Citrix Systems Citrix MetaFrame Application for Windows 1.8 - Manual (Page 133)

$SSHQGL[ $ 0HWD)UDPH &RPPDQG 5HIHUHQFH 
/write:filename
Specifies the name of an output file. Creates a comma-delimited file that can
be imported into an application such as a spreadsheet to produce custom
reports or statistics. It generates a report of logon/logoff activity for each user,
displaying logon/logoff times and total time logged on.
If filename exists, the data is appended to the file.
/time
Generates a report of logon/logoff activity for each user, displaying
logon/logoff times and total time logged on. Useful for gathering usage
statistics by user.
/fail
Generates a report of all failed logon attempts.
/all
Generates a report of all logon/logoff activity.
/detail
Generates a detailed report of logon/logoff activity.
/clear:filename
Saves the current event log in filename and clears the Event Log. This
command will not work if filename already exists.
/? (help)
Displays the syntax for the utility and information about the utility’s options.
5HPDUNV
Auditlog gives you a powerful tool to verify and maintain system security and
correct usage. The information can be extracted as reports or as comma-delimited
files that can be used as input to other programs.
You must enable logon/logoff accounting on the local machine in order to collect
the information used by auditlog. To enable logon/logoff accounting, logon as a
local administrator and start User Manager for Domains. On the User menu, click
Select Domain. Enter the name of the local machine and click OK. On the
Policies menu, click Audit and check the Logon Success and Failure boxes.
Click OK to save your changes.