Real-time user activity/session tracking not working as expected

[mountaindude]

Describe the bug
Butler includes a Log4Net appender XML file that when deployed to a QSEoW server is supposed to provide Butler with information about starting and ending sessions.
This has worked in the past but in recent (tested Nov 2020) versions of QSEoW it partly fails.

The file in question is https://github.com/ptarmiganlabs/butler/blob/master/docs/log4net_user-audit-event/LocalLogConfig.xml.

Correct session messages are still sent to Butler, but there are also many, many incorrect messages sent by that XML file. Possibly QSEoW has changed logging in recent versions and now log more than earlier.

The result is that Butler receives (and forwards to for example Slack) messages such as

Expected behavior
The log appender xml file should only send valid session events to Butler.

[mountaindude]

The easy solution is to add filtering to the xml file so that only session start/stop events are forwarded to Butler:

<?xml version="1.0"?>
<configuration>
    <appender name="NodeUserLogger" type="log4net.Appender.UdpAppender">
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="Start session" />
        </filter>
        <filter type="log4net.Filter.StringMatchFilter">
            <param name="stringToMatch" value="Stop session" />
        </filter>
        <filter type="log4net.Filter.DenyAllFilter" />
        ...
        ...

[mountaindude]

Fixed in coming 5.0 release.