Analyzer Resources
Analyzer's resource area includes:
View an extensive range of Analyzer sample reports
Read the most FAQ for Analyzer
Watch Analyzer demonstrations
Book Online Demo with a WebSpy representative
Read WebSpy's informative white papers
Sample Reports
The following reports can be created using WebSpy's Analyzer range.
Please note: these HTML reports can only be viewed using Internet Explorer.
Web Reports
- Department Activity
- Large Downloads
- Organization
- Productivity
- Unacceptable File Downloads
- Unproductive Browsing
- User Activity
Email Reports
- Department Email Activity
- Email Productivity
- Organization Email Usage
- Productivity
- Organization Web and Email Activity
- Unproductive Email
- User Email Activity
Analyzer FAQs
I've noticed differences in total Browsing Time values displayed throughout Analyzer. For example, if I drilldown to Users, I can see the Browsing Time for a particular user, but if I drilldown into that user to see the sites they've visited, the Total Browsing Time at the bottom of the screen is different. Why?
It's not unusual for the browsing time for a list of sites to be different to the total browsing time for the user that visited those sites. The reason for the difference is that you could have multiple sites open at the same time, or you may have visited some sites for less than 1 second.
This is one way this behavior could happen: if I go to www.webspy.com and browse that site from 12:00 to 12:05, then that would be 5 minutes browsing time for that session, and 5 minutes for www.webspy.com.
However, if at the same time I open a second browser window to www.cnn.com, and also browse that site from 12:00 to 12:05, then in total my user and session browsing time would still be only 5 minutes, but the total browsing time for sites would be 10 minutes, as there is 5 minutes on www.webspy.com and 5 minutes on www.cnn.com.
Alternatively, if you visit www.webspy.com only at 12:00:01 and www.cnn.com at only 12:04:01, then the browsing time for www.webspy.com would be 0 seconds, and the browsing time for www.cnn.com would also be 0 seconds, however the browsing time for the user would be 4 minutes.
This is why browsing time for sites can be very different to browsing time for users, sessions and dates.
How is Browsing Time calculated?
Browsing Time is the estimated time a user spent browsing the web. In addition to Users, you can view the Browsing Time for Sites (the total time spent browsing a site), Dates (the total time spent browsing on a particular date), Sessions (the total time of a browsing session) and Departments (the sum of all the department's user's browsing time).
Browsing Time is calculated by looking at the date/time stamp of each hit, and then grouping the hits into sessions. The total time of one session is calculated as the time between the first and last hits of the session.
Hits are grouped into the same session if they occur within five minutes of each other. If there is a break of more than five minutes with no hits made, then the previous session is finished and a new session is started when the next hit is made. The five minute 'Session Threshold' value can be changed in Tools | Options | Summaries (see Summaries Options).
Browsing Time should not be confused with Download Time which is the time taken to download a resource from the web site.
I deleted a log file from Folders and Files view in Storages, but the number of hits in the storage is still the same. Why?
You need to 'Reload all hits' after deleting files or folders as there is no relationship between the hits imported and the folder / file structure in Storages. This means that the hits associated with a log file in your storage will still be represented in Reports, even though that log file has been deleted. The functionality to delete log files and folders is for advanced users that have deleted periods such as Dates, Weeks, or Months from their storage, and know which log files these hits originated from. Deleting periods such as Dates, Weeks, and Months will delete the hits from your storages, but they will be reloaded next time you 'Reload all hits', unless the log files that the hits originated from are also deleted from the storage.
Reloading the Hits in one particular file of folder by right-clicking the file/folder and selecting Reload should be avoided, as this will duplicate the info in your storages. The safest way to reload data is by 'Reloading all hits'.
My logging device logs in GMT (UTC). How can I report on my log file using my local time zone?
You can set the time zone offset when importing your log files. Go to Storages, create a new storage and import logs into the storage. When you are on the Input Format page of the Import Wizard, select the format of your log files and click the Format Properties button on the toolbar. Select the appropriate time zone offset from the 'Time Zone' drop down list and click OK. Proceed through the Import Wizard to import your logs. When you analyze or report on the logs, your times will be displayed in your current time zone.
I am having trouble opening WSR reports on my 2003 server, is there something I can do to fix this problem?
Windows 2003 Servers have special security settings that block the WSR files from opening correctly. To open WSR reports on a Windows 2003 Server you will need to turn off "Secure Browsing". To do this go to Control Panel | Add/Remove Programs | Add/Remove Windows Components, then double-click 'Internet Explorer Enhanced Security Configuration' and clear the checks for administrators or all users as appropriate.
Can I create reports for each of my organization's departments?
Yes, you can create separate reports for each department. You can even schedule these reports to run and be emailed to the appropriate manager automatically.
I want all my reports to be accessible from a web site. How do I schedule a 'Publish to web' task?
Create a task with a 'Run a Report' action. Proceed through the Report Wizard ensuring the report format is set to Web Document. On the Publish page of the Report, choose 'Copy Report to a location'. On the next page enter the website directory where you would like the files copied to, and click the 'Extract' checkbox. This will extract all the HTML pages directly to your website's directory. All you then need to do is link to the index page for each report from your web page. This page has the same name as your report with the extension .html. This process will also create a subfolder of the same name containing all the graphics and other pages required to make up the report.
How do I set up a daily task to import yesterday's logs into a new storage and run a report on that storage?
To do this you need to set up an import action to only import yesterday's logs into a new storage with the current date prefixed to the storage name, and then set a report action to report on the storage with the current date prefixed to the storage name. You then need to schedule these two actions to run on the same day. Go to Tasks and select "New Task Dialog" to launch the Task Dialog.
Adding the import action:
- Click the Actions Tab and select Add | Import log files into new storage. This launches the Import Wizard. Click Next.
- On the Storage page, enter a name for your storage such as 'Daily Storage' and check the 'Prefix with the current date' checkbox. This will insert the current date at the start of each storage name. Click Next.
- On the Input Format page, select the format of your log files and click Next.
- On the Input Location page, select Add | Folder and navigate to the folder where your logging device stores its log files. Click OK to launch the Folder Properties dialog. On the Folder Properties dialog ensure the checkboxes 'Use this folder when importing new hits' and 'Search this folder for new files when importing new hits' is checked. Click OK. Click Next.
- On the Select page, check the 'Select Dates' checkbox. Click Next.
- On the Select Dates page, check the 'Show past' checkbox, and enter 1 Days in the edit and dropdown boxes. Do not check the 'Include current day' checkbox. This filter will ensure that only yesterday's logs are imported. Click Next and then click Finish on the final page of the Import Wizard.
Adding the report action:
- On the Actions tab of the Task dialog, click Add | Run a report.
- On the Report Types page, select the type of report you want to run on the daily storage. Click Next.
- On the storages page, check the checkbox next to the storage you named in step 2 of Adding the import action (for example, select '[date] Daily Storage'). Ensure no other storages are selected. Click Next.
- Proceed through the Report Wizard selecting the report requirements for your daily report. Hint: You can set the report to be emailed to you when it is generated on the Publish page on the Report Wizard.
Schedule the actions to run on the same day:
- On the Task Dialog, click the Schedule tab and click the Add button on the toolbar. This launches the Schedule Wizard. Click Next.
- On the Period page, select 'Daily'. Click Next.
- On the Daily page, select the date from when you would like the task to begin. Select the time you would like the task to run on each day. Note: if you are importing a lot of data, ensure you set an appropriate start time to allow both task actions to run on the same day. Enter "1" to perform this task every day. Click Next.
- On the Account login page, enter your login details so the task can run when you are logged out of your PC. Click Next and click Finish on the final page of the wizard.
Finally, click the General Tab of the Task Dialog and give the task a name such as 'Daily Task' and ensure the 'Allow this task to run as scheduled' checkbox is checked. Click OK.
Analyzer is pretty neat. However, since my logs don't always get the DNS name of the sites, it makes it a real pain to see what sites the users have been browsing. When it only shows the IP address I have to browse to the website just to see where they have been. That becomes too time consuming. Is there anything that can be done about this?
Analyzer has the ability to Resolve IPs when you are looking at Sites. Simply go to Summaries and drilldown into Sites, then click the Resolve IPs link in the Advanced task pad. You will need to select an alias to resolve the IPs into such as 'Sitenames'. Once the resolve has finished, select the alias you resolved the IPs into in the Aliases task pad. Any resolved IPs will now be displayed by their resolved DNS name.
However, the Resolve IPs functionality in Analyzer simply contacts your DNS server to resolve the IPs. If your logging device couldn't find a resolved DNS name, then it is unlikely that Analyzer will find it. You could use a web resource like www.samspade.org to determine site names, or try optimizing your local DNS server.
Is it necessary to install Analyzer per client on the workstation side?
All WebSpy software is designed to be installed on workstation PCs. You only need to install a WebSpy application in one place on your network in order to monitor the entire network. So if you have only one proxy device or firewall, you will only need to install a WebSpy product on one PC and point it to where the logs are located.
When reporting on some users, some of the sites they've visited are showing up as 'Unspecified'. What does this mean?
When Analyzer displays a site name as ‘Unspecified’ it means that no site name or site IP address was recorded in the log file. You may still be able to drilldown on the Unspecified site to Resources. If there are resources, then this usually means that the site is your own website and your logging device does not log its name.
How does Analyzer calculate download time?
Most servers records the time it took to download the specific resource associated with a hit. When looking at Users, Analyzer calculates the Download Time column by adding up these times for all of the resources (hits) that user downloaded. A user could be downloading multiple resources simultaneously, e.g. by having multiple browser windows open at the same time.
Why are sites listed, even though I don't remember visiting them?
Sometimes websites use pictures or other files that are stored on a different website. Whenever this happens, your Internet browser will request the files stored elsewhere and then display them as part of the website you are viewing. However, the original location of each file, not where you viewed the file, is listed in your proxy log files, and Analyzer uses those log files to generate your summaries and reports. For example, www.webspy.com/index.asp may reference an image at www.www.isaserver.org/images/logo.gif. This second site and resource is recorded in your log file and therefore Analyzer displays this site, even though you did not go directly to www.www.isaserver.org.
My Scheduled Tasks do not run anymore. Why?
The most common reason for this is that you have changed your logon password. If you change your logon password for the computer that runs your tasks, you will need to modify each scheduled task so that it uses the new password. If you do not, the task will not run at all.
To do this, open the Edit task dialog for each task by double-clicking on the task's name, go to the Schedules tab and double click the schedule to launch the Schedule Wizard. Proceed through the wizard to the Account Details page, and update your details as necessary. Once you have finished the wizard your task will run as before.
