5 Replies Latest reply on Mar 12, 2013 8:23 AM by sroering

    Web reporter

      Hi,

       

      I have a Web reporter version 5.2.x and I run the default query "Summary - Overview of All Activity (Top10)" and have a custom filter to show only the reports from January 1, 2013 up to January 31, 2013. When I checked the: Summary: Top 10 Sites by Browse Time and Summary: Top 10 Users by Browse Time The reports have a top ten sites and the browse time is "369 days 5 hours 57 minutes 41 seconds". How can it have that amount of browse time when suppossed to be it will have a maximum of 31 days only?

       

      1.) I tried to create a query base on the KB64344:Recommended Method for Correlating User Browse Time with Websites or Categories and modified it to show number of: Hits, Hits - Allowed and Hits - Blocked My question is what is Hits?, is it the number of times the user went to that site? and why is it that www.yahoo.com shows 170,000 Hits - Allowed and 100,000 Hits - Blocked? Why does it have a Hits allowed and hits blocked at the same time?

       

      3.) One user belongs to a group that Social networking sites are blocked. The report shows that it has hits - allowed and hits - blocked. What do you mean by hits allowed and hits blocked? Why is it appearing to have allowed and blocked at the same time?

       

      4.) How hits are counted is it per page or it also counts frames on a page that was allowed/blocked?

       

      5.) I have a 4GB RAM, Quadcore processor, Redhat version 5.5 and set the Java to use 2GB. Why is it it runs very slow particularly on quick view which is the main page of web reporter but when it is on a windows server 2003 environment it runs ok. What can I do to make it faster and can I also set a different main page?.

        • 1. Re: Web reporter
          sroering

          As the KB article says, browse time is not tracked by site, only by user and client IP.  The browse time is divided among the requests for the browseing session for that user. All of this can be a bit long to explain so I'll skip it intentionnaly. What I can say is that if you include browse time with anything other than client IP and/or user name, it will not be an accurate value.

           

          1) yes, a hit is one request. If you do not have page views enabled on your log parsing options, then hits will be greatly inflated.  Consider www.mcafee.com. Our home page has around 30 requests to mcafee.com for images, java scripts, stylesheets, etc.  Each of those would be a hit for www.mcafee.com unless you disable page views.  Similarly, if you are blocking based on content type (ex. streaming media) or category (ex. advertising) then some of the content on the page could be blocked, while the main body of the page is still allowed.  If you run a detailed report for blocked urls it should become more clear to you.

           

          3) This would require inspection of the policy on the gateway.  For example, if you have a whitelist rule above the category block rule, then it's possible that the requests are not blocked. Essentially this is likely due to something in your gateway policy that would need to be found.

           

          4) This document might help explain.  https://community.mcafee.com/docs/DOC-4662

           

          5) Make sure you run index maintenance on a regular basis. That is the most common problem.  Keep in mind that there is almost nothing on the Web Reporter server side that helps with report performance.  Reports are run on the database and the report speed relies on the DB, which is why it is important to keep indexes defragmented and statistics up to date.

          • 2. Re: Web reporter

            Hi sroering,

                            Thank you for your reply.

             

            1.) You are saying that a page could have many request depending on the elements the page consist and some of these elements are blocked. So for example a webpage is consisting 30 elements and 15 of those elements are blocked the report that web reporter will generate will be:

             

             

            15 Hits - Allowed

            15 Hits - Blocked

             

             

            b.) If a page has many request then for example www.google.com has frame elements from facebook which has no social networking allowed on one user then there would be a count for www.facebook.com that will be reported as blocked?.

             

             

            3.) Why does www.facebook.com has a hits - allowed on a client that belongs to a group that has no social networking sites are blocked and no facebook on the whitelist?

             

             

            5.) How can I defragment the indexes and statistics on the MySQL DB of Web reporter?

            • 3. Re: Web reporter
              sroering

              1 & 3) I cannot answer that without looking at the gateway policy and getting example urls that were not handled as you expected.  I would also know what you wanted to happen, such as block by category or blocked by media type, etc. 

               

              5) On the db maintenance config you should see an option to run index maintenance with DB maintenance.  Make sure that is enabled. If you don't see it upgrade to the latest version and it will be there.

              • 4. Re: Web reporter

                5.) Navigating on the menus of web reporter is also slow on redhat server compared to windows server.

                • 5. Re: Web reporter
                  sroering

                  Give the Web Reporter JVM more memory.  Either 1536 MB or 2048 MB should help.