As the KB article says, browse time is not tracked by site, only by user and client IP. The browse time is divided among the requests for the browseing session for that user. All of this can be a bit long to explain so I'll skip it intentionnaly. What I can say is that if you include browse time with anything other than client IP and/or user name, it will not be an accurate value.
1) yes, a hit is one request. If you do not have page views enabled on your log parsing options, then hits will be greatly inflated. Consider www.mcafee.com. Our home page has around 30 requests to mcafee.com for images, java scripts, stylesheets, etc. Each of those would be a hit for www.mcafee.com unless you disable page views. Similarly, if you are blocking based on content type (ex. streaming media) or category (ex. advertising) then some of the content on the page could be blocked, while the main body of the page is still allowed. If you run a detailed report for blocked urls it should become more clear to you.
3) This would require inspection of the policy on the gateway. For example, if you have a whitelist rule above the category block rule, then it's possible that the requests are not blocked. Essentially this is likely due to something in your gateway policy that would need to be found.
4) This document might help explain. https://community.mcafee.com/docs/DOC-4662
5) Make sure you run index maintenance on a regular basis. That is the most common problem. Keep in mind that there is almost nothing on the Web Reporter server side that helps with report performance. Reports are run on the database and the report speed relies on the DB, which is why it is important to keep indexes defragmented and statistics up to date.
Thank you for your reply.
1.) You are saying that a page could have many request depending on the elements the page consist and some of these elements are blocked. So for example a webpage is consisting 30 elements and 15 of those elements are blocked the report that web reporter will generate will be:
15 Hits - Allowed
15 Hits - Blocked
b.) If a page has many request then for example www.google.com has frame elements from facebook which has no social networking allowed on one user then there would be a count for www.facebook.com that will be reported as blocked?.
3.) Why does www.facebook.com has a hits - allowed on a client that belongs to a group that has no social networking sites are blocked and no facebook on the whitelist?
5.) How can I defragment the indexes and statistics on the MySQL DB of Web reporter?
1 & 3) I cannot answer that without looking at the gateway policy and getting example urls that were not handled as you expected. I would also know what you wanted to happen, such as block by category or blocked by media type, etc.
5) On the db maintenance config you should see an option to run index maintenance with DB maintenance. Make sure that is enabled. If you don't see it upgrade to the latest version and it will be there.
5.) Navigating on the menus of web reporter is also slow on redhat server compared to windows server.
Give the Web Reporter JVM more memory. Either 1536 MB or 2048 MB should help.