Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 5 subscribers
  • Views 8872 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Wrong values in reports Total User By Time

eclipse79

Hello,

I have a client that constantly monitors the status of some web sites. It runs h24. In daily reports -> Web Usage -> TOP10 Users by time it is obviously at first position, but I noticed that the value is 27 hours... 27?! It seems also that other clients that are ON for 8 hours spent 10hours in web usage... How is calulated this value? 

 

Thanks

eclipse79



This thread was automatically locked due to age.
  • 0

    Interesting question!  I wonder if you started streaming movies in two separate windows if both would be counted.

    I just checked.  I leave my desktop on all of the time and RDP into it occasionally.  I had one window of Firefox open on it yesterday with two tabs.  My only activity was checking what Notifications had been received from a client's UTM in Texas - a minute or two at most.  Reporting shows over 25h35m for that device in Web Protection.  The data volume came primarily from mozilla.org though, so probably Firefox updates.

    Hopefully, one of the Sophos folks will come by to enlighten us.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    uhm... I'm seeing some other strange things in reports... Do you ever seen "Top Application" entries that are listed in executive reports, but not in Web Protection->Application control?

    I have SoundCloud for 1,4gb (in executive report9, that is not listed in web application logs...

  • 0

    1) Based on your data, I am guessing that UTM is charging for elapsed time, which accumulates as long as the user does something on the site new within a fixed time period.   The goal is to monitor the amount of time that his eyes are on the site, not the amount of workload generated by the site.   To my knowledge, this algorithm is not published for UTM.  I used to run a Sophos Web Appliance, and I think an algorithm like this may have been published in its documentation.  But Sophos Support would be the best source for the truth.

    2) If the user has more than one tab active, elapsed time could (and arguably should) accumulate on each tab, in parallel. 

    3) Most websites fire off additional web requests to load web elements, style sheets, images, and who knows what else.   These operations might also trigger either actual or elapsed time accumulations, and can presumably accumulate in parallel.

    So I am guessing that there is an explanation, but probably not something that Sophos will have any appetite to fix.

     

  • 0

    Hi Eclipse,

    Instead of guessing the probabilities, I would suggest, raise a case in support and PM me the case#.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Unfiltered HTML