Welcome to the Frequently Asked Questions page. Below you will find a list of
questions that our sales and support teams are asked on a regular basis. If you
have a question you need answering, chances are it is already is in the list
below.
To view the questions related to a particular area, please select the area from
the drop down list below:
General
Analyzer
Sentinel
Live
Insight for Microsoft SBS Premium
Log File Support
Trial Versions
Registration
Terminology
Can WebSpy software do blocking and filtering?
No, our software is designed solely for monitoring. Our software can be used proactively to reduce Internet misuse and can be used in conjunction with a firewall to identify sites that need to be blocked.
Does WebSpy software act as a Proxy Server?
Vantage, Analyzer and Live are designed to read log files from a proxy server, firewall or
mail server. If you do not have a logging device available, we have 3 solutions
available for you: WebSpy Sentinel contains a packet sniffer and logs
Internet and Email activity; this does not act as a proxy server. WebSpy
FlowMonitor collects and logs NetFlow output from Cisco Routers, and is designed
for byte accounting; this also is not a proxy server. You may also consider implementing a third parth proxy device such as Squid (free).
Will WebSpy work with my Mac?
WebSpy products will only run on computers running Windows® operating systems.
However, WebSpy products can be used to monitor any network, as long as the
program itself is installed on a Windows computer and can access any necessary
log files.
Most of my websites get classified as 'Miscellaneous'. How do I improve WebSpy's URL categorization?
In your summaries section, run an analysis, then go to Site Profiles/Profiles
Right click on the 'Miscellaneous' profile in the list and choose Drilldown | Sites/Site Name
All sites that have not been categorized will be displayed
Sort sites by hits or size by clicking the column header
To categorize a site, right-click it and choose ‘Include In Profile’
Select an existing profile from the list, or type the name of your new profile into the box
Repeat this for all sites you want to categorize (typically the top 10-20 sites)
Regularly repeat this procedure to increase categorization accuracy
» Back to top
I've noticed differences in total Browsing Time values displayed throughout
Analyzer. For example, if I drilldown to Users, I can see the Browsing Time for
a particular user, but if I drilldown into that user to see the sites they've
visited, the Total Browsing Time at the bottom of the screen is different. Why?
It's not unusual for the browsing time for a list of sites to be different to the
total browsing time for the user that visited those sites. The reason for the
difference is that you could have multiple sites open at the same time, or you
may have visited some sites for less than 1 second.
This is one way this behavior could happen: if I go to www.webspy.com and browse
that site from 12:00 to 12:05, then that would be 5 minutes browsing time for
that session, and 5 minutes for www.webspy.com
However, if at the same time I open a second browser window to www.cnn.com, and
also browse that site from 12:00 to 12:05, then in total my user and session
browsing time would still be only 5 minutes, but the total browsing time for
sites would be 10 minutes, as there is 5 minutes on www.webspy.com and 5 minutes
on www. cnn.com.
Alternatively, if you visit www.webspy.com only at 12:00:01 and www.cnn.com at
only 12:04:01, then the browsing time for www.webspy.com would be 0 seconds, and
the browsing time for www.cnn.com would also be 0 seconds, however the browsing
time for the user would be 4 minutes.
This is why browsing time for sites can be very different to browsing time for
users, sessions and dates.
How is Browsing Time calculated?
Browsing Time is the estimated time a user spent browsing the web. In addition to
Users, you can view the Browsing Time for Sites (the total time spent browsing a
site), Dates (the total time spent browsing on a particular date), Sessions (the
total time of a browsing session) and Departments (the sum of all the
department's user's browsing time).
Browsing Time is calculated by looking at the date/time stamp of each hit, and
then grouping the hits into sessions. The total time of one session is
calculated as the time between the first and last hits of the session.
Hits are grouped into the same session if they occur within five minutes of each
other. If there is a break of more than five minutes with no hits made, then the
previous session is finished and a new session is started when the next hit is
made. The five minute 'Session Threshold' value can be changed in Tools |
Options | Summaries (see Summaries Options).
Browsing Time should not be confused with Download Time which is the time taken
to download a resource from the web site.
I deleted a log file from Folders and Files view in Storages, but the number of
hits in the storage is still the same. Why?
You need to 'Reload all hits' after deleting files or folders as there is no
relationship between the hits imported and the folder / file structure in
Storages. This means that the hits associated with a log file in your storage
will still be represented in Reports, even though that log file has been
deleted. The functionality to delete log files and folders is for advanced users
that have deleted periods such as Dates, Weeks, or Months from their storage,
and know which log files these hits originated from. Deleting periods such as
Dates, Weeks, and Months will delete the hits from your storages, but they will
be reloaded next time you 'Reload all hits', unless the log files that the hits
originated from are also deleted from the storage.
Reloading the Hits in one particular file or folder by right-clicking the
file/folder and selecting Reload should be avoided, as this will duplicate the
info in your storages. The safest way to reload data is by 'Reloading all hits'.
My logging device logs in GMT (UTC). How can I report on my log file using my
local time zone?
You can set the time zone offset when importing your log files. Go to Storages,
create a new storage and import logs into the storage. When you are on the Input
Format page of the Import Wizard, select the format of your log files and click
the Format Properties button on the toolbar. Select the appropriate time zone
offset from the 'Time Zone' drop down list and click OK. Proceed through the
Import Wizard to import your logs. When you analyze or report on the logs, your
times will be displayed in your current time zone.
I am having trouble opening WSR reports on my 2003 server, is there something I
can do to fix this problem?
Windows 2003 Servers have special security settings that block the WSR files from
opening correctly. To open WSR reports on a Windows 2003 Server you will need to
turn off "Secure Browsing". To do this go to Control Panel | Add/Remove Programs
| Add/Remove Windows Components, then double-click 'Internet Explorer Enhanced
Security Configuration' and clear the checks for administrators or all users as
appropriate.
Can I create reports for each of my organization's departments?
Yes, you can create separate reports for each department. You can even
schedule these reports to run and be emailed to the appropriate manager
automatically.
I want all my reports to be accessible from a web site. How do I schedule a
'Publish to web' task?
Create a task with a 'Run a Report' action. Proceed through the Report Wizard
ensuring the report format is set to Web Document. On the Publish page of the
Report, choose 'Copy Report to a location'. On the next page enter the website
directory where you would like the files copied to, and click the 'Extract'
checkbox. This will extract all the HTML pages directly to your website's
directory. All you then need to do is link to the index page for each report
from your web page. This page has the same name as your report with the
extension .html. This process will also create a subfolder of the same name
containing all the graphics and other pages required to make up the report.
How do I set up a daily task to import yesterday's logs into a new storage and run a report on that storage?
Adding the import action:
Click the Actions Tab and select Add | Import log files into new storage . This launches the Import Wizard. Click Next .
On the Storage page, enter a name for your storage such as 'Daily Storage' and check the 'Prefix with the current date' checkbox. This will insert the current date at the start of each storage name. Click Next .
On the Input Format page, select the format of your log files and click Next .
On the Input Location page, select Add | Folder and navigate to the folder where your logging device stores its log files. Click OK to launch the Folder Properties dialog. On the Folder Properties dialog ensure the checkboxes 'Use this folder when importing new hits' and 'Search this folder for new files when importing new hits' is checked. Click OK . Click Next .
On the Select page, check the 'Select Dates' checkbox. Click Next .
On the Select Dates page, check the 'Show past' checkbox, and enter 1 Days in the edit and dropdown boxes. Do not check the 'Include current day' checkbox. This filter will ensure that only yesterday's logs are imported. Click Next and then click Finish on the final page of the Import Wizard.
Adding the report action:
On the Actions tab of the Task dialog, click Add | Run a report .
On the Report Types page, select the type of report you want to run on the daily storage. Click Next .
On the storages page, check the checkbox next to the storage you named in step 2 of Adding the import action (for example, select '[date] Daily Storage'). Ensure no other storages are selected. Click Next .
Proceed through the Report Wizard selecting the report requirements for your daily report. Hint: You can set the report to be emailed to you when it is generated on the Publish page on the Report Wizard.
Schedule the actions to run on the same day:
On the Task Dialog, click the Schedule tab and click the Add button on the toolbar. This launches the Schedule Wizard. Click Next .
On the Period page, select 'Daily'. Click Next .
On the Daily page, select the date from when you would like the task to begin. Select the time you would like the task to run on each day. Note: if you are importing a lot of data, ensure you set an appropriate start time to allow both task actions to run on the same day. Enter "1" to perform this task every day. Click Next .
On the Account login page, enter your login details so the task can run when you are logged out of your PC. Click Next and click Finish on the final page of the wizard.
Finally, click the General Tab of the Task Dialog and give the task a name such
as 'Daily Task' and ensure the 'Allow this task to run as scheduled' checkbox is
checked. Click OK.
Analyzer is pretty neat. However, since my logs don't always get the DNS name of
the sites, it makes it a real pain to see what sites the users have been
browsing. When it only shows the IP address I have to browse to the website just
to see where they have been. That becomes too time consuming. Is there anything
that can be done about this?
Analyzer has the ability to Resolve IPs when you are looking at Sites. Simply go
to Summaries and drilldown into Sites, then click the Resolve IPs link in the
Advanced task pad. You will need to select an alias to resolve the IPs into such
as 'Site names'. Once the resolve has finished, select the alias you resolved the
IPs into in the Aliases task pad. Any resolved IPs will now be displayed by
their resolved DNS name.
However, the Resolve IPs functionality in Analyzer simply contacts your DNS
server to resolve the IPs. If your logging device couldn't find a resolved DNS
name, then it is unlikely that Analyzer will find it. You could use a web
resource like www.samspade.org to determine site names, or try optimizing your
local DNS server.
Is it necessary to install Analyzer per client on the workstation side?
All WebSpy software is designed to be installed on workstation PCs. You only need
to install a WebSpy application in one place on your network in order to monitor
the entire network. So if you have only one proxy device or firewall, you will
only need to install a WebSpy product on one PC and point it to where the logs
are located.
When reporting on some users, some of the sites they've visited are showing up
as 'Unspecified'. What does this mean?
When Analyzer displays a site name as <Unspecified>
it means that no site name or
site IP address was recorded in the log file. You may still be able to drilldown
on the Unspecified site to Resources. If there are resources, then this usually
means that the site is your own website and your logging device does not log its
name.
How does Analyzer calculate download time?
Most servers record the time it took to download the specific resource
associated with a hit. When looking at Users, Analyzer calculates the Download
Time column by adding up these times for all of the resources (hits) that user
downloaded. A user could be downloading multiple resources simultaneously, e.g.
by having multiple browser windows open at the same time.
Why are sites listed, even though I don't remember visiting them?
Sometimes websites use pictures or other files that are stored on a different
website. Whenever this happens, your Internet browser will request the files
stored elsewhere and then display them as part of the website you are viewing.
However, the original location of each file, not where you viewed the file, is
listed in your proxy log files, and Analyzer uses those log files to generate
your summaries and reports. For example, www.webspy.com/index.asp may reference
an image at www.isaserver.org/images/logo.gif. This second site and
resource is recorded in your log file and therefore Analyzer displays this site,
even though you did not go directly to www.isaserver.org.
My Scheduled Tasks do not run anymore. Why?
The most common reason for this is that you have changed your logon password. If
you change your logon password for the computer that runs your tasks, you will
need to modify each scheduled task so that it uses the new password. If you do
not, the task will not run at all.
To do this, open the Edit task dialog for each task by double-clicking on the
task's name, go to the Schedules tab and double click the schedule to launch the
Schedule Wizard. Proceed through the wizard to the Account Details page, and
update your details as necessary. Once you have finished the wizard your task
will run as before.
» Back to top
Do I need to install Sentinel Service on every computer that I want to monitor?
You don't have to install Sentinel Service on every computer on your network. For
most networks, Sentinel Service only needs to be installed on one computer,
which can 'see' all of your network's Internet traffic. To determine which
computer on your network should act as your Sentinel Server, please consult
Sentinel's Planning and Installation Guide.
Does Sentinel capture passwords?
If Sentinel captures data in an email, telnet or FTP session containing a
password that isn't encrypted (i.e. the email is in plain text), that password
can be found in the log files Sentinel creates. Passwords sent via the web, or
in a news item are also available from Sentinel's log files if the passwords
were not encrypted. Passwords sent over a secure connection such as secure web
(HTTPS) or secure telnet (SSH) are not obtainable from the log files. Because of
the possibility of captured passwords, you should implement NT folder security
where appropriate. You should also consider how capturing passwords fits in with
your organization's Internet usage and privacy policies.
» Back to top
How do I get rid of an Alert from the Live Status window?
In Live Status, you can right-click on an alert to dismiss or display alert
details. Select these options from the pop-up menu that is displayed.
I currently use WebSpy Analyzer and Live, and I use exactly the same Usernames,
Departments and Profiles for both applications. Every time I make a change to my
Departments, Usernames or Profiles in Analyzer, I need to go into Live and make
the same change again. Is there an easy way of keeping these synchronized
without making each change twice?
Yes there is. In WebSpy Analyzer, Select Tools | Options from the main menu. On
the General Tab, check the 'Keep Profiles and Aliases synchronized between
WebSpy applications' checkbox and click OK. In WebSpy Live select Tools |
Options from the main menu on the Live Configuration window. On the General Tab,
check the 'Keep Profiles and Aliases synchronized between WebSpy applications'
checkbox and click OK. When ever you make a change to your aliases or profiles
in either application, the change will be made to the other application's
aliases and profiles as well.
» Back to top
Is Insight just making a copy of all the ISA data on my PC and if so is it
compressed? What's the best way to manage this?
Yes. Insight imports ISA data into its own internal storage folder located in
C:\Documents and Settings\your user profile\Local Settings\Application
Data\WebSpy\Insight for Microsoft SBS Premium 1.0 The storage will be smaller
than ISA's MSDE log database, but it is not compressed.
You can apply NTFS compression to the storage folder to reduce the disk space. To do this:
Go to C:\Documents and Settings\Your User Profile\Local Settings\Application Data\WebSpy\Insight for Microsoft SBS Premium 1.0 , right-click the storage folder and select 'Properties'
On the General Tab, click the Advanced button and check the 'Compress contents to save disk space' check box.
Click OK , then click Apply .
Select 'Apply changes to this folder, subfolders and files' and click OK .
This should reduce the storage size by about 25%.
You should also purge old data (data that you are no longer interested in
analyzing) from your storage. You can always collect it again later if required
by clicking the 'Collect data' link. Removing old data will reduce your storage
size and improve the speed of analysis and reporting.
To purge old data:
Click the Remove collected data link in the Configuration task pad.
Check the dates that you are no longer interested in analyzing.
Click OK . An analysis will run automatically to remove the periods from the Web usage, Security overview, and Email activity views.
Do I have to collect data each time I open Insight to get the latest data?
Yes. Insight doesn't automatically collect new data when it starts. You need to
manually collect new data. Insight will automatically run a new analysis once
the data has been collected.
To get the latest data you click the 'Collect data' link in the Configuration task pad. There are two ways to get the new data:
Select ‘Collect all Available data' and check 'Clear existing data before collecting new data' (this option will re-import everything and take may take a while)
If you know which dates have already been imported into Insight, you can select 'Collect data for these dates' and select the dates that contain the new data. Uncheck 'Clear existing data before collecting new data' so that your existing data is retained and click OK .
Both options will import the new data and automatically run a new analysis.
» Back to top
I have a Microsoft ISA server and I am only interested in viewing web usage.
Which logs should I import?
If you only want to view web usage, you should only import log files with WEB in the name of the file. The FWS log files are firewall activity logs, and the IPP log files
are packet filter logs (which Analyzer cannot load).
Can Microsoft ISA logs be saved to a different location other than on the
server?
Yes, it is possible to change the location of the log files.
Launch ISA Management
Go to Monitoring Configuration | Logs
Open the Properties for the 'ISA Server Web Proxy Service'
Click the Options button
Select 'other folder'
Enter the desired network path for the log files
The user that the ISA service is configured to run as will need write permissions
to the target folder.
It doesn't look as though WebSpy software supports my log file format but I
would still like to evaluate the software. Is this possible?
Please email a sample log file to support@webspy.com and we will endeavor to add
support for you.
I am trying to import my Microsoft Exchange log files into Analyzer Premium, but
it comes back with errors like found 1 field was expecting 19. How do I set up
Analyzer Premium to import my logs correctly?
Analyzer Premium supports the Microsoft Exchange tracking log format. If you are
importing anything other than these logs, Analyzer Premium may report the errors
you mentioned. The tracking logs are usually stored in a folder called "SERVERNAME .LOG", where SERVERNAME is the name of your Exchange server. The log files are named after the date
they were created in yyyymmdd.log format, e.g. 20031216.log would be today's
file.
If you can't find this folder or files like this on your Exchange server the
logging may not be enabled yet. What you need to do is enable message tracking.
» Back to top
I downloaded a 30-day trial of WebSpy, installed it and then forgot about it. I
would still like to evaluate the program but my 30 days have run out. What can I
do?
Please contact the WebSpy Development Team at support@webspy.com, and we will
organize another 30-day trial for you.
» Back to top
I had to re-install WebSpy, and it is asking me for another Unlock Code. I put
in the one you gave me, but it doesn't work. What now?
Each Unlock Code is only valid once, so every time you re-install Analyzer you
will need to request a new Unlock Code. Simply go through the Registration
Wizard again, and submit your details to us, and we will be able to generate a
new Unlock Code for you.
» Back to top
What is a "hit"?
When looking at web data, a hit is defined as any single resource downloaded from
a website. When looking at email data, a hit is defined as a single email. A web
page can consist of many different files; graphic files, html files, scripts,
stylesheets etc. Each file is downloaded separately by the proxy server and
recorded on a different line in the log file. Analyzer therefore counts each
file as separate hit. A popup would count as at least 1 hit.
What is meant by IAU policy?
An IAU policy is the acronym used for Internet Acceptable Usage policy. This is
the publicly made available document to all new and existing employees of an
organization that clearly and succinctly explains how the Internet resource is
to be used within the workplace environment. Often this is a legal document that
has been formulated by a combination of the Human Resources and IT departments
to ensure correct and appropriate web surfing. WebSpy's analysis and reporting solutions have
been proven to reduce inappropriate web usage when used in conjunction with such
a document.
What is a URL?
URLs are the Internet equivalent of addresses. URL stands for either Universal
Resource Locator or Uniform Resource Locator, depending on the source of the
definition. A URL is the name or IP address of a site that you would type into
the Address box in your Internet browser.
What is an IP address?
An IP address is a unique string of numbers that identifies a computer on the
Internet or on a network, consisting of 4 parts separated by dots,
e.g.165.113.245.2. This number may be represented by a simple name e.g.
www.webspy.com
What is a site name?
The site name is the part of the web page's URL before the first forward slash
character '/'. e.g. www.webspy.com is a site name.
What is a resource?
Resources are the individual items that you download from a web site. The
resource name is the part of the URL that comes after the first forward slash
character '/'.
What is a protocol?
A protocol is a special set of rules or conventions for communication between two
computers. Both computers must recognize and observe the protocol. Different
types of Internet traffic use different protocols. Protocols are often described
in an industry or international standard.
» Back to top
