Frequently Asked Questions
Welcome to the Frequestly Asked Questions page. Below you will find a list of questions that our sales and support teams are asked on a regular basis. If you have a question you need answering, chances are it is already is in the list below.
To view the questions related to a particular area, please select the area from the drop down list below:
General
Q. Can WebSpy software do blocking and filtering?
A. No, our software is designed solely for monitoring. Our software can be used
proactively to reduce Internet misuse and can be used in conjunction with a
firewall to identify sites that need to be blocked.
A. Analyzer and Live are designed to read log files from a proxy server, firewall or mail server. If you do not have a logging device available, we have 3 solutions available for you: WebSpy Sentinel Suite contains a packet sniffer and logs Internet and Email activity; this does not act as a proxy server. WebSpy FlowMonitor collects and logs NetFlow output from Cisco Routers, and is designed for byte accounting; this also is not a proxy server. WebSpy ISA Server Suite, contains WebSpy Analyzer Standard and Microsoft ISA server, which is a proxy server and firewall. Q. Will WebSpy work with my Mac?
A. WebSpy products will only run on computers running Windows® operating systems. However, WebSpy products can be used to monitor any network, as long as the program itself is installed on a Windows computer and can access any necessary log files. Q. Most of my websites get classified as 'Miscellaneous'. How do I improve WebSpy's URL categorization?
A. Regularly updating your 'Miscellaneous' profile will provide more accurate categorization when analyzing and reporting Internet usage. If you find that your 'Miscellaneous' profile is increasing in size and/or hits, this is because any URL not matched up with a current profile ends up here. Following the procedure (listed below) either every time you run our solution, or on a regular basis, enables you to improve the accuracy of your profile categorization and reporting.
- In your summaries section, run an analysis, then go to Site Profiles / Profiles
- Right click on the 'Miscellaneous' profile in the list and choose Drilldown | Sites / Site Name
- All sites that have not been categorized will be displayed
- Sort sites by hits or size by clicking the column header
- To categorize a site, right-click it and choose Include In Profile
- Select an existing profile from the list, or type the name of your new profile into the box
- Repeat this for all sites you want to categorize (typically the top 10-20 sites)
- Regularly repeat this procedure to increase categorization accuracy
Analyzer
Q. I've noticed differences in total Browsing Time values displayed throughout Analyzer. For example, if I drilldown to Users, I can see the Browsing Time for a particular user, but if I drilldown into that user to see the sites they've visisted, the Total Browsing Time at the bottom of the screen is different. Why?A. It's not unusual for the browsing time for a list of sites to be different to the total browsing time for the user that visited those sites. The reason for the difference is that you could have multiple sites open at the same time, or you may have visited some sites for less than 1 second.
This is one way this behavior could happen: if I go to www.webspy.com and browse that site from 12:00 to 12:05, then that would be 5 minutes browsing time for that session, and 5 minutes for www.webspy.com.
However, if at the same time I open a second browser window to www.cnn.com, and also browse that site from 12:00 to 12:05, then in total my user and session browsing time would still be only 5 minutes, but the total browsing time for sites would be 10 minutes, as there is 5 minutes on www.webspy.com and 5 minutes on www.cnn.com.
Alternatively, if you visit www.webspy.com only at 12:00:01 and www.cnn.com at only 12:04:01, then the browsing time for www.webspy.com would be 0 seconds, and the browsing time for www.cnn.com would also be 0 seconds, however the browsing time for the user would be 4 minutes.
This is why browsing time for sites can be very different to browsing time for users, sessions and dates
Q. How is Browsing Time calculated?Browsing Time is the estimated time a user spent browsing the web. In addition to Users, you can view the Browsing Time for Sites (the total time spent browsing a site), Dates (the total time spent browsing on a particular date), Sessions (the total time of a browsing session) and Departments (the sum of all the department's user's browsing time).
Browsing Time is calculated by looking at the date/time stamp of each hit, and then grouping the hits into sessions. The total time of one session is calculated as the time between the first and last hits of the session.
Hits are grouped into the same session if they occur within five minutes of each other. If there is a break of more than five minutes with no hits made, then the previous session is finished and a new session is started when the next hit is made. The five minute 'Session Threshold' value can be changed in Tools | Options | Summaries (see Summaries Options).
Browsing Time should not be confused with Download Time which is the time taken to download a resource from the web site
Q. I deleted a log file from Folders and Files view in Storages, but the number of hits in the storage is still the same. Why?A. You need to 'Reload all hits' after deleting files or folders as there is no relationship between the hits imported and the folder / file structure in Storages. This means that the hits associated with a log file in your storage will still be represented in Reports, even though that log file has been deleted. The functionality to delete log files and folders is for advanced users that have deleted periods such as Dates, Weeks, or Months from their storage, and know which log files these hits originated from. Deleting periods such as Dates, Weeks, and Months will delete the hits from your storages, but they will be reloaded next time you 'Reload all hits', unless the log files that the hits originated from are also deleted from the storage.
Reloading the Hits in one particular file of folder by right-clicking the file/folder and selecting Reload should be avoided, as this will duplicate the info in your storages. The safest way to reload data is by 'Reloading all hits'.
Q. My logging device logs in GMT (UTC). How can I report on my log file using my local time zone?You can set the time zone offset when importing your log files. Go to Storages, create a new storage and import logs into the storage. When you are on the Input Format page of the Import Wizard, select the format of your log files and click the Format Properties button on the toolbar. Select the appropriate time zone offset from the ‘Time Zone’ drop down list and click OK. Proceed through the Import Wizard to import your logs. When you analyze or report on the logs, your times will be displayed in your current time zone. Q. I am having trouble opening WSR reports on my 2003 server, is there something I can do to fix this problem?
A. Windows 2003 Servers have special security settings that block the WSR files from opening correctly.
To open WSR reports on a Windows 2003 Server you will need to turn off "Secure Browsing". To do this go to Control Panel | Add/Remove Programs | Add/Remove Windows Components, then double-click 'Internet Explorer Enhanced Security Configuration' and clear the checks for administrators or all users as appropriate. Q. Can I create reports for each of my organization's departments?
A. Yes, you can create separate reports for each department. You can and even schedule these reports to run and be emailed to the appropriate manager automatically. Q. I want all my reports to be accessible from a web site. How do I schedule a ‘Publish to web’ task?
A. Create a task with a ‘Run a Report’ action. Proceed through the Report Wizard ensuring the report format is set to Web Document. On the Publish page of the Report, choose 'Copy Report to a location'. On the next page enter the website directory where you would like the files copied to, and click the ‘Extract’ checkbox. This will extract all the HTML pages directly to your website’s directory. All you then need to do is link to the index page for each report from your web page. This page has the same name as your report with the extension .html. This process will also create a subfolder of the same name containing all the graphics and other pages required to make up the report. Q. How do I set up a daily task to import yesterday’s logs into a new storage and run a report on that storage?
To do this you need to set up an import action to only import yesterday’s logs into a new storage with the current date prefixed to the storage name, and then set a report action to report on the storage with the current date prefixed to the storage name. You then need schedule these two actions to run on the same day. Go to Tasks and select "New Task Dialog" to launch the Task Dialog. Adding the import action:
1. Click the Actions Tab and select Add | Import log files into new storage. This launches the Import Wizard. Click Next.
2. On the Storage page, enter a name for your storage such as ‘Daily Storage’ and check the ‘Prefix with the current date’ checkbox. This will insert the current date at the start of each storage name. Click Next.
3. On the Input Format page, select the format of your log files and click Next.
4. On the Input Location page, select Add | Folder and navigate to the folder where your logging device stores it’s log files. Click OK to launch the Folder Properties dialog. On the Folder Properties dialog ensure the checkboxes ‘Use this folder when importing new hits’ and ‘Search this folder for new files when importing new hits’ is checked. Click OK. Click Next.
5. On the Select page, check the ‘Select Dates’ checkbox. Click Next.
6. On the Select Dates page, check the ‘Show past’ checkbox, and enter 1 Days in the edit and dropdown boxes. Do not check the ‘Include current day’ checkbox’. This filter will ensure that only yesterday’s logs are imported. Click Next and then click Finish on the final page of the Import Wizard. Adding the report action:
1. On the Actions tab of the Task dialog, click Add | Run a report.
2. On the Report Types page, select the type of report you want to run on the daily storage. Click Next.
3. On the storages page, check the checkbox next to the storage you named in step 2 of Adding the import action (for example, select ‘[date] Daily Storage’). Ensure no other storages are selected. Click Next.
4. Proceed through the Report Wizard selecting the report requirements for your daily report. Hint: You can set the report to be emailed to you when it is generated on the Publish page on the Report Wizard. Schedule the actions to run on the same day:
1. On the Task Dialog, click the Schedule tab and click the Add button on the toolbar. This launches the Schedule Wizard. Click Next.
2. On the Period page, select ‘Daily’. Click Next.
3. On the Daily page, select the date from when you would like the task to begin. Select the time you would like the task to run on each day. Note: if you are importing a lot of data, ensure you set an appropriate start time to allow both task actions to run on the same day. Enter “1” to perform this task every day. Click Next.
4. On the Account login page, enter your login details so the task can run when you are logged out of your PC. Click Next and click Finish on the final page of the wizard. Finally, click the General Tab of the Task Dialog and give the task a name such as ‘Daily Task’ and ensure the ‘Allow this task to run as scheduled’ checkbox is checked. Click OK. Q. Analyzer is pretty neat. However, since my logs don’t always get the DNS name of the sites, it makes it a real pain to see what sites the users have been browsing. When it only shows the IP address I have to browse to the website just to see where they have been. That becomes to time consuming. Is there anything that can be done about this?
A. Analyzer has the ability to Resolve IPs when you are looking at Sites. Simply go to Summaries and drilldown into Sites, then click the Resolve IPs link in the Advanced task pad. You will need to select an alias to resolve the IPs into such as ‘Sitenames’. Once the resolve has finished, select the alias you resolved the IPs into in the Aliases task pad. Any resolved IPs will now be displayed by their resolved DNS name. However, the Resolve IPs functionality in Analyzer simply contacts your DNS server to resolve the IPs. If your logging device couldn’t find a resolved DNS name, then it is unlikely that Analyzer will find it. You could use a web resource like www.samspade.org to determine site names, or try optimizing your local DNS server. Q. Is it necessary to install Analyzer per client on the workstation side?
A. All WebSpy software is designed to be installed on workstation PCs. You only need to install a WebSpy application in one place on your network in order to monitor the entire network. So if you have only one proxy device or firewall, you will only need to install a WebSpy product on one PC and point it to where the logs are located. Q. When reporting on some users, some of the sites they’ve visited are showing up as <Unspecified>. What does this mean?
A. When Analyzer displays a site name as <Unspecified> it means that no site name or site IP address was recorded in the log file. You may still be able to drilldown on the Unspecified site to Resources. If there are resources, then this usually means that the site is your own website and your logging device does not log its name. Q. How does Analyzer calculate download time?
A. Most servers records a the time it took to download the specific resource associated with a hit. When looking at Users, Analyzer calculates the Download Time column by adding up these times for all of the resources (hits) that user downloaded. A user could be downloading multiple resources simultaneously, e.g. by having multiple browser windows open at the same time. Q. I am using WebSpy Premium 4.x. I need to import 3.5 GB, but Premium only allows me to import 3GB. I can’t justify upgrading to Analyzer Giga just so I can import 500MB more data.
A. In Analyzer Premium, you can open up to 4 GB of data at once but you can only import up to 3GB into the one storage. To do this, import 3GB into a storage, and then close it (but don't delete it). Then start a new storage and import the rest of the data. Once this has been imported, open your 3GB storage. You can have both storages open at once. In fact you can have up to 6 storages open at the same time, and you can run reports and analyses on all storages at the same time. This doesn't, mean you can open 6 x 3GB storages all at the same time. With the above method you can open up to 4GB in Premium at once, and that is all. Q. Why are sites listed, even though I don’t remember visiting them?
A. Sometimes websites use pictures or other files that are stored on a different website. Whenever this happens, your Internet browser will request the files stored elsewhere and then display them as part of the website you are viewing. However, the original location of each file, not where you viewed the file, is listed in your proxy log files – and Analyzer uses those log files to generate your summaries and reports. For example, www.webspy.com/index.asp may reference an image at www.inspectionmanager.com/images/logo.gif. This second site and resource is recorded in your log file and therefore Analyzer displays this site, even though you did not go directly to www.insepctionmanager.com. Q. My Scheduled Tasks do not run anymore. Why?
A. The most common reason for this is that you have changed your logon password. If you change your logon password for the computer that runs your tasks, you will need to modify each scheduled task so that it uses the new password. If you do not, the task will not run at all. To do this, open the Edit task dialog for each task by double-clicking on the task’s name, go to the Schedules tab and double click the schedule to launch the Schedule Wizard. Proceed through the wizard to the Account Details page, and update your details as necessary. Once you have finished the wizard your task will run as before.
Sentinel
Q. Do I need to install Sentinel Service on
every computer that I want to monitor?
A. You don’t have to install Sentinel Service on every computer on your
network. For most networks, Sentinel Service only needs to be installed on one
computer, which can ‘see’ all of your network’s Internet traffic. To determine
which computer on your network should act as your Sentinel Server, please
consult Sentinel’s Planning and Installation Guide.
Q. Does Sentinel capture passwords?
A. If Sentinel captures data in an email, telnet or FTP session containing a
password that isn’t encrypted (i.e. the email is in plain text), that password
can be found in the log files Sentinel creates. Passwords sent via the web, or
in a news item are also available from Sentinel’s log files if the passwords
were not encrypted. Passwords sent over a secure connection such as secure web
(HTTPS) or secure telnet (SSH) are not obtainable from the log files. Because
of the possibility of captured passwords, you should implement NT folder
security where appropriate. You should also consider how capturing passwords
fits in with your organization’s Internet usage and privacy policies.
Live
Q. How do I get rid of an Alert from the Live Status window?A. In Live Status, you can right-click on an alert to dismiss or display alert details. Select these options from the pop-up menu that is displayed. Q. I currently use WebSpy Analyzer and Live, and I use exactly the same Usernames, Departments and Profiles for both applications. Every time I make a change to my Departments, Usernames or Profiles in Analyzer, I need to go into Live and make the same change again. Is there an easy way of keeping these synchronized without making each change twice?
A. Yes there is. In WebSpy Analyzer, Select Tools | Options from the main menu. On the General Tab, check the 'Keep Profiles and Aliases synchronized between WebSpy applications' checkbox and click OK. In WebSpy Live select Tools | Options from the main menu on the Live Configuration window. On the General Tab, check the 'Keep Profiles and Aliases synchronized between WebSpy applications' checkbox and click OK. When ever you make a change to your aliases or profiles in either applications, the change will be made to the other application's aliases and profiles as well.
Insight for Microsoft SBS Premium<
Q. Is Insight just making a copy of all the ISA data on my PC and if so is it compressed? What's the best way to manage this?
A. Yes. Insight imports ISA data into its own internal storage folder located in
C:\Documents and Settings\your user profile\Local Settings\Application Data\WebSpy\Insight for Microsoft SBS Premium 1.0
The storage will be smaller than ISA's MSDE log database, but it is not compressed.
You can apply NTFS compression to the storage folder to reduce the disk space. To do this:
- Go to C:\Documents and Settings\scottg\Local Settings\Application Data\WebSpy\Insight for Microsoft SBS Premium 1.0, right-click the storage folder and select 'Properties'
- On the General Tab, click the 'Advanced' button and check the 'Compress contents to save disk space' check box.
- Click OK, then click 'Apply'.
- Select 'Apply changes to this folder, subfolders and files' and click OK.
This should reduce the storage size by about 25%.
You should also purge old data (data that you are no longer interested in analyzing) from your storage. You can always collect it again later if required by clicking the 'Collect data' link. Removing old data will reduce your storage size and improve the speed of analysis and reporting.
To purge old data:
- Click the 'Remove collected data' link in the Configuration task pad.
- Check the dates that you are no longer interested in analyzing.
- Click OK. An analysis will run automatically to remove the periods from the Web usage, Security overview, and Email activity views.
Q. Do I have to collect data each time I open Insight to get the latest data?
A. Yes. Insight doesn't automatically collect new data when it starts. You need to manually collect new data. Insight will automatically run a new analysis once the data has been collected.
To get the latest data you click the 'Collect data' link in the Configuration task pad. There are two ways to get the new data:
- Select 'Collect all Available data' and check 'Clear existing data before collecting new data' (this option will reimport everything and take may take a while)
- If you know which dates have already been imported into Insight, you can select 'Collect data for these dates' and select the dates that contain the new data. Uncheck 'Clear existing data before collecting new data' so that your existing data is retained and click OK.
Both options will import the new data and automatically run a new analysis.
Log File Support
Q. I have a Microsoft ISA server and I am only interested in viewing web usage. Which logs should I import?A. If you only want to view web usage, you should import only log files named WEB*.log. The FWS log files are firewall activity logs, and the IPP log files are packet filter logs (which Analyzer cannot load). Q. Can Microsoft ISA logs be saved to a different location other than on the server?
A. Yes, it is possible to change the location of the log files. To do this:
1. Launch ISA Management
2. Go to Monitoring Configuration\Logs
3. Open the Properties for the 'ISA Server Web Proxy Service'
4. Click the Options button
5. Select 'other folder'
6. Enter the desired network path for the log files The user that the ISA service is configured to run as will need write permissions to the target folder. Q. It doesn't look as though WebSpy software supports my log file format but I would still like to evaluate the software. Is this possible?
A. Please email a sample log file to support@webspy.com and we will endeavor to add support for you. Q. I am trying to import my Microsoft Exchange log files into Analyzer Premium, but it comes back with errors like found 1 field was expecting 19. How do I set up Analyzer Premium to import my logs correctly?
A. Analyzer Premium supports the Micorsoft Exchange tracking log format. If you are importing anything other than these logs, Analyzer Premium may the import errors you mentioned. The tracking logs are usually stored in a folder called "TRACKING.LOG" on your Exchange server. The log files are named after the date they were created in yyyymmdd.log format, e.g. 20031216.log would be today's file. If you can't find this folder or files like this on your Exchange server the logging may not be enabled yet. What you need to do is enable message tracking. Q. I run Microsoft Proxy Server and I have both WS and W3 logs. Which ones do I use for Analyzer?
A. You will need to use your W3 logs when running WebSpy as the information collected in those logs is more comprehensive. See the example below:
W3 log:
127.108.158.115smith\WEB, Mozilla/4.0 (compatible; MSIE 4.01;Windows 95), Y, 11/17/98, 8:23:41, W3Proxy, A_SERVER, -,10.252.21.45, 10.252.21.45, 80, 4078, 24708, 25023, http, tcp, GET, http://www.webspy.com.au text/html, VFInet, 200, 0
WS log:
128.50.1.160, john, IEXPLORE.EXE:2:4.0, Y, 12/9/98, 7:41:12, WspSrv, NETLINK_PROXY, -, home.webspy.com, -, -, 5297, -, -, -, -, GHBN
Trial Versions
Q. I downloaded a 30-day trial of WebSpy, installed it and then forgot about it. I would still like to evaluate the program but my 30 days have run out. What can I do?Please contact the WebSpy Development Team at support@webspy.com, and we will organize another 30-day trial for you. Q. After downloading a trial version of WebSpy, I was asked to enter a password to unzip the file. Where do I find the password?
A. The password is emailed to you along with a confirmation of your download. If you did not receive an email you may have entered your email address incorrectly and will need to contact WebSpy for a password on support@webspy.com. Alternatively, you could download the trial version again, entering the correct information.
Registration
Q. I had to re-install WebSpy, and it is asking me for another Unlock Code. I put in the one you gave me, but it doesn't work. What now?A. Each Unlock Code is only valid once, so every time you re-install Analyzer you will need to request a new Unlock Code. Simply go through the Registration Wizard again, and submit your details to us, and we will be able to generate a new Unlock Code for you.
Terminology
Q. What is a "hit"?A. When looking at web data, a hit is defined as any single resource downloaded from a website. When looking at email data, a hit is defined as a single email. A web page can consist of may different files; graphic files, html files, scripts, stylesheets etc. Each file is downloaded separately by the proxy server and recorded on a different line in the log file. Analyzer therefore counts each file as separate hit. A popup would count as at least 1 hit. Q. What is meant by IAU policy?
A. An IAU policy is the acronym used for Internet Acceptable Usage policy. This is the publicly made available document to all new and existing employees of an organization that clearly and succinctly explains how the Internet resource is to be used within the workplace environment. Often this is a legal document that has been formulated by a combination of the Human Resources and IT departments to ensure correct and appropriate web surfing. WebSpy has been designed and has been proven to reduce inappropriate web usage when used in conjunction with such a document. (Read our Case Study or Guide to Creating Your Own IAU) Q. What’s a URL?
A. URLs are the Internet equivalent of addresses. URL stands for either Universal Resource Locator or Uniform Resource Locator, depending on the source of the definition. A URL is the name or IP address of a site that you would type into the Address box in your Internet browser. Q. What’s an IP address?
A. An IP address is a unique string of numbers that identifies a computer on the Internet or on a network, consisting of 4 parts separated by dots, e.g.165.113.245.2. This number may be represented by a simple name e.g. www.webspy.com. Q. What’s a site name?
A. The site name is the part of the web page's URL before the first forward slash character '/'.
e.g. www.webspy.com is a site name. Q. What’s a resource?
A. Resources are the individual items that you download from a web site. The resource name is the part of the URL that comes after the first forward slash character. e.g. www.webspy.com/logo.gif indicates there is a resource called /logo.gif stored at the site www.webspy.com. Q. What is a protocol?
A. A protocol is a special set of rules or conventions for communication between two computers. Both computers must recognize and observe the protocol. Different types of Internet traffic use different protocols. Protocols are often described in an industry or international standard.
