This article applies to:

• Firewall Suite 4.X

Question:

Information:

When viewing reports after analyzing proxy or firewall log files it is sometimes difficult to understand how Firewall Suite calculates the amount of time a visitor has spent on a Web site. Some visitors may even appear to have spent more time on the Internet than the time they spent at work for that day.

In the dialog for the General tab of Options for the Firewall Options, there is a Session Timeout setting. The default setting is thirty minutes. This timeout setting is used to determine when to stop tracking a given visitor session (also referred to as a visit in the reporting).

As no activity is logged when a visitor turns off his or her browser, it is impossible to tell when he or she stopped viewing a page based on the firewall or proxy log file. Because of this, Firewall Suite has had to set a point where, if no further activity is found in the log file, it is assumed that the session has discontinued.

So, if a visitor goes to Site A at 9:00:00 and hits pages at 9:01:00, 9:31:05 and 9:32:04, the total time spent on that site is one minute and 59 seconds. Notice that there was more than 30 minutes of inactivity between 9:01:00 and 9:31:05. Because of the break in activity the first visitor session is from 9:00:00 and 9:01:00. A second session started at 9:31:05 and ended at 9:32:04, adding the 59 seconds to the previous session length of 1 minute. This would show in the report as two visitor sessions with a total time of 1:59.

Now, if the visitor hit Site A at 9:01:00 and 9:02:00 and then hit Site B at 9:03:00 and 9:27:00, then hit Site A again at 9:28:00, the total time will be 27 minutes for Site A and 24 minutes for Site B.

This article was previously published as:

NETIQKB1531