Internet audit report

To be able to use this feature, the (non-free) module wwwlog must be installed by your 1A business partner. This can be done remotely, without causing any disruption of service.

The surfing behaviour tool lets you keep an eye on what your users are doing on the Internet. You can see which pages your users visit, how often they visit them, and how much time they spend there. The surfing behaviour tool makes daily, weekly and monthly reports.

The reports do not contain "live" data. They are created every night for the previous 24 hours. There is always a day's delay in the reports. The most recent report you can see today is the one for yesterday.

It can sporadically happen that an IP address has been handed out to multiple users in a period of time. This can mean that the surfing behaviour is attributed to the wrong person. You should use the surfing behaviour tool as an indicator and not a monitor.

The surfing behavious tool reports ask for a correct interpretation. A user will often not notice that more is being loaded than just the one website. Furthermore, a total connection time of 600 minutes does not have to imply that someone has browsed a website for ten hours. It could also be that this person has left the website open in the background. Inactive sessions expire in five minutes, but a page can refresh itself, causing it to never become inactive.

Requirements

To complete this manual, you will need:

The module wwwlog installed on your 1A-server
A computer connected to your 1A-server
The name of your 1A-server
A webbrowser

Configure

Steps

Open "wwwlogs"

Open your browser
Enter the name of your 1A-server
Click on the intranet icon
Click wwwlogs

Open report overview

Click Reports for all users

Open report

Click on the link of a report

View report (1)

You can see a list of users
Click Overview to return to the main screen
Click Index to return to the user list overview
Click on a username to view the report for that user

View report (2)

You can rank the users in different ways by clicking the table headers. You can see which user visited the most sites, how many pages the users have requested, how much time they have spent on the internet, and how much data they have downloaded.
At the bottom of the page is an explanation of what each column means. You can also see if a user is unknown. Unknown users occur when a username cannot be linked to an IP adress. This link is made when a user is logged in to the 1A-server's domain.
In some cases however, someone can use the internet via the 1A-server without logging in to its domain, for instance when someone attaches a laptop to the network. In that case the username cannot be determined, and only the IP address is shown.

View user report

Click on a username
Only days that the user was online are shown
Click on a date to get a detailed overview

View detailed user report (1)

You will get an overview of which sites were visited that day by this user, how much time he or she spent there, how much pages he or she has requested, how much has been downloaded, and how large those downloads were.

View detailed user report (2)

You will probably notice a number of sites which have been open for a very long time or have caused many downloads. In the example you can see two websites: www.google-analytics.com and ad.nl.doubleclick.net
Both websites are advertising sites. They were not actually visited, but were loaded by other web pages. This kind of website kan collect a lot of downloads and minutes, because they are loaded by many other websites.
You will also notice that large websites, websites with a lot of images and news sites generate a lot of traffic. There are also many websites which refresh automatically on a regular basis. TBy doing this the site can generate lots of page views and downloads without the user's knowledge.