Log Analyzer. August 1998 Edition. Copyright WebTrends Corporation

Transcription

1 Log Analyzer August 1998 Edition Copyright WebTrends Corporation

2

3 Disclaimer WebTrends Corporation makes no representations or warranties with respect to the contents or use of this manual, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, WebTrends Corporation reserves the right to revise this publication and to make changes to its content at any time, without obligation to notify any person or entity of such revisions or changes. Further, WebTrends Corporation makes no representations or warranties with respect to any WebTrends Corporation product, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, WebTrends Corporation reserves the right to make changes to any and all parts of WebTrends Corporation products at any time, without obligation to notify any person or entity of such changes. Trademarks Product Support WebTrends, WebTrends Log Analyzer, and FastTrends are trademarks of WebTrends Corporation. Other brands and their products are trademarks or registered trademarks of their respective holders. If you should have any questions during the installation or use of WebTrends Log Analyzer, please refer to the WebTrends Corporation Knowledge Base online at: If you are unable to resolve the problem, do not hesitate to contact our Product Support Department: Telephone: (503) , Fax: (503)

4 Software License Agreement GRANT WebTrends Corporation ("Developer") hereby grants you a non-exclusive license to use its accompanying software product ("Software") for use on a single computer. You may not: permit other individuals to use the Software, modify, translate, reverse engineer, decompile, disassemble (except to the extent applicable laws specifically prohibit such restriction), or create derivative works based on the Software; copy the Software (except for back-up purposes); rent, lease, transfer or otherwise transfer rights to the Software; or remove any proprietary notices or labels on the Software or documentation. SOFTWARE If you receive your first copy of the Software electronically, and a second copy on media, the second copy may be used for archival purposes only. This license does not grant you any right to any enhancement or update. TITLE Title, ownership rights, and intellectual property rights in and to the Software shall remain with the Developer or its suppliers. The Software is protected by the copyright laws of the United States and international copyright treaties. Title, ownership rights, and intellectual property rights in and to the content accessed through the Software is the property of the applicable content owner and may be protected by applicable copyright or other law. This License gives you no rights to such content. DISCLAIMER OF WARRANTIES THERE ARE NO WARRANTIES, CLAIMS OR REPRESENTATIONS MADE BY DEVELOPER, EITHER EXPRESS, IMPLIED, OR STATUTORY, WITH RESPECT TO THE SOFTWARE, INCLUDING WARRANTIES OF QUALITY, PERFORMANCE, NON INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE, NOR ARE THERE ANY WARRANTIES CREATED BY COURSE OF DEALING, COURSE OF PERFORMANCE, OR TRADE USAGE. DEVELOPER DOES NOT WARRANT THAT THE SOFTWARE WILL MEET YOUR NEEDS OR BE FREE FROM ERRORS, OR THAT THE OPERATIONS OF THE SOFTWARE WILL BE UNINTERRUPTED. THE FOREGOING EXCLUSIONS AND DISCLAIMERS ARE AN ESSENTIAL PART OF THIS AGREEMENT AND FORMED THE BASIS FOR DETERMINING THE PRICE CHARGED FOR THE PRODUCTS. SOME STATES DO NOT ALLOW EXCLUSION OF AN IMPLIED WARRANTY, SO THIS DISCLAIMER MAY NOT APPLY TO YOU. EXCLUSIVE REMEDY Developer's cumulative liability to you or any other party for any loss or damages resulting from any claims, demands, or actions arising out of or relating to this Agreement shall not exceed the license fee paid to Developer for use of the Software. In no event shall Developer be liable for any indirect, incidental, consequential, special, or exemplary damages or lost profits, even if Developer has been advised of the possibility of such damages. EXCLUSION OF CONSEQUENTIAL AND OTHER DAMAGES

5 DEVELOPER WILL NOT BE LIABLE TO USER OR ANY THIRD-PARTY CLAIMANT FOR ANY INDIRECT, SPECIAL, PUNITIVE, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, WHETHER BASED ON A CLAIM OR ACTION OF CONTRACT, WARRANTY, NEGLIGENCE, STRICT LIABILITY, OR OTHER TORT, BREACH OF ANY STATUTORY DUTY, INDEMNITY OR CONTRIBUTION, OR OTHERWISE, EVEN IF DEVELOPER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE EXCLUSION CONTAINED IN THIS PARAGRAPH SHALL APPLY REGARDLESS OF THE FAILURE OF THE EXCLUSIVE REMEDY PROVIDED IN THE FOREGOING PARAGRAPH. SOME STATES DO NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE LIMITATIONS OR EXCLUSIONS IN THIS AND THE FOREGOING PARAGRAPH MAY NOT APPLY TO YOU. TERMINATION This license will terminate automatically if you fail to comply with the limitations described above. On termination, you must destroy all copies of the Software. MISCELLANEOUS This Agreement represents the complete agreement concerning this license between the parties and supersedes all prior agreements and representations between them. It may be amended only in writing executed by both parties. If any provision of this Agreement is held to be unenforceable for any reason, such provision shall be reformed only to the extent necessary to make it enforceable. This Agreement shall be governed by and construed under Oregon law as such law applies to agreements between Oregon residents entered into and to be performed within Oregon, except as governed by Federal law. U.S. Government Restricted Rights. Use, duplication or disclosure by the Government is subject to restrictions set forth in subparagraphs (a) through (d) of the Commercial Computer-Restricted Rights clause at FAR when applicable, or in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS , and in similar clauses in the NASA FAR Supplement. Manufacturer is WebTrends Corporation, 621 SW Morrison, Suite 1300, Portland OR 97205, U.S.A.

6

7 Table of Contents Chapter 1. Before You Begin 13 WebTrends Features 13 Understanding WebTrends Log Analysis 14 WebTrends Log Analyzer Features 14 How does the WebTrends Log Analyzer Work? 15 Understanding Log Files 16 Terminology and Conventions 18 Getting Help 19 Giving Us Feedback 19 Chapter 2. Installing and Setting Up WebTrends 21 System Requirements 21 Installing WebTrends 21 Installing with Auto-run 22 Installing from the Run Dialog 22 Software License Agreement 22 Installing Extended Logging Plug-Ins 22 Installing TNG Integration Utility 23 Registering WebTrends 23 Uninstalling WebTrends 24 WebTrends Main Console 24 Chapter 3. Web Log Analysis Profiles and Reports 27 Scenario: Web Site Activity Reporting 27 Adding a Web Log Analysis Profile 28 Creating a Log Analysis Report 33

8 Formatting Log File Path Entries 36 Standard Log File URL Path Examples 36 Compressed Logs 36 Wildcards 37 Multiple Logs 37 File Name Macros 37 WebTrends Views 39 Creating a WebTrends View 39 Chapter 4. Filtering Log Analyses 45 Using Web Log Analysis Filters 46 Adding a Filter 46 Combining Filter Elements 47 Combining Include and Exclude Filters in a Profile 48 Filter Elements 48 Return Codes 48 User Address 48 Multi-Homed Domain 50 Directory 50 File Filter 52 Referrer 53 Advertising 54 Browser 55 Username 56 Day 56 Hour 57 Scenario: Filtering a Multi-Homed Log File 57 Verifying your Log File is Multi-Homed 57 Adding Profiles for Multi-Homed Log 58 Defining and Memorizing Report Settings 59 Chapter 5. Modifying Reports 61 Scenario: Modifying WebTrends Report Style 61

9 Adding or Editing Report Styles 62 Scenario: Modifying WebTrends Report Language 64 Adding or Editing Report Languages 65 Scenario: Modifying WebTrends Report Content 66 Chapter 6. Scheduling Reports 69 Scenario: Automating Web Log Analysis Reports for Speed 70 Adding a Log Analysis Profile for Scheduled Reports 70 Memorizing Settings for Scheduled Reports 72 Scheduling Web Log Analysis Reports 73 Scenario: Automating Web Log Analysis Reports Conserving System Resources 75 Adding a Log Analysis Profile for Scheduled Reports 75 Memorizing Settings for Scheduled Reports 76 Scheduling Web Log Analysis Reports 77 Changing a Scheduled Report 78 Deleting a Scheduled Report 78 Using the Schedule Log 79 Searching for a Text String 79 Changing Font 80 Changing Point Size 80 Printing the Schedule Log 80 Saving the Schedule Log 80 Clearing the Schedule Log 81 Running a Scheduled Report On Demand 81 Chapter 7. FastTrends and Real Time Reporting 83 Scenario: Creating Several Reports from One Log File 84 Adding a Profile for Multi-homed Domain 84 Scenario: Generating Reports in Real Time 84 Defining Real-Time Reporting Options 85 Defining a Real-Time Analysis Profile 86 Clearing Your FastTrends Cache 87

10 Chapter 8. Ad Views and Clicks 89 Scenario: Tracking Internet Advertising 89 Defining an Advertisement to Track 90 Adding a Log Analysis Profile for an Ad 93 Customizing and Memorizing Settings for Ad Tracking Reports 95 Chapter 9. Intranet Management 97 About Intranet Management 97 Scenario: Configuring WebTrends for your Intranet 98 Adding an Intranet Domain 98 Intranet Reporting 100 Chapter 10. Notes for Netscape Web Server Users 101 Samples of Netscape Web Server Log Files 101 Setting up WebTrends Netscape Plug-In 102 Extended Logging and Multi-Homing 104 Chapter 11. Notes for Microsoft IIS Users 105 Samples of Microsoft IIS Web Server Log Files 105 Microsoft IIS Plug-in for Extended Logging 107 WebTrends Plug-In Configuration Utility 107 Tips for Microsoft IIS Users 111 Multi-Homed Filtering 111 Home Page URL 112 Chapter 12. Remote Reporting 113 Scenario: Using Your Browser to Create a WebTrends Report 113 Creating a Report Remotely 114 View an Existing Report Remotely 115 Delete an Existing Report Remotely: 116 Remote Reporting Configuration Options 116

11 Running a New Report 117 Working With Profiles 117 Modifying Configuration Options 117 Chapter 13. Configuration Options 119 General Options 119 Locale 120 Selecting an HTML Browser 120 Running WebTrends as an NT Service 121 Proxy Server Settings 123 Options 124 Remote Reporting Options 125 Scenario: Making WebTrends Reporting Available to Remote Users 126 Defining Windows NT Accounts for WebTrends Remote Reporting Server Access _ 126 Setting up a Remote Reporting Server 127 SNMP Agent 128 Web Log Analyzer Options 129 File Types 129 Modifying Domain Name Groupings 131 General Web Log Analyzer Settings 132 Microsoft Word and Excel Report Options 134 Cookies 135 Log File Cache Options 137 Real-Time 138 Language 139 Chapter 14. Performance 141 Using Filters to Optimize Performance 141 Running Reports without DNS Lookup 141 Running Reports without DNS Lookup 142 Cache the Log File 142 Accessing the log file/site: file, ftp, http 142

12 Report Type 142 DNS Cache Size 143 Retrieving HTML Page Titles 143 Zip Archived Log Files 143 Appendix A. Glossary 145 Appendix B. Sample WebTrends Report 153 Web Log Analysis Report Sample 153 Appendix C. Reference 163 Report/View Ranges 163 Examples: Defining Log Files in a Log Analysis Profile 167 Working with Profiles 167 Local File 168 Remote (FTP) 168 Remote (HTTP) 168 Multiple (Rotated) 168 Product Support 170 Index 171

13 Chapter 1. Before You Begin In This Chapter: WebTrends Features Understanding WebTrends Log Analysis Terminology and Conventions Getting Help Giving Us Feedback The WebTrends User Guide provides the information you need to install, set up, and use WebTrends. In addition to general reference information and step by step instructions, we have included scenarios that describe how you can make the most of WebTrends. WebTrends Features WebTrends Log Analyzer is member of the WebTrends family of tools for the web professional. With WebTrends, you have the most powerful and comprehensive web site management tool on the market! WebTrends provides the following cartridges, each enabling you to manage and report on an aspect of your web site. Report Style, Language and Content Editors Designing your own WebTrends HTML reports is a breeze! Now you can not only choose which graphs and tables to include in your reports, but also the colors, fonts, layouts and text to use. Even adding your company logo to all of your reports is easy. Table of Contents Frame in HTML Reports Navigating WebTrends HTML reports is now simplified: each report automatically generates a hyper-linked Table of Contents so that you can jump directly to the section that interests you. 13

14 WebTrends Log Analyzer Remote Reporting/Configuration If you are running WebTrends Log Analyzer as a Remote Reporting Server, remote users now have all of the log analyzer configuration options available to them. Enhanced Company Database The company database included with your copy of WebTrends now contains more than 1 million domains and their corresponding addresses and regional information. This information is displayed in WebTrends reports. Understanding WebTrends Log Analysis Once you have set up your web server and connected to the Internet, anyone with a browser can access it to retrieve information and files. With WebTrends Log Analysis, you can measure that activity on your web site including who is visiting your site, which pages are the most popular, whether your Internet advertising is paying off, and what time of day you should perform server maintenance. WebTrends Log Analyzer Features Supports all major and most minor log file formats. Processes access log, referrer logs, and agent logs. Allows remote retrieval of log files so that WebTrends does not have to be installed on your Web server. Extensive filtering options make it possible to zero in on exactly the information that you need. Versatile report formats (HTML, Microsoft Word & Excel, ASCII & comma-delimited text). Advertisement tracking. Log file Viewer to view your log file data in color-coded, condensed or detailed format. 14

15 Chapter 1. Before You Begin How does the WebTrends Log Analyzer Work? Your Web server generates a file, the log file, that documents all activity on your site, including, but not limited to: The IP address or domain name of the visitor to your site. The date and time of their visit. What pages they viewed. Any errors that they encountered. Any files downloaded and the sizes. Any URL that referred to your site. The Web browser and platform (the operating system) that was used. You tell WebTrends where to find the log file, how you want the log file analyzed, and any filters to apply using a log profile. WebTrends analyzes the log file according to the Web log profile and stores the data to speed future analyses of the same log file. WebTrends applies the report settings to the analysis results and displays them in the Web log analysis report. The following graphic shows how WebTrends generates Web log analysis reports: 15

16 WebTrends Log Analyzer Understanding Log Files Web server log files contain all activity on the web site: who visited, when they visited, and what they did when they were there. They normally have a.log extension, and are located: On an FTP site: /logs/*.log Locally (Microsoft IIS): c:\winnt\system32\logfiles\in*.log Locally (Netscape): c:\netscape\servers\http-[server name]\logs\*.log If you retrieve your web server log file remotely from your ISP, you need to ask them for the following information to define your Web Log Analysis profile: What is the exact FTP or HTTP path to your log files? What is the naming convention for your log files? What are the user name and password you need to access them? What is the rotation of your log files (i.e., daily, weekly, monthly, etc.)? Samples: Common and Combined (Extended) Log File Format The NCSA recognizes two log file format standards: Common and Combined (Extended). Following is a sample line from a "common log file: - [16/Jan/1996:10:36: ] "GET /dept/arguides/dwgs/ jpg HTTP/1.0" The combined or extended log file format is similar to the common log file format with the addition of the referrer and user fields at the end of the line (inside quotes). The following is a sample line from a "combined (extended) log file: tarpon.gulf.net - [12/Jan/1996:20:37: ] "GET /buttons/next_p.gif HTTP/1.0" " "Mozilla/2.0b5 (WinNT; I)" 16

17 Chapter 1. Before You Begin Note: Both log file formats have the first eight fields in common; the Combined (Extended) log file format includes in addition Field 9, Referrer and Field 10, Browser/Platform : The following table defines each of the fields in the sample log file lines. Field # Field Name Description Field 1 User Address The numeric IP address or domain name of the user accessing the site. Field 2 Rfc931 This field is used to log the domain for multi-homed web servers. Field 3 User Authentication User name, if required. Field 4 Date/Time The date and time the user accessed the site. Field 5 GMT offset The number of hours from GMT (if this is it is logged in GMT time). Field 6 Action The particular operation (i.e., Get or Post ) of the hit (this must be in quotes). Field 7 Return Code The return code for the action tells whether it was successful and why. Field 8 Size The size of the file sent. Field 9 Referrer: The URL which linked the user to your site. Field 10 Browser/ Platform The Web browser and platform used by the visitor to your site. Note: If you are attempting to report on a Microsoft IIS log file, and if WebTrends returns an error stating that there is no data for the date range specified, you may need to change your date format (i.e., Microsoft IIS U.S., European, or Japanese Date Format). You can change the format in Log File Format field of the Add or Edit Log Profile dialog (Title - URL tab). 17

18 WebTrends Log Analyzer Terminology and Conventions The following table explains some common terms used throughout the program and documentation. If you see Click Dialog Doubleclick Field Select Tab Window It means Use the mouse to position the selector arrow on an a screen item and press the left mouse button once. A dialog is a program box that appears providing spaces (fields) for you to enter information or buttons for you to select. Use the mouse to position the selector arrow on an a screen item and press the left mouse button twice quickly. This is where you enter your information in a dialog. A field typically looks like a box. Use the mouse to position the selector arrow over a screen item so that it is highlighted, and click the left mouse button once. A tab is a part of the program that looks like a separation card in a Rolodex or recipe file. Programs are displayed through windows. A window may provide access to several dialogs or tabs. The following table describes the conventions used to present parts of the WebTrends program. This text bold Refers to A button or field name (New button, Description field). Italic Refers to a chapter or section in the manual (Chapter 12, Adding a Profile). Title Case courier 8 point in quotes Refers to the names of dialogs, windows, and fields (Add Web Log Profile dialog, Home Page URL) Refers to how text appears on the screen or in a file. Refers to a value or character that should be entered in a dialog (Enter 12 in the hours field). 18

19 Chapter 1. Before You Begin Refer to Appendix A. Glossary on page 145 for additional definitions of terms used in WebTrends and in the documentation, as well as for general Internet terminology. Getting Help WebTrends provides comprehensive online help to guide you through dialogs and procedures. Look for the Help button in WebTrends dialogs. If you re not sure about what to enter in a particular field click the Help button. At any time, you can access help by selecting the Help menu from the WebTrends main console. Giving Us Feedback We welcome your feedback. If you have questions that aren t answered through this manual, please tell us so by selecting the Give Us Feedback option from the Feedback menu main console. 19

20

21 Chapter 2. Installing and Setting Up WebTrends In This Chapter: System Requirements Installing WebTrends Uninstalling WebTrends WebTrends Main Console System Requirements You can install and run WebTrends on any computer running Microsoft Windows NT 4.x or Windows 95. Because WebTrends can retrieve your Web server log files and analyze web sites remotely, it is not necessary to install this program on the server itself. WebTrends works with the following minimum system requirements: 20 MB available disk space 16 MB memory for Windows 95 systems, 32 MB memory for Windows NT systems Microsoft Windows NT 4.x or Windows 95 Note: More space and memory is required to analyze large log files. Contact your Product Support representative for more information. Installing WebTrends WebTrends is installed using a straightforward Windows setup program. Choose the procedure that best suits your needs: 21

22 WebTrends Log Analyzer Installing with Auto-run If your system is set up to automatically run CD-ROMs when you place them in the CD-ROM drive, complete the following steps: 1. Insert the WebTrends CD-ROM into your CD-ROM drive. The setup program is launched. 2. Follow the on-screen instructions to install WebTrends. Installing from the Run Dialog 1. Insert the WebTrends CD-ROM into your CD-ROM drive, and choose Run from the File or Start Menu. 2. In the Run dialog box, type d:\setup where d: refers to the drive letter of your CD-ROM drive. The setup program is launched, and walks you through the installation of WebTrends. Software License Agreement Before the WebTrends program files are copied to your system, the WebTrends Software License Agreement is presented. If you agree to the stated terms, click Accept. Otherwise, click Cancel to exit the setup program without installing WebTrends. Note: The WebTrends Software License Agreement appears at the beginning of this guide. Installing Extended Logging Plug-Ins WebTrends is shipped with plug-ins for Microsoft IIS (3.0 and 4.0) and Netscape Web Server which allow you to log your web site visitors browser and platform (operating system) information (also known as extended logging ). If the WebTrends Setup program detects either Microsoft IIS or Netscape Web server software on the system it is being installed on, you have the option to install the plug-in to enable extended logging. For more information about the extended logging plug-ins including plug-in configuration options, see Microsoft IIS Plug-in for Extended Logging on page 107 or Setting up WebTrends Netscape Plug-In on page

23 Chapter 2. Installing and Setting up WebTrends Note: This option is available only if you are installing WebTrends on a system where Netscape Server or Microsoft IIS is installed. Note: You can install the plug-in later or on a different machine by running IIS Extended Log Setup or Netscape Extended Log Setup (extendlog.exe) from the WebTrends program group. Installing TNG Integration Utility The WebTrends TNG integration utility for Computer Associates TNG Unicenter and Computer Associates TNG Framework lets you manage WebTrends and monitor its status through the SNMP Agent. You can also monitor the status of WebTrends and perform certain actions to a given change of state. Unicenter and Framework are management consoles for IS infrastructure, which includes everything from networks, the computers attached to them, the software loaded onto those computers, as well as extraneous devices. To install the TNG integration utility complete the following steps: 1. From the Start menu, select Programs, WebTrends, and you'll see an entry called TNG Setup. 2. Click OK when the Welcome dialog is displayed to start the installation. 3. Select the repository where all WebTrends objects are stored for the TNG database. 4. A dialog is displayed telling you the importance of activating the SNMP trap server within Unicenter. Click OK. 5. Click OK to complete the installation. When you run Unicenter or Framework, WebTrends shows up as an icon. Note: You must have TNG Unicenter or TNG Framework set up and running before installing this plug-in. Registering WebTrends When you launch WebTrends for the first time, you can register your copy of the software online. 23

24 WebTrends Log Analyzer Note: If you choose not to register WebTrends at this time, you can access the registration form later by selecting Online Registration from the Help menu within the program. If you click Yes in the Online Registration dialog, a dialog appears allowing you to register your purchase. Uninstalling WebTrends WebTrends includes a standard Windows uninstall program. To remove the software from your system: 1. Select the Add/Remove Programs utility from your Control Panel. 2. In the Install/Uninstall tab, highlight WebTrends in the list of existing programs and click Add/Remove. 3. The Uninstall program walks you through the removal of the WebTrends program from your system. WebTrends Main Console All program functions can be accessed from the File and Configure menus. The main program activities are represented in the toolbar just below the menu. All of the analysis and reporting that you do with WebTrends is based on profiles. These are listed in the main area of the WebTrends main console. The profile tabs allow you to choose between the display of all profiles or just the profiles for a cartridge. Tip: By default, the profile lists are sorted alphabetically by the descriptions: to sort by either of the other list criteria (i.e., URL Path or Profile Type), click on the title button at the head of the column. Tip: Right-click anywhere in the profile list area to access a pop-up menu which includes a View > command. This submenu gives you the option to view your profile lists as large icons, small icons, list or detail. The default is Detail View. 24

25 Chapter 2. Installing and Setting up WebTrends Your first step when you initially install WebTrends is to add a profile (click New) telling WebTrends where your web site, Web server log file or proxy server log file is located. Then, when you are ready to analyze and report on that site or log file, you highlight the profile in the list, and click Report. Click here to launch the WebTrends scheduler. Click here to configure WebTrends for your environment. Click here to add a new link, web log or proxy analysis profile. Click here to edit the highlighted profile. Click here to remove the highlighted profile. Click here to generate a WebTrends report using the highlighted profile. Click here to access the WebTrends report style editor. List of the existing link, web log and/or proxy analysis profiles. Displays the status of the next scheduled report or a realtime analysis in progress. Displays statistics for the highlighted profile. Click and drag the lower right corner of the main console to enlarge it and display all of the button bar options. Balloon help appears as you drag your cursor over the button toolbar on the main console: 25

26

27 Chapter 3. Web Log Analysis Profiles and Reports In This Chapter: Scenario: Web Site Activity Reporting Formatting Log File Path Entries WebTrends Views Now you re ready to get down to business and see what kind of traffic your web site has been getting. All web site activity is recorded in a log file maintained by the Web server, so all you need to do is tell WebTrends where to find your Web server log file, what kind of information you want to retrieve from it, and WebTrends does the rest! Note: For a more general overview of how WebTrends Web log analysis works, see Understanding WebTrends Log Analysis on page 14. Scenario: Web Site Activity Reporting For this scenario, you are the new head of the marketing department of SuperSales, Inc. Your company has had a virtually hosted web site up for the last year which until now been an untapped resource. Your plan is to use WebTrends to show who is visiting the site, where they are coming from, and which pages are the most popular: in short, how to make the most of your internet real estate. 27

28 WebTrends Log Analyzer The procedures that follow walk you through these important steps: Adding a Web Log Analysis Profile tells WebTrends where to find your web site s log file and how to process and filter it. Creating a Log Analysis Report explains the WebTrends reporting options. Adding a Web Log Analysis Profile Your first step is to tell WebTrends where to find the log file that contains the activity information for your web site. 1. From the WebTrends main console, click New. The Add Log Profile Title, URL dialog appears. 2. In the Description field, enter a description to identify your Web server log file (for example, SuperSales, Inc. Web Site ). This description appears in the profile list in the WebTrends main console, and as the subtitle of reports and views that are based on this profile. 3. In the Log File URL Path field, select the ftp:// option to retrieve your log file via FTP since your site is hosted remotely. In the future you may select one of the following: File Retrieval Method Select the file://option from the drop-down list if you have a drive mapped to your web server. Then enter the path to your log file. Click the Browse button to search for the exact location and file name. 28

29 Chapter 3. Web Log Analysis Profiles and Reports Note: To add multiple log files (rotated log files), enter a pipe character ( ) between the log file path names. Or use the wildcard characters (* or?) to stand for several log files. FTP Retrieval Method Select the ftp:// option from the drop-down list if you must retrieve your log file using ftp (file transfer protocol). For example, if your web site is hosted through an ISP, you may have to retrieve your log file through ftp. When you specify an ftp URL, you must enter the full path from the root of the ftp server, not just from the default login directory. To add multiple log files (rotated log files), enter a pipe character ( ) between the log file path names. Or use the wildcard characters (* or?) to stand for several log files. To enter your user name and password for the FTP site click Details. Within this login dialog, you can click Browse to search for the each FTP location. HTTP Retrieval Method Select the http option to retrieve your web server log file over the Internet using HTTP. You must enter the username and password information only if you are accessing a secured web site. ODBC Retrieval Method If your web server log file data is stored in an ODBC data source, WebTrends can retrieve the information directly from this source. Click Browse to search for the exact location of the data source. Note: You can use wildcards, date macros, multiple logs, and compressed logs in your log file entry. See Examples: Log File Entries later in this chapter for details. 5. Click Details to access the FTP Server Login Info. dialog. 5. Since you are using FTP, you must supply a user name and password for the specified computer. Enter a username and password for the FTP server. Click Browse to specify the exact location and name of the log file, and click OK to continue. 29

30 WebTrends Log Analyzer 6. In the Log File Format field, specify the log file format if necessary. By default WebTrends automatically detects the type of log file that you are adding, but you can specify one here. 7. When you have completed defining the location of the log file, click Next to display the DNS Lookup dialog. Reverse DNS lookups translates the numeric IP address into a domain name. This can be done either by the web server when logging activity or by WebTrends when it analyzes the log files. DNS Lookups are performed more efficiently by the web server as the log is created, rather than by WebTrends. However, if you know your web server administrator or ISP disabled DNS Lookups for their servers, you can have WebTrends do them for you. Since you have determined that your Web server is not performing the DNS lookup, and you would like your reports to display domain names and corresponding geographic information, you will select Resolve Mode. In the future you can choose one of the following: Quick mode, using format from log Maintains the log format, domain name or numeric IP address, making this the fastest method for creating reports. If your web server doesn t perform DNS Lookups and you choose the Quick Mode in this dialog, WebTrends reports will display visitor s IP addresses rather than domain names. Resolve mode, lookup all numeric IPS If your web server does not perform DNS Lookups and you need geographic or other domain-related information, select this option. Note: Resolve mode may significantly slow reporting. Use it only if DNS lookups cannot be done on the server. Once a numeric address has been looked up, its text equivalent is stored in a permanent cache to expedite all subsequent reports. The default cache size is 7,000 entries; once this limit is reached, the oldest addresses are replaced with the new entries. You can change the cache size in the Web Log Analyzer General Options tab. See page 132 for details. 30

31 Chapter 3. Web Log Analysis Profiles and Reports Auto mode, if you re unsure If you don t know whether your log file contains IP addresses or domain names, you can let WebTrends decide. If WebTrends finds a domain name when it begins analyzing the log file, it uses the quick mode. If WebTrends finds an IP address when it begins analyzing the log file, it tries to translate, or resolve, all IP addresses. Note: For Tips on how to determine if your Web server is performing the DNS Lookup, see Creating a WebTrends View on page 39 later in this chapter. 8. Click Next > to proceed to the Add Log Profile, Home Page dialog. Although you are not required to complete the following two fields, we strongly recommend that you do. These fields define the location of your web server home page regardless of any sub-domains on which you are reporting. Note: If you want WebTrends reports to identify Web pages by their <title>, you need to specify the home page directory. See Retrieve HTML Page Title on page In the Home Page File Names field, specify the file names that the web server defaults to when a visitor requests a URL without a specific file name. Separate multiple file names with spaces. 10. In the Web Site URL field, specify the location of your web site. In the first field, select the method of accessing your web site and then enter the path to the web site. For our example, select ftp:// from the list, and click Details to enter your login information. Then click Browse to specify the exact location and file name of the HTML home page for your web site. Click OK. In the future you can choose from the following: file:/// If you have file system access to your web server log file (on your machine or through a mapped drive), this is the quickest retrieval method. Specify the drive and directory to your web page. For example, c:\inetpub\wwwroot\ 31

32 WebTrends Log Analyzer ftp:// If you access your web pages through FTP, select this method and enter the complete path to your web site. If you access your web pages through HTTP, select this method and enter the path to your web site. If the web site is secure, click Login to enter username and password information. Note: If you use each time a web page title is retrieved, it is counted as a new hit. Both ftp:// and file:/// avoid recording these false hits. Note: If WebTrends reports N/A hits to your home page, try specifying the IP address in this field. This field must contain the data as it is recorded in your log file. 11. Click Next > to display the Filters dialog. The filters dialog allows you to specify the log file data that you want to analyze. In this example, you will keep the default Include Everything filter so that all of your log file data will be included. Click Next > to proceed. For a complete explanation of WebTrends filters, (for example, reporting on one domain housed on a server with many others) see Chapter 4. Filtering Log Analyses on page In the Database and Real-Time dialog, you can set up analysis caching and real-time analysis and reporting options for your log analysis profile. See Chapter 7. FastTrends and Real Time Reporting on page 83 for details about FastTrends caching and real-time analysis and reporting options. 13. Click Finish. You are returned to the WebTrends main console, and your new log analysis profile appears in the profile list. Note: Statistics about the log file corresponding to the highlighted profile appear at the bottom of the main console. These include the log file size and when it was first and last updated. For remote FTP and HTTP log profiles, these fields will display N/A. 32

33 Chapter 3. Web Log Analysis Profiles and Reports Tip: WebTrends profiles are text-based to facilitate changing multiple profiles at one time with any text editor. The extension for web log analysis profile is.wlp. Profiles are located in the datfiles subdirectory of the wtm_log directory. Creating a Log Analysis Report Now that you have told WebTrends where to find your Web server log file and how to process the data, you can run a report. At the time that you create a WebTrends Web log analysis report, you define the following parameters: The time or date range of the report The report format (i.e., HTML, MS Word, etc.) The destination (file location or recipient) of the resulting report The report style and language to use The report content (which graphs and tables to include) All of these settings can be memorized so that you can apply them to other Web log analysis profiles. To create a Web log analysis report: 1. From the WebTrends main console, click once on your Web Log analysis profile to select it. 2. Click Report to display the Create Report window. 33

34 WebTrends Log Analyzer 3. To use previously memorized settings for reporting or editing, select the name of the memorized report from the Memorized Report Name dropdown list (and skip to step number 10). Otherwise, proceed to the next step. If you do not choose a Memorized Report Name, select the time or date range for your report from the Report Range drop-down list. See Report/View Ranges on page 163 for explanation of the predefined Report Ranges. Note: While WebTrends attempts to analyze and report on the specified Report Range within the log file processed, you need to ensure that the specified range corresponds to existing dates in the log file. For example, if the analyzed log file contains data for only the last week of activity, WebTrends is not able to provide meaningful monthly averages. 4. Select the Format tab. Select the format in which to produce the report. Note: HTML reports are the quickest to create. Use Word formats to created printed executive reports with page numbering, headers and footers. Note: You must have Microsoft Office installed to use the Word or Excel formats, rather than the stand alone versions. 5. Select the Save As/Mail To tab to identify the location and file name in which to save your report and select one of the following options: 34

35 Chapter 3. Web Log Analysis Profiles and Reports file:/// This option saves reports locally. ftp:// This option uploads files to another system. mailto This option automatically s the files to one or several recipients. Then, enter the URL path in which to save the report that you are creating. Note: WebTrends provides macros that you can use to define file or directory names that represents a date. For more information, see File Name Macros on page 37. To the completed report, select the mailto: option from the drop-down list and specify the addresses of the recipients as well as the report file name. Note: See Options on page 124 for more information about enabling and configuring the WebTrends feature. 6. Select the Style tab. In the Report Title field, enter the title that will appear at the top of your report above the log profile description. 7. In the Report Language field, select a language from the list. See Adding or Editing Report Languages on page 65 for more information about the Language Editor. 8. In the Report Style field, select from a list the default or your own predefined report styles. See Scenario: Modifying WebTrends Report Style on page 61 for more information about the Style Editor. 9. Select the Content tab to specify the report items to include, the number of elements for each table and graph, and the style of each graph. See Scenario: Modifying WebTrends Report Content on page 66 for more information about the Content Editor. 35

36 WebTrends Log Analyzer 10. Click Memorize if you would like to save your report settings in order to apply them to any log profile for future reports. Otherwise, proceed to the next step. 11. Click Start to accept the options that you have defined and generate your report. Note: While WebTrends is in the process of generating the report, you can click Stop Here to create the report with the data collected so far, or click Cancel to cancel the report generation. If your report settings are not memorized, however, you lose all the settings. 12. Once the report data is collected, WebTrends launches your browser and loads the generated HTML report. If you are generating a report in Microsoft Word or Excel, WebTrends automatically launches the appropriate program. See examples of Web Log Analysis Report on page 153. Formatting Log File Path Entries The examples in this section show how you might use wildcards or date macros to specify log file path entries, and how to specify compressed logs or zipped log files. Standard Log File URL Path Examples c:\winnt\system32\logfiles\ex log Specifies the file location of the log file. ftp.domain.com/logs/ex log Specifies the FTP log file path. Specifies HTTP log file path. Compressed Logs c:\domain.com/logs/ex zip ftp.isp.com/log/ex gz 36

37 Chapter 3. Web Log Analysis Profiles and Reports Wildcards c:\winnt\system32\logfiles\ex*.log c:\winnt\system32\logfiles\ex9802*.log c:\winnt\system32\logfiles\ex9802??.log Multiple Logs You can specify multiple log file names by separating the entries with the pipe( ) character. d:\logfiles\logfile.log logfile2.log Specifies "logfile.log" and "logfile2.log" in the "logfile" directory on drive d:. \server\*.log \server2\*.log Specifies all of the.log files in the "server" and "server2" directories on the current drive. c:\server\logfile.log d:\logfiles\*.log Specifies "logfile.log" in the "server" directory on drive c: and all of the.log files in the "logfiles" directory on drive d:. File Name Macros WebTrends provides built-in macros to assist in automating report process. You can also use these macros in the Save As paths of the Scheduler and the Create Report dialog. %mm% Returns the current two-digit month value. %dd% Returns the current two-digit day value. %yy% Returns the current two-digit year value. 37

38 WebTrends Log Analyzer %YYYY% Returns the current four-digit year. %MON% Returns the current three-letter month Note: This variable is now case-sensitive. For example, %Mon% will read Jan, and %mon% will read jan. %DATE-x% Subtracts x value from the current date (e.g., %DATE-1% returns one day before current date) Note: This variable will affect the month or year values. If, for example, you use %DATE-10% on the 10 th day of the month, you will be specifying the last day of the previous month. Example 1: To configure WebTrends to run a report every day which never overwrites the previous day s report, enter the following in the Create Report Window (Save As/Mail To tab) Save As field: C:\WEBTREND\DATFILES\REPORTS\%mm%%dd%%yy%.htm WebTrends creates a report file each day with file names like HTM Example 2: If your Web server maintains a separate log file for each day named by the date, and you would like to define a log profile which incorporates only the previous day s web site activity, enter a line like the following in the Log File URL Path: field in the Add Log Profile dialog: C:\WEBSRVR\LOGFILES\%DATE-1%%mm%%dd%%yy%.log Example 3: If your Web server maintains a separate log file for each day named by the date, and you would like to specify the previous three days worth of log files, enter a line like the following in the Log File URL Path: field in the Add Log Profile dialog: C:\WEBSRVR\LOGFILES\%DATE-1%%mm%%dd%%yy%.log %DATE-1%%mm%%dd%%yy%.log %DATE-1%%mm%%dd%%yy%.log Note the pipe characters between each file name, and that each %DATE-1% refers to the date immediately preceding it in the list: you do not have to enter DATE-2 and DATE-3, etc. 38

39 Chapter 3. Web Log Analysis Profiles and Reports WebTrends Views With WebTrends, you can peruse filtered data from your Web server log file in a color-coded, organized, and easily identifiable format referred to as a view. You can view a specific time or date range, order by different criteria such as country or domain type, and in a detailed or standard format. As with WebTrends reports, views are based on log analysis profiles, and once you have established the parameters for a view, you have the option to memorize the settings to use with any Web log analysis profile. Views Tip: WebTrends views can be especially helpful for gathering data about your log file and troubleshooting information. For example, if the Home field appears, you know that yours is a multi-homed log file. See Scenario: Filtering a Multi-Homed Log File on page 57 for an example. Or if you turn the WebTrends DNS lookup option off and the IP addresses are still being resolved (domain names are appearing in the Address field) then you know that your Web server is performing reverse DNS lookups. Creating a WebTrends View Complete the following steps to view your log file and memorize the view settings: 1. From the WebTrends main console, select your log analysis profile. 2. Choose View Log from the File menu. 39

40 WebTrends Log Analyzer 3. To use previously memorized settings for this view, select the name of the memorized view from the Memorized Views drop-down list. Otherwise, proceed to the next item. 4. In the View Type field, choose whether to generate a Detailed Log Report or a Standard Log Report (examples follow). The default is Standard Log Report. 5. In the Order View by field, choose whether to order the report by Time, Domain Type, Country, Protocol, Event, Date, Result or File. The default is to order by Time. Note: If you choose to order by any criteria other than Time, WebTrends creates a separate view for each item. For example, if you are sorting by Country and you have events from three countries, you will have three views. 6. In the View Range field, choose the time or date range that you would like to view within the selected log file. You can specify a date and time range, or you can choose between the predefined parameters. The default is All of Log. Click to view the list of predefined range options and then click on the range you want to select. View Range options are defined in Report/View Ranges section on page 163. Note: While WebTrends attempts to analyze and report on the specified Report Range within the log file processed, you need to ensure that the specified range corresponds to existing dates in the log file. For example, if the analyzed log file contains data for only the last week of activity, WebTrends is not able to provide meaningful monthly averages. 7. Click Memorize if you would like to save your view parameters in order to apply them to any log profile for future views. Otherwise, proceed to the next step. 8. Click Start to accept the options that you have defined and generate your log file view. Note: While WebTrends is collecting data for your log file view, you can click Stop Here to view the log data collected so far, or click Cancel to cancel the view. If your view settings are not memorized, however, you will lose all the settings. 40

41 Chapter 3. Web Log Analysis Profiles and Reports The following graphics show the same view in detailed format and then in standard format. Detailed view example: Standard view example: 41

42 WebTrends Log Analyzer For definitions of view items terminology, refer to the log file field definitions in Understanding Log Files on page 16 or Appendix A. Glossary on page Click the down and up arrows to scroll through additional pages of the view. When you are done, click Close to exit the view window and return to the WebTrends main console. 10. To create additional views, repeat steps 2-9. View Text Color Coding View text is color coded to help you identify the different items in a report. This Color Blue Black Green Red Indicates View title and file names Headings Data Warnings or errors Note: If you choose to order by any criteria other than by Time, WebTrends creates a separate view for each item. Click to display a list of views, and click on the item you want to view. 42

43 Chapter 3. Web Log Analysis Profiles and Reports Click here to view a list of available views. Within the WebTrends log file viewer, you can search for a specific text string, change the font and point size, save or print the log file view. The following sections details these activities. Searching for a Text String Complete the following steps to search the log file view for a text string: 1. Click in the Find Next text entry box to enable it and then type the text string you want to search for. 2. To begin searching, click Find Next. WebTrends finds the first instance of the text string and highlights it. 3. To search for the next instance of the text string, click Find Next again. When you have completely searched the view for the text string, a dialog box appears asking if you want to begin searching from the beginning of the view. 4. Choose Yes to continue or No to quit. 43

44 WebTrends Log Analyzer Changing Font and Point Size To change the font: 1. Click in the upper left corner of the view to display a list of available installed Windows fonts. 2. Click on the font name to select it and change the view text. To change the point size of the view text: 1. Click on next to the font change window to display a list of available point sizes. 2. Click on the desired point size to select it and change the view text. Printing and Saving Log File Views You can save or print any view you generate with WebTrends for future reference. To print the view: 1. Click Print in the View Report window. A standard Windows print dialog box appears. 2. You can print the entire view or a range of pages. To save the view: 1. Click Save in the View Report window. 2. Enter a file name (the extension is determined by the view type you choose). 3. Enter a location and view type (color-coded or ASCII) for the view. By default, views are saved in the report directory (C:\Program Files\WebTrends Suite\Reports\Web Analysis\*.RPT, for the ASCII view or C:\Program Files\WebTrends Suite\Reports\Web Analysis\*.CCR for color-coded views). 4. Choose OK to save the view in the specified location. Note: If you are printing or saving a view which has been ordered by any criteria other than Time (i.e., Suffix, Country, Protocol, Event, Date, Result or File), before the standard Print or Save As dialog boxes appear, you have the option to select which views to print or save. 44

45 Chapter 4. Filtering Log Analyses In This Chapter: Using Web Log Analysis Filters Filter Elements Scenario: Filtering a Multi-Homed Log File Filters let you limit the scope of your analysis by telling WebTrends what you want it to look at in your web log analysis profile. How the analysis is performed determines what is displayed in your WebTrends reports or views. You can filter in data through include filters and filter out data through exclude filters. Include filters tell WebTrends that you only want to WebTrends to analyze activity in the log file that matches the filters you have defined and that you want to ignore everything else. By default, WebTrends includes everything. If you want to filter in specific information, you can begin by editing the Include Everything filter and making changes in one of the filter fields. You can combine several filter elements in a single include filter and use several include filters in a single profile. Exclude filters tell WebTrends to ignore specific activity in the log file and exclude it from the analysis and reports. By default, nothing is excluded. You can combine several filter elements in an exclude filter and use several exclude filters in a single profile. Note: You can create both an include and exclude filters in one profile. For example, if you would like to determine how much of your domestic Web server activity is from organizations other than the military, create an include filter for all U.S. User Addresses and an exclude filter for all military User Addresses (.MIL). 45

46 WebTrends Log Analyzer Using Web Log Analysis Filters The capabilities of WebTrends filters are far-reaching. This section describes creating a simple filter, and explains the principles of combining filter elements and using multiple filters in a profile. Adding a Filter To a filter to an exiting Web log analysis profile: 1. Select the Web log analysis profile that you want to filter in the profile list of the WebTrends main console. 2. Click Edit. 3. Click the Filters tab in the Edit Web Log Profile window. 4. Select the Include Everything and click Delete. 5. Click Add. The Add Filter Type dialog appears. 6. Choose whether to create an include or exclude filter, and click Next. The Add Filter Name dialog appears. 7. Enter a name for the filter in the name field, and click Next. The Element dialog appears. 8. Click the Include Only Activity Based Upon option. 46

47 Chapter 4. Filtering Web Log Analyses 9. Indicate the type of activity that you want to filter by checking the corresponding filter element boxes. The corresponding filter element tabs appear where you can define the criteria that you want to filter for. Refer to the Filter Elements section later in this chapter for descriptions and use of each element. Combining Filter Elements You can combine several filter elements (such as Directory and User Address) in one include or exclude filter. For example, if you want WebTrends to check the current profile for only a user address of janesmith.com and if that user was looking at the \Sales directory, you would create an Include filter and enter janesmith.com in the User Address tab and \Sales in the Directory tab. If WebTrends find a match that meets both of your criterion, it returns the result to you and display the result in the report or view. Note: WebTrends reads the elements of a single filter (such as multi-homed domain, file) as and statements. For example, if Log File Activity matches Filter Element1 AND matches Filter Element2 AND then return the result in the report or view. 47

48 WebTrends Log Analyzer Combining Include and Exclude Filters in a Profile You can combine include and exclude filters within a profile to focus the analysis. For example, you might want to Include only activity that matches your \Products directory but exclude any images. To do so you would create an Include filter and enter \Products in the directory tab, and then create an exclude filter and enter *.gif in the Files tab. Note: WebTrends reads the filters in a profile as or statements. For example, if the Log File Activity matches Filter1 OR matches Filter2 OR then return the result in the report or view. This means that for a log file record to be included, it must match at least one include filter and not match an exclude filter. Filter Elements A single filter is comprised of filter elements, each enabling you to focus on a different aspect of the log file. These elements are described in the sections that follow. Return Codes The log file includes the results of results received from browsers, which are called return codes. Use the Return Code filter to specify the types of results you want to include or exclude. For example, if you are creating an include filter and you want to only return successes, select Success Only from the list. For example, to find out about all hits that ended up with a 404, filter for this Return Code. This can help you identify sites that refer to material removed from your web site. You can select one of the common returns codes provided in the list, or type another numeric result code in this field. The default, indicated by an asterisk (*), is All Return Codes. User Address Use a User Address filter to include or exclude domains, IP addresses, or countries from the results of this web log analysis profile. For example, if you are creating an exclude filter and you specify a domain that you want to exclude, such as your own, the report would not include any activity from the domain that you entered. 48

49 Chapter 4. Filtering Web Log Analyses Type the user addresses that you want to specify, or click the down arrow to select from the list of predefined user addresses. The default All User Addresses is indicated by an asterisk (*) in the field. Note: Country information is not always accurately reported. User Address Filter Examples: * Specifies all numeric IP addresses from through *.WebTrends.com Specifies only those addresses that have a sub-domain that appears to the left of this domain (such as., www. WebTrends.com, ftp. WebTrends.com, etc.) This would not include addresses without a subdomain. * WebTrends.com Any address that includes the specified domain, with or without a subdomain (such as., www. WebTrends.com, ftp. WebTrends.com, or WebTrends.com). *.edu *.com *.net *.de All addresses that have the domain types: edu, com, or net. Specifies all addresses from Germany. Specifies only those addresses that have www as a sub-domain. Formatting User Address Filters Use wildcards to specify multiple user addresses or separate them with a space * Specifies all numeric IP addresses from through

50 WebTrends Log Analyzer *.webtrends.com Specifies only those addresses that have a sub-domain that appears to the left of this domain (e.g., ftp.webtrends.com, etc.). This would not include addresses without a sub-domain. *webtrends.com Any address that includes the specified domain, with or without a subdomain (e.g., ftp.webtrends.com, or webtrends.com). Tip: You can specify IP addresses as well as domain names in filter fields if you are uncertain whether DNS lookups are being performed. *.edu *.com *.net *.de All addresses that have the domain types: edu, com, or net. Specifies all addresses from Germany. Specifies only those addresses that have www as a sub-domain. Multi-Homed Domain Note: This filter only applies to multi-homed log files. Specify the domains you want to include or exclude. For example, if your multi-homed log file contains activity from domains and and you want to report only on and you would create an include file and specify the following: Directory Use the Directory filter to include or exclude the activity of a specific directory. Enter the directory path in this field. 50

51 Chapter 4. Filtering Web Log Analyses The default for an include directory filter is to view all directories starting at the root directory, indicated by a slash in the field (/). There is no default for an exclude directory filter. If you want to include or exclude all subdirectories, starting with the directory you specified and proceeding downward, click the Include SubDirs checkbox. Check the case sensitive box if you want WebTrends to look for exact case matches. The default for both include and exclude files filters is to activate the subdirectories (indicated by a check in the Include/Exclude Subdirectories box). Therefore, if you created an exclude filter for the /Images directory, WebTrends automatically excludes the subdirectories. Similarly, if you created an include filter for a directory, WebTrends automatically includes the subdirectories. Directory Filter Examples /images Specifies the directory /images is filtered and all subdirectories thereof, if Include Subdirectories is checked. "/image files" Specifies the long directory /image files. "/image files" /intranet /graphics /image* Specifies the directories /image files, /intranet, and /graphics. Specifies any first-level directory whose name begins with image, such as /image bitmaps, /image1 and /image2, but not /intranet/image bitmaps. /*graphics Specifies any first-level directory whose name ends in graphics, such as /bitmap graphics, but not /intranet/bitmap graphics. /*/graphics Specifies all second-level directories named /graphics, such as /home/graphics and /intranet/graphics, but not /home/sales/graphics. Directories such as /home/graphics/logos, are specified by this example only if Include Subdirectories is checked. 51

52 WebTrends Log Analyzer /graphics /*/graphics /*/*/graphics Specifies all first, second and third level directories named graphics, such as /graphics, /home/graphics, and /home/sales/graphics. Subdirectories of these, such as /home/graphics/logos, and /home/sales/graphics/logos/specials would be included only if Include Subdirectories is checked. /*graphics*/ Specifies all first level directories with names containing graphics, such as /graphics, /graphics files, and /bitmap graphics. Note: Remember to put quotation marks around directories containing spaces or commas. Note: Most servers do not require case sensitive (upper or lower case) matches, although some do. If yours is not case sensitive, do not check this box. Formatting Directory Filters Use wildcards to specify multiple directories, or separate directories with a space. Enclose file names that include a space (logo_graphic) in quotation marks ( /logo_graphic ). File Filter Use the file filter to include or exclude specific files. Enter the file name or extension in this field, or click the down arrow to select a file type from the list. The default for an include files filter is to include all files, indicated by *.* in the field. The is no default for an exclude filter. A check in the case sensitive box means that you want WebTrends to look for exact case matches (upper or lower case). Note: Most servers do not require case sensitive matches, although do. If yours is not case sensitive, do not check this box. File Filter Examples help.htm 52

53 Chapter 4. Filtering Web Log Analyses Specifies the file help.htm. *.gif *.bmp Specifies bitmap (.bmp) and gif (.gif) files. help*.html help*.* Specifies all html files whose name begin with help. Specifies all files whose name begin with help, regardless of type. marketing.htm marketing help.htm marketing leads.htm Specifies the files marketing.htm, marketing help.htm, and marketing leads.htm. Formatting File Filters You can use wildcard characters to expand the number of files reported on, such as all HTML files (*.HTM) or all GIF files (*.GIF). You can also specify several file types at once by inserting a space between each file type, as in the following example: Corporate Logo.gif Specifies that the corporate logo.gif file is filtered. *.htm *.html *.shtml *.txt The default for an Include Item, *.*, is to include all files. There is no default for an Exclude Item, therefore it will exclude no files. Referrer The referrer filter helps you identify the quantity and quality of users coming to your site from other sites or from a specific Internet advertisement link. With this feature you can establish the effectiveness of your Internet advertising. 53

54 WebTrends Log Analyzer Note: Be sure to include either the protocol of the referrer or a wild card at the beginning of the entry. For example * where the first asterisk (*) stands for the protocol, or where indicates the protocol. Referrer Filter Examples Specifies all referring URLs originating from search services. Specifies only the referring URLs from the domain yahoo.com. *reports.html Specifies only the referring URLs originating from the reports.html pages. *yahoo.com* Specifies all activity from the yahoo.com domain. Note: This filter does not apply to log file views, only for log file reports. Formatting Referrer Filters You can separate multiple referrers with a space. Use an asterisk (*) either to the right or left of a partial referring URL as a wildcard. If you do not use a wildcard, WebTrends looks for exact matches (case insensitive). Append a wildcard character (*) if you want to specify all activity form a referrer. For example, Advertising With the advertising filter you can either include or exclude hits that result from and Ad View or Ad Click. This filter gives you the ability to produce reports based on a specific web site advertisement s activity to distribute to a client. 54

55 Chapter 4. Filtering Web Log Analyses Click the down arrow to select a previously configured advertising definition. Note: You can define Ad Views and Clicks by clicking the Ad Clicks button. You may have to expand the window to see this button. Click the Help button in the dialog for details. Browser Use the browser filter to either include or exclude a browser, spider or robot from a Web log profile. You can filter any browser, spider or robot if you know how it appears in the agent field of the log file. Browser Filter Examples: Mozilla/4. Mozilla/3.1 Indicates that activity that matches Netscape Navigator 4. or Netscape Navigator 3.1 is included or excluded from the report or view. MSIE Microsoft Internet Explorer/ Indicates that activity that matches any version of Internet Explorer is included or excluded from the report or view. Note: You cannot use wildcards (*) in a browser filter. WebTrends assumes that there are wildcards at either end of each browser entry when comparing it to the agent field in the log file. Note: Filtering for Netscape Navigator may not return accurate results because many browsers identify themselves as Netscape Navigator. 55

56 WebTrends Log Analyzer Formatting Browser Filters Use a space to separate multiple browsers. Use quotation marks around browser names that have embedded spaces. You cannot use wildcards for browser filters. Username If you have an Intranet site or a Web site that requires visitors to log on with a user name and password, then you can use the Authenticated User filter to include or exclude authenticated users from this web log profile. Check the case sensitive box if you want WebTrends to look for exact case matches (upper or lower case). Note: Most servers do not require case sensitive matches, although some do. If yours is not case sensitive, do not check this box. Username Filter Examples Jane Smith Indicates that any activity that matches Jane Smith is included or excluded from the report or view. Note: If the username you are filtering has a space separating the first and last names, you must surround the username in quotation marks as shown in this example. Bob Mike John Indicates that any activity that matches Bob, Mike or John is included or excluded from the report or view. Day Use the day filter to include or exclude days of the week from your web log analysis. For example, if you create an include days filter, a check indicates the log file activity must match the days checked to be displayed in the report or view. 56

57 Chapter 4. Filtering Web Log Analyses Hour Use the hour filter to include or exclude days of the week from your web log analysis. The default for the Hour Include filter is All. The default for the Hour Exclude filter is None. Any activity that is within the hour range that you specify through the begin and end range is filtered from the report or view. Note: Enter the hours in military format (twenty-four hour clock). Hour Filter Examples Between 12 and 17 Indicates that any activity from 12 p.m. to 5 p.m. is included or excluded from the report or view. Between 20 and 6 Indicates that any activity from 10 p.m. to 6 a.m. is included or excluded from the report or view. Scenario: Filtering a Multi-Homed Log File Let s assume that you are an Internet Service Provider (ISP) running Microsoft IIS in the Extended Log File Format, and would like to make web site activity reports available to your clients. The steps involved include: Step 1: Verifying your Log File is Multi-Homed (each hit logged is identified with the site that it belongs to) Step 2: Adding Profiles for Multi-Homed Log for each of your clients sites. Step 3: Defining and Memorizing Report Settings for your clients reports. Verifying your Log File is Multi-Homed One way to verify that your log file is logging multi-homed information, as well as determine the exact criteria to use in the multi-homed filter field, is to use the WebTrends View Log feature. 1. First, add a profile (click New in the WebTrends main console) for your Web server log file. 57

58 WebTrends Log Analyzer 2. Identify your log file location in the Add Profile dialog, accept the profile defaults (i.e., no DNS lookups, Include all filter, no FastTrends caching or real-time analysis), and save your profile. 3. Highlight your new profile and click View Log. (You may need to enlarge the WebTrends main console to see this button). 4. Accept the defaults in the View Log File window and click Start to begin generating your log file view. For more details on WebTrends Log View, see page In the View Report window, you can click Stop at any time to view the data analyzed so far. 6. Find the Home field that contains the name or IP address of the server this profile is for: what appears in this field is what you enter in your Multi-Homed Domain filter field. Adding Profiles for Multi-Homed Log Since you have already added a general profile identifying the location of your Web server log file, you can edit it to add your filter criteria, or, if you would like to keep this general profile for reference, you can make a copy to edit: 1. Highlight your profile and click Edit. 2. In the Edit Web Log Profile dialog, enter a description identifying the client s site that you are specifying. 3. Define the analysis criteria to use. See Adding a Web Log Analysis Profile, page 28, for definitions of the DNS Lookup, Home Page, and Real-Time options. 4. Select the Filters tab, highlight the Include everything filter and click Delete to remove it. 5. Click Add to add a new filter. 6. In the Type dialog, select Include, and click Next. 7. In the Name dialog, enter a title for your filter, and click Next. 8. In the Element dialog, select the Include Activity Based Upon option, and check the Multi-Homed Domain box. Click Next to continue. 9. Enter the Home field value from your View Log report (see above). 10. Click Finish to save your filter. 58

59 Chapter 4. Filtering Web Log Analyses 11. Click OK in the Edit Web Log Profile dialog to save your changes. 12. You are returned to the WebTrends main console, and your new profile appears in the profile list. 13. Use the Copy profile command from the File menu and repeat the previous steps to define a separate profile with corresponding filter for each of your clients. Defining and Memorizing Report Settings Now you are ready to define the report settings to apply to each client s profile. 1. From the WebTrends main console, click once on your Web log analysis profile to select it. 2. Click Report. 3. Define the report settings to use in the Create Report window. 4. See Creating a Log Analysis Report on page 33 for explanations of all of the report settings. 5. Select the Save As/Mail To tab. 6. In the Save Report As field, specify the local path or FTP upload location from which your clients can retrieve the completed reports. 7. Click Memorize to save your settings. 8. In the Memorized Report Description dialog, enter a name to identify these report settings and click Save. Chapter 6. Scheduling Reports on page 69 includes step-by-step instructions for scheduling WebTrends reports. 59

60

61 Chapter 5. Modifying Reports In This Chapter: Scenario: Modifying WebTrends Report Style Scenario: Modifying WebTrends Report Language Scenario: Modifying WebTrends Report Content WebTrends provides the following report editors which allow you to customize your reports: Style Editor With the style editor you can modify the colors, fonts, table frames, and logos used in WebTrends HTML reports. You can create multiple combinations, save them, and apply them to different reports. To access the style editor, click Style Editor on the toolbar. Language Editor The language editor makes it easy for you to customize reports with terminology common within your organization or to create foreign language versions of your reports. Each cartridge of WebTrends has its own language editor which you access through the Language tab in the Options dialog. Content Editor Each time you generate a Web log report, you have the option to specify which tables and graphs to include. You can also modify the number of items represented in each table or graph, as well as the style (e.g., pie chart, bar graph) of each graph. These selections are made in the Content tab of the Create Report window. Scenario: Modifying WebTrends Report Style WebTrends includes pre-configured style settings to help you get started with reports. What do you do when you want your WebTrends reports to follow a corporate look? Design your own! 61

62 WebTrends Log Analyzer In this scenario you ll learn how to add a watermark to all report pages, change the report font, and add your company logo. Adding or Editing Report Styles 1. To access the WebTrends style editor, click the Style Editor button on the WebTrends main console. The Style Wizard Introduction dialog appears, displaying a list of report styles. The left-hand side displays a sample of the style. Note: These styles apply only to HTML WebTrends reports. Word and Excel reports must be edited in through those programs after they have been created. 2. Since you want to use the default WebTrends report style as the basis for your new report style, select Edit the Selected Report Style. 3. Select the (Default) style in the Existing Styles list. 4. Click Next. The Style Wizard Color Configuration dialog appears where you select the image to use as a watermark for your report pages. 5. In the Page Colors area click Page Background and click the button. The Open a File dialog appears. 6. Select the image file you want to use as a watermark and click Open. The display area provides a sample of your selected image as a watermark. Note: The watermark image file must be in.gif or.jpeg format. 62

63 Chapter 5. Modifying Reports 7. Click Next to display the Style Wizard Font Selection dialog. Here you can identify the new fonts that you would like to use for the font in each report section. As you change fonts, the area to the left of the dropdown lists displays a sample of your selections. 8. Click Next to display the Style Wizard Table Layout dialog. In this dialog you can make changes to the following report features: Section Description Choose whether to include long or short descriptions for each section included in your WebTrends reports. Sort By Choose whether to order your report tables according to Hits, % of Hits, or User Sessions in decreasing order. Column Items Check the items that you would like to include in your table columns. Table Border Width Select the frame border to apply to your WebTrends report tables. The maximum width is 5mm. 9. Click Next > to display the Style Wizard Page Layout dialog. This dialog is where you can specify the logo to include on your WebTrends reports by defining the following options: 63

64 WebTrends Log Analyzer Table of Contents Frame Make sure this option is not selected to remove the framed table of contents in your WebTrends HTML reports. Table of Contents Frame Width (%) Specify the width of the table of contents frame as a percentage of the total report width. The default is 20%, and the range of possible frame widths is from 5% to 50%. Align Number in Table Columns Choose whether to center, left-justify or right-justify the data in your report tables cells. Logo File Click Browse to locate and select the logo that you want to add to your WebTrends reports. This logo file appears at the bottom of the last page of your report. 10. Click Next >. The Style Wizard Finalization dialog appears. 11. Enter a name for your new report style settings so that you can retrieve it, and click Finish to save your settings and exit the style editor. 12. In the WebTrends main console, highlight the profile you want to report on and click Report. 13. In the Create Report window, select the Style tab and select your new style from the Report Style drop-down list. Scenario: Modifying WebTrends Report Language In this scenario, your organization has standardized terminology for web site accesses. You need to replace all instances of User Sessions and Sessions with the word Visit. The language editor makes this easy! With the WebTrends language editor, you can easily modify any or all of the text that appears in WebTrends reports. This is particularly helpful if you would like to generate WebTrends reports in a foreign language. As with the style editor, you can create several different report languages. Then when you create a report, you can choose which language to apply. 64

65 Chapter 5. Modifying Reports Adding or Editing Report Languages 1. Click the Options button on the toolbar. 2. Click the Web Log Analysis button on the left-hand side of the Options dialog. Select the Language tab. Here you can modify the following options: Report Language Select the existing language to modify, or click Add to create a new language. Report Items Here you can view a tree of the report sections and corresponding text areas. Use the Collapse All button to close all of the books and view only the first directories of the selected language tree. Use the Expand All button to open all subdirectories and view the entire tree. Content Here you can edit the text that appears in the report sections by selecting a report section in the Report Items section and editing the text in the Content section. Click Save to save your changes or Restore to revert to a previously saved version of text for the selected Report Item or the entire Report Language. Set Default Language Use this button to define the language that should be used by default for all new reports. 3. Since you want to replace all instances of User Sessions and Sessions with Visits, simply click Find to access the Find/Replace dialog. The Find/Replace dialog appears. 4. Select Search in Text to work with all of the text that actually appears in the reports. Note: Search in Title searches only the titles as they appear in the Report Items list). 5. In the Find What: field, type User Sessions, and in the Replace With: field, type Visits. 65

66 WebTrends Log Analyzer 6. Select Match Case, and click the Replace All button. 7. Repeat steps 6 through 9 with the text in all lower case to replace all instances of user sessions. 8. Repeat steps 6 through 9 with upper and lower case Sessions and Visits to complete the search and replace process. 9. Click Save to save the changes to your new language. 10. Select Exit and Unload from the File menu, and then restart WebTrends to activate your changes. 11. In the WebTrends main console, select the profile you want to report on and click Report. 12. In the Create Report window, select the Style tab and select your new language from the Report Language drop-down list. Scenario: Modifying WebTrends Report Content For this scenario, you are the Webmaster for your company s web site. You need to provide your executive team with a weekly report. The Executive Report provided with WebTrends is nearly perfect, but you would also like to include the Advertising Table to emphasize the success of your online advertising efforts. In this example, you have already added your Ad Views and Clicks advertisement definitions. See Scenario: Tracking Internet Advertising on page 89 for details. In the Content tab of the Create Report window, you can select which tables and graphs to include in the report that you are generating. You can also modify the number of items represented in each table or graph, as well as the graph style (such as pie chart or bar) of each graph. 1. In the WebTrends main console, highlight your Web log analysis profile and click Report. The Create Report dialog appears. 2. Select the Content tab. 66

67 Chapter 5. Modifying Reports 3. Select and customize the following report items as desired: Available Items Lists all possible report tables, graphs and the glossary which you can choose to include in your WebTrends reports. Select the report item(s) to include. The Elements field displays the existing number of elements to be included in the corresponding table/graph. The check box to the left of a table or graph icon lets you include it include or exclude it from the report. With a check means it is included. Select the name of the table or graph to modify the graph type or the number of elements. Note: If you select a table or graph for which there is no data in your log file, the table or graph will not appear in your report. Right-click on a list item for the option to Select All items, Unselect All items, or Reverse the selection of items. Graph Type Click on the down arrow to choose from among the available graph types. The options are: stack bar, standard bar, Z-bar, pie chart, area graph, line graph, side bar, and side stack bar. Click on 3D or 2D to display the graph in three dimensional or two dimensional form. 67

68 WebTrends Log Analyzer Elements Use the up and down arrows to change the number of elements represented in the selected graph or the number of items in the selected table. Sub-Items For tables that include a secondary set of information, such as Top Search Keywords with Engine Detail, you can modify the number of these sub-items to include in this field. Note: Including more than 10 items in a graph may clutter the graph making it difficult to read. 4. To include the Advertising Table to the Executive Summary report, select Executive Summary (MS Word) from the Memorized Report Name drop-down list. 5. Scroll down the Available Items list until you see the Advertising Table item and click in the box to the left of the title so that a check appears, indicated that it is included in the report. 6. To increase the number of advertisements that are included in the table to 20, be sure that the item title is highlighted, and increase the number in the Elements field to 20 using the up arrow. 7. Click Memorize to save your report settings. 8. Click Start to generate your report. 68

69 Chapter 6. Scheduling Reports In This Chapter: Scenario: Automating Web Log Analysis Reports for Speed Scenario: Automating Web Log Analysis Reports Conserving System Resources Using the Schedule Log Clearing the Schedule Log Running a Scheduled Report On Demand You can schedule reports to be generated automatically with the WebTrends Scheduler. Scheduling reports can greatly reduce the time that you spend running reports. Since reports can be scheduled to run during off-hours, your system won t be tied up when you need to use it. For example, if you have a weekly Monday meeting at 8:00 a.m. that requires a report on the previous week s web site activity, you can schedule a memorized report to be generated every Monday morning at 2:00 a.m. so that the information is ready and waiting for you. Note: For the scheduler to run, the main WebTrends window must be active or minimized or it must be running as a service. If WebTrends is not running or if you are using the program when the scheduled time arrives, the scheduled event is skipped. A one-time event will not take place at all, and the clock for a repeated event is reset for the next scheduled occurrence. 69

70 WebTrends Log Analyzer Tips: You can have reports run consecutively by scheduling them to run at the same time, or a minute apart if you want to define an order. Use the Close command from the WebTrends File Menu to close the WebTrends main console but keep the program active so that scheduled events will run. The Exit & Unload command in the File Menu closes the WebTrends main console and unloads the program from memory so that scheduled reports will not run. Scenario: Automating Web Log Analysis Reports for Speed For this scenario, you are running Microsoft IIS and rotate your log files daily. You have a drive mapped to your web server, and you need to run reports on a daily and monthly basis. Note: Follow these steps if the system on which you are running WebTrends has plenty of disk space, and your priority is to speed report generation as much as possible. Step 1: Create one log analysis profile using a file name macro to identify the previous day s log file and turn on the FastTrends cache. Step 2: Memorize two report settings specifying date ranges for the previous day and the previous month. Step 3: Create two scheduled events - both based on the same log analysis profile one for each of the two memorized report settings. Adding a Log Analysis Profile for Scheduled Reports Your first step is to identify the location and method of processing your web server log file. For more detailed explanations of each of the options, see Adding a Web Log Analysis Profile on page Click New in the WebTrends main console to add a new log analysis profile. The Add Log Profile-- Title, URL dialog appears. 2. Enter a description in the Description field to indicate that this profile is the one that identifies the previous day s log file. 70

71 Chapter 6. Scheduling Reports 3. In the Log File URL Path field, enter the location of the server log file. In this case, you have a drive mapped to your web server, so choose file:/// from the list and specify the path to your log file. Click Browse to specify the exact location of the file. Since you want to identify the log file containing the previous day s activity, use the %DATE-1% macro for the file name. Your complete path looks something like this: P:\WINNT\SYSTEM32\LOGFILES\IN%DATE- 1%%DD%%MM%%YY%.LOG For more information about the format, location and definition of web server log files in WebTrends log analysis profiles, see the Understanding Log Files section on page 16. For more information about date file name macros, see File Name Macros on page Click Next. The Add Web Log Profile -- DNS Lookup dialog appears. 5. Select Resolve Mode to have WebTrends resolve all IP addresses which may not have been converted by the server. 6. Click Next. The Add Web Log Profile -- Home Page dialog appears. 7. Identify the location and file name of your site s home page. For example: DEFAULT.HTM and P:\WINNT\SYSTEM32\ 8. Click Next. The Filters dialog appears. 9. Since you want to report on all of your web site s activity, click Next again to accept the default Include Everything filter. The Database and Real-Time dialog appears. 10. Check the FastTrends Cache box to enable the caching of your log file data in a cache on your hard drive. For more information about the real-time analysis and reporting options, see Chapter 7. FastTrends and Real Time Reporting on page Click Finish to save your log analysis profile settings. Note: To speed up reporting, check your Log Cache options in the Web Log Analysis options dialog. Select either Download the log file once and keep it for subsequent reports or Download the log file only when changes are detected in the remote log file. 71

72 WebTrends Log Analyzer Memorizing Settings for Scheduled Reports Once you have created your log analysis profiles, you are ready to memorize the report settings. As long as you accept the default report settings (format, language, style, save as information), you only need to memorize report settings for the monthly reports; the log analysis profile for the daily reports already identifies the proper range (yesterday s log file). 1. From the WebTrends main console, select the daily log analysis profile to select it. 2. Click Report. Select Last Month from the drop-down list in the Report Range field. 3. Select the Save As/Mail To tab to specify the location where your reports should be saved. Use the date file name macros to identify a variable destination file name based on the month (for example, \%mm%%yy%.htm). For more information about date file name macros, see the File Name Macros section on page Click Memorize to save your settings. The Memorize Report dialog appears. 5. Enter a descriptive name for these report settings (for example, Monthly Report ). 72

73 Chapter 6. Scheduling Reports Scheduling Web Log Analysis Reports Once you have your profiles and memorized report settings prepared, you are ready to define your scheduled reports. Adding a Scheduled Report Once you have created profiles and memorized report settings, you can set up the scheduled reports. To create scheduled events, complete the following steps: 1. Click Scheduler. The main Scheduler window appears. 2. Click Add in the main scheduler window to add a new scheduled event. The Schedule Report window appears. 3. Select Complete Summary from the Memorized Type list. Note: You can modify existing memorized report settings or create new ones by clicking on the New button next to the Memorized Type field. 73

74 WebTrends Log Analyzer 4. Select your daily log analysis profile from the Profile Description list. 5. To have the report run every morning at 2 a.m., enter 02:00:00 (hh:mm:ss) in the Start Time field. 6. In the Repeat Every fields, type 1 and then select Day(s) in the next field. 7. In the Save Report To: field you can override the Save As/Mail To values as saved in the Memorized Report Settings. See Creating a Log Analysis Report on page 33. See Options on page 124 for more information about enabling and configuring the WebTrends feature. Tip: You can use macros in the Save Report To field. For more information, see File Name Macros on page Click Save to save your scheduled event. You are returned to the main Scheduler window, and your scheduled event appears in the list. 9. For the monthly report, repeat the previous steps with the following differences: a. Select your Monthly Report settings in the Memorized Type dropdown list. b. To have the report run on the first of each month at 4 a.m., enter the following in the Schedule Start Time & Date and Repeat Every fields: 04:00:00 (hh:mm:ss) in the Start Time field, the 1 st of the next month: 10/01/97 (mm/dd/yy), and in the Repeat Every fields, type 1 and select Month(s) in the second field. 74

75 Chapter 6. Scheduling Reports Note: Check the Disable All Scheduled Events box in the main Scheduler window to temporarily disable all of your scheduled reports. 10. Click OK to return to the WebTrends main console. Scenario: Automating Web Log Analysis Reports Conserving System Resources For this scenario, you are running Microsoft IIS and rotate your log files daily. You have a drive mapped to your web server, and you need to run reports on a daily and monthly basis. Note: Follow these steps if your system has limited free disk space and the speed at which the reports are generated is not an issue. Step 1: Create two separate log analysis profiles with FastTrends cache turned off. One of the profiles should specify the previous day s log, the other should specify the daily logs. Step 2: Memorize report settings specifying the last month s activity for the date range. Step 3: Create two scheduled events, one based on the daily log analysis profile, and one based on the all log analysis profile with the monthly memorized report settings. Adding a Log Analysis Profile for Scheduled Reports Your first step is to identify the location and method of processing your web server log file. For more detailed explanations of each of the options, see Adding a Web Log Analysis Profile on page Click New in the WebTrends main console to add a new log analysis profile. The Add Log Profile-- Title, URL dialog appears. 2. Enter a description for the log analysis profile that identifies it as one specifying all of your log files in the LOGFILES directory. 75

76 WebTrends Log Analyzer 3. In the Log File URL Path field, enter the location of the server log file. In this case, use the * wildcard to include all of the log files in the directory: P:\WINNT\SYSTEM32\LOGFILES\*.LOG For more information about the format, location and definition of Web server log files in WebTrends log analysis profiles, see Understanding Log Files on page 16. For more information about date file name macros, see the File Name Macros section on page Click Next. The Add Web Log Profile -- DNS Lookup dialog appears. 5. Select Resolve Mode to have WebTrends resolve all IP addresses which may not have been converted by the server. 6. Click Next >. The Add Web Log Profile -- Home Page dialog appears. 7. Identify the location and file name of your site s home page. For example: P:\WINNT\SYSTEM32\ and DEFAULT.HTM 8. Click Next. The Filters dialog appears. Since you want to report on all of your web site s activity, click Next> again accept the default Include Everything filter. The Database and Real-Time dialog appears. 9. Make sure the FastTrends Cache box is not checked. For more information about the real-time analysis and reporting options, see Chapter 7. FastTrends and Real Time Reporting on page Click Finish to save your log analysis profile settings. Note: To speed up reporting, check your Log Cache options in the Web Log Analysis options dialog. Select either Download the log file once and keep it for subsequent reports or Download the log file only when changes are detected in the remote log file. Memorizing Settings for Scheduled Reports Now that you have added your log analysis profiles, you are ready to memorize the report settings that you want the scheduler to use. 76

77 Chapter 6. Scheduling Reports As long as you accept the default report settings (format, language, style, save as information), you only need to memorize report settings for the monthly reports; the log analysis profile for the daily reports already identifies the proper range (yesterday s log file). 1. From the WebTrends main console, highlight the daily log analysis profile to select it. 2. Click Report. 3. In the Create Report window, select Last Month from the drop-down list in the Report Range field. 4. Select the Save As/Mail To tab to specify the location in which to save your reports. Use the date file name macros to identify a variable destination file name based on the month (for example, \%mm%%yy%.htm). For more information about date file name macros, see the File Name Macros section on page Click Memorize to save your settings. The Memorize Report dialog appears. 6. Enter a descriptive name for these report settings. Scheduling Web Log Analysis Reports Now that you have your profiles and memorized report settings prepared, you are ready to define your scheduled reports. Adding a Scheduled Report Now that you have your log analysis profiles and memorized report settings, you are ready to set up the scheduled reports. To create scheduled events, complete the following steps: 1. Click Scheduler. 2. Click Add in the main scheduler window to add a new scheduled event. The Schedule Report window appears. 3. Select the default Complete Summary from the Memorized Type list. Note: You can modify existing memorized report settings or create new ones by clicking on the New button next to the Memorized Type field. 77

78 WebTrends Log Analyzer 4. Select your daily log analysis profile from the Profile Description dropdown list. 5. To have the report run every morning at 2 a.m., enter 02:00:00 (hh:mm:ss) in the Start Time field. 6. In the Repeat Every fields, type 1 and then click and select Day(s) in the second field. 7. In the Save Report To: field you can override the Save As/Mail To values as saved in the Memorized Report Settings. See Creating a Log Analysis Report on page 33. See Options on page 124 for more information about enabling and configuring the WebTrends feature. Tip: You can use the date file name macros in the Save Report To: field. For more information, see File Name Macros on page Click Save to save your scheduled event. You are returned to the main Scheduler window, and your scheduled event appears in the scheduled report list. 9. Click OK to return to the WebTrends main console. Changing a Scheduled Report To edit an existing scheduled report:. 1. Select the report description in the main Scheduler window. 2. Click Edit to display the Schedule Report window. 3. Make changes to the existing settings. The options are described in detail in the previous section, Adding a Scheduled Report. 4. When you have configured all of the settings, click Save to save your scheduled event and return to the main Scheduler window. Deleting a Scheduled Report To delete an existing scheduled report, 1. Highlight the report description in the main Scheduler window. 2. Click Delete. You are prompted to confirm that you want to delete the schedule. 78

79 Chapter 6. Scheduling Reports 3. Click OK to delete the selected scheduled report or Cancel to return to the main Scheduler window without deleting the selected scheduled report. Using the Schedule Log WebTrends maintains a log of the scheduled report activity. You can view this activity or print or save it for future reference. To access the schedule log, click the View Schedule Log button in the main Scheduler window. The first entry identifies the date and time that the schedule log file was created, and each scheduled event is listed by date and time. The type of report is indicated as well as if an error occurred when running the scheduled report. Use the down and up arrows to scroll through additional pages of the schedule log. Searching for a Text String To search the schedule log for a text string: 1. Click in the Find Next Text entry box to activate it, and then type the text string you want to search for. 2. To begin searching, click Find Next. WebTrends finds the first instance of the text string and highlights it. 79

80 WebTrends Log Analyzer 3. To search for the next instance of the text string, click Find Next again. When you have completely searched the report for the text string, a dialog box appears asking if you want to begin searching from the beginning of the report. 4. Click Yes to continue or click No to quit. Changing Font 1. Click the down arrow in the upper left corner of the Schedule log viewer to display a list of available installed Windows fonts. 2. Click on the font name to select it and change the schedule log text. Changing Point Size 1. Click the down arrow next to the font change window to display a list of available point sizes. 2. Click on the desired point size to select it and change the schedule log text. Printing the Schedule Log You can save or print the WebTrends schedule log for future reference. To print the schedule log: 1. Click Print. A standard Windows print dialog box appears. 2. Make you print selection. You can print the entire log or a range of pages. Saving the Schedule Log 1. Click Save. 2. Enter a file name and choose a location for the schedule log. By default, the schedule log is saved in the reports directory as an ASCII report. 3. Click OK to save the schedule log in the specified location. 80

81 Chapter 6. Scheduling Reports Clearing the Schedule Log You have the option to delete all of the entries in the schedule log. When the schedule log is cleared, the date and time created change to the date and time that it was cleared. To clear the schedule log: 1. Click the Scheduler button in the main Scheduler window 2. Click the Clear Schedule Log button. 3. Click OK to confirm that you want to clear the schedule log. Running a Scheduled Report On Demand You can immediately generate a report that is scheduled to run one time or repeatedly in the future. For example, if you have scheduled a report to be generated every Monday morning and want to preview the report on Friday afternoon, use the Start Now button to create the report with the information to date. To run a scheduled report on demand: 1. Select the report that you want to run in the main Scheduler window. 2. Click Start Now to immediately generate the selected scheduled report. Note: While WebTrends is collecting log file data for the report, you can click Stop Here to create the report with the data collected so far, or click Cancel to cancel the report generation. If your report settings are not memorized, however, you will lose all the settings. 81

82

83 Chapter 7. FastTrends and Real Time Reporting In This Chapter: Scenario: Creating Several Reports from One Log File Scenario: Generating Reports in Real Time Clearing Your FastTrends Cache If you are working with large log files, WebTrends can perform real-time analysis or reporting so that you can access reports almost instantly. The factors involved in WebTrends real-time reporting are: FastTrends Data Caching This patent-pending technology makes it possible to store the results of log file analyses in a cache to significantly speed future reports that are based on the same log file. The analysis results are imported into the database transparently when you analyze your log files for the first time. Real-Time Analysis WebTrends can analyze your log files and maintain the results in real time. Real-time analysis is performed in the background without interrupting the user or the Web server, allowing you to request upto-the-minute reports and get the results within seconds. WebTrends can analyze sites with over 40 million hits a day and daily log files greater than 4 Gigabytes. Real-Time Reporting With real-time reporting, you can configure WebTrends to automatically create reports every 5-10 minutes so that users can access those reports on-line with a browser. You get up-to-theminute, live reports in real time without the need to create those reports manually. 83

84 WebTrends Log Analyzer Scenario: Creating Several Reports from One Log File For this scenario, you are an ISP who has several virtual servers on your web server. All your virtual servers log information into the same log file, and you want separate reports for each of these. You have two domains, abc.com and xyz.com, that both log to the same log file. Step 1: Add a profile for each domain. Step 2: Edit the Include Everything filter. Adding a Profile for Multi-homed Domain To add a profile for a multi-homed domain, complete the following steps: 1. From the WebTrends main console, click New. The Add Web Log Profile Title, URL dialog appears. 2. Enter a name for the first domain. 3. Continue creating the profile for the first domain (for example, abc.com) When you get to the Filters dialog, make sure the include Include Everything filter is selected and click the Edit button. Note: Refer to Adding a Web Log Analysis Profile on page 28 for detailed steps on adding a profile. 4. Select the Domains tab. Enter the domain for this profile (for example, abc.com). 5. Complete the setup for your new profile. 6. Repeat steps 1-7 for the second domain, substituting the second domain name and setup information throughout. When you run the reports for each profile, the reports are generated with the data for each domain even though the data for the two profiles is derived from the same log file. Scenario: Generating Reports in Real Time For this scenario, your Web server log file is rotated daily and you are using WebTrends to run daily and weekly reports. Although your web site receives more than two million hits each day, you can generate detailed and accurate reports virtually instantaneously using the WebTrends real-time options! 84

85 Chapter 7. FastTrends and Real-Time Reporting Using WebTrends real-time analysis and reporting is a two step process: Step 1: Defining the real-time options. Step 2: Setting up a real-time log analysis profile. Defining Real-Time Reporting Options Your first step is to configure the global settings for reports generated in real time. 1. Click Options. 2. Click the Web Log Analysis button on the left-hand side of the Options window, and select the Real-Time tab. 3. In the Report Range field, select the time/date range of the log file to be included in all real-time reports. 4. In the Memorized Report Name field, select the report settings to apply to all reports that are generated in real time. (See Creating a Log Analysis Report on page 33 for more details.) 5. In the CPU Usage field, click and drag the CPU Usage button to set the amount of system resources to be dedicated to the generation of reports in real time. Note: The default setting is max (i.e., all CPU resources). 85

86 WebTrends Log Analyzer 6. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Defining a Real-Time Analysis Profile You can add FastTrends, real-time analysis or reporting options to an existing log analysis profile. 1. Highlight the profile you want to modify in the profile list in the WebTrends main console, and click Edit. The Edit Log Profile dialog appears. Select the Database and Real-Time tab. 3. Check the FastTrends Cache option to have WebTrends store the results of log file analyses in a cache. This significantly speeds up future reports. Note: This option must be selected to enable the Real-Time Analysis and Real-Time Reporting options. 4. Check the Real-Time Reporting box to have WebTrends continuously monitor the log file for any additions, and analyze and store the results in a FastTrends cache. This process occurs in the background and does not interfere with the use of your system. Note: This option must be selected to enable the Real-Time Reporting option. 86

87 Chapter 7. FastTrends and Real-Time Reporting 5. Check the Real-Time Reporting box to automatically generate a report on a fixed interval so that the results are continuously available. Specify the interval at which you want the reports to be run. For example, if you want a report to be generated every 12 hours, type 12 in the first field, select Hours in the second field. Note: See the previous section Real-Time Reporting Options on page 85 for more information about defining the report range and format to use for all real-time reports. 6. In the Save As field, enter a destination path and file name in which to save the real-time reports generated for this profile. Tips: To enable real-time reporting for an existing Web log profile, highlight the profile in the main console and click Edit. In the Edit Profile window, select the Database and Real-Time tab and make your selections. If you are not running WebTrends as a service and want to exit the program but want your real-time analyses or reports to continue to run, use the Close command from the File Menu. This closes the WebTrends main console but keeps the program active, whereas the Exit & Unload command (also in the File Menu) closes and unloads the program from memory so that real-time events stop running. Clearing Your FastTrends Cache In order to clear your FastTrends cache, you must first delete the existing cache and then rebuild a new one. To delete your existing cache: 1. In the WebTrends main console, highlight the real-time log analysis profile for which you want to clear the cache 2. Click Edit. 3. Select the Database and Real-Time tab. 4. Deselect the FastTrends Cache option. 5. Click Yes when asked to confirm the deletion of the cache; the cache is deleted. 6. Reselect the FastTrends Cache option, and click OK to save the profile. 87

88 WebTrends Log Analyzer 7. Run a Complete Analysis report based on the log analysis profile to rebuild the FastTrends cache. 88

89 Chapter 8. Ad Views and Clicks In This Chapter: Scenario: Tracking Internet Advertising The Web has become an extraordinary advertising resource. With the potential to reach millions of people on a daily basis, an ad on a web site can be extremely effective, but until now, difficult to track. With WebTrends Ad Views and Clicks feature, you can easily determine the number of visitors to your web site who view or click on a particular ad or ads. If you are selling advertising space on your web site, the WebTrends Ad Views and Clicks feature makes it easy to collect exact traffic statistics to help determine pricing schedules. Additionally, WebTrends includes advertising filters with which you can profile a specific advertisement s traffic patterns (such as busiest time of the day or day of the week.) as well as demographic information (such as top viewing or clicking organizations or country of origin.). With this feature you can easily produce advertising reports for each of your clients. Tips: For the most effective reporting results, use the Advertising Summary memorized report settings which includes all of the tables and graphs relating to advertisement tracking. You can track exit URLs using Ad Views and clicks by creating an Ad View for each advertisement that you want to track. Note: To track the effectiveness of web site advertisements that you are placing on other sites, see Referrer on page 53. Scenario: Tracking Internet Advertising Your site is booming and advertising is selling like mad. How do you keep your billing from becoming a nightmare? Automate WebTrends reports that provide each of your clients ad s activity, including views, clicks, click through rate and more. 89

90 WebTrends Log Analyzer The following instructions walk you through the process of: Step 1: Defining an advertisement to track Step 2: Adding a log analysis profile with a filter to track that ad Step 3: Customizing and memorizing global report settings to apply to all of your clients profiles. Defining an Advertisement to Track Your first step is to define the advertisements that you want to track. Following are two possible advertisement configurations. 1. To access the Ad Views and Clicks utility, click Ad Clicks. (You may have to enlarge the WebTrends main console to see this button by dragging the corner of the main console). 2. Click Add to define a new advertisement to track. 3. In the Description field, enter a descriptive name of the web site ad. This is the text that identifies the ad in WebTrends reports. For our example, enter: IBM Laptop Advertisement. 90

91 Chapter 8. Ad Views and Clicks 4. In the Ad View File Name field, enter the file name or text string identifying the advertisement view you want to track. You must enter the exact text in the same case (such as upper or lower) from the Web Server log file. You can specify multiple components separated by spaces (each component acting as a logical Boolean "OR" to the other components). Refer to the following examples to determine which you should enter. Example 1: Tracking Statically Linked Ads For this example, we'll track the IBM advertisement which is statically linked, meaning that it's not retrieved through CGI scripts but rather called straight through an <IMG SRC> HTML tag. When a browser hits your site and sees the link to the image, it asks the server for that image and generates a log entry on the server that looks something like this:... "GET /images/ibm_ad.gif" Since the filename "ibm_ad.gif" is unique to just IBM's advertisement, then the file name itself is sufficient to put in the "Ad View File Name" field to accurately track views of this ad. Example 2: Tracking Ads Sent Through Scripts In this example, let s say you have an automated CGI script that delivers ads to a browser. The advertisement image, (ibm_ad.gif), is sent to the client through a CGI script with an advertisement ID number rather then a filename. The only way to retrieve this particular ad is to make an image link off your view page to a CGI script, which has a URL looking something like this: 91

92 WebTrends Log Analyzer When a web browser sees this URL, it asks the server for that image and generates a log entry that looks like:... "GET /cgi-bin/showad.cgi?ad=123456" Since the CGI script returns the image, the file name is irrelevant. For our ad view we want to use text specific to this advertisement only, in this case, the CGI script's ad ID string. For this example, we'll put "showad.cgi ad=123456" in the Ad View File Name field, since the only time this combination of text shows up in the log file is when retrieving the IBM advertisement image. 5. In the Ad Click ID String field, enter the text identifying the advertisement click you want to track. This must be the exact text (case insensitive) from the Web server log file. You can specify multiple components separated by spaces which together define a click. WebTrends scans only the log file Action field (usually Get or Post statements) for the text that you specify, so the click must create an entry in your log file. For example, if a visitor clicks on an ad which takes him or her out of your site directly via a URL, this is not logged in your log file. In order to be able to track ad clicks, you must implement some type of server-side scripting (for example, CGI, Perl, or ASP) to perform a redirect to the destination URL. A very common Perl script is redir.pl. To summarize, if you have a.gif file on your site that links to IBM s site through redir.pl, the information in the Ad Views and Clicks dialog would break down like this: In the Description field, you would enter IBM Laptop Advertisement In the Ad View File Name field, you would enter ibm_ad.gif And in the Ad Click ID String field, you would enter url= because when a visitor to your site clicks on the ad, the following information is recorded in your log file: GET /cgi-bin/redir.pl?url= 6. When you have finished, click OK to save the new advertisement definition and return to the Ad Views and Clicks Configuration window. 92

93 Chapter 8. Ad Views and Clicks 7. Repeat steps 2-6 to add Ad definitions for each of your clients, and click Close to exit the Ad Views and Clicks Configuration dialog when you have finished. Note: To edit an existing advertisement definition, highlight it in the main Ad Views and Clicks Configuration window and click Edit. Note: To delete an existing advertisement definition, highlight it in the Ad Views and Clicks Configuration window and click Delete. Adding a Log Analysis Profile for an Ad Once you have completed your advertisement definitions, you are ready to add log analysis profiles to identify each of your client s advertisement activity. If you already have a profile for the same log file, you can quickly create new profiles for each ad using Copy Profile button. Note: For more detailed explanation of each of the options, see the Adding a Web Log Analysis Profile section on page To add a new log analysis profile, click New in the WebTrends main console. The Add Log Profile-- Title, URL dialog appears. 2. In the Description field, enter a description to identify this profile as one that tracks the advertisement activity for your client (for example, IBM Advertisements). This description appears in the analysis profile list in the WebTrends main console, as well as in the title of reports and views that are based on this profile. 3. In the Log File URL Path field, enter the location of your Web server log. In this case, you have a drive mapped to your Web server, so choose file:/// from the drop-down list and the enter the path to your log file. You can click Browse to search for the exact location of the file. Note: For more information about the format, location and definition of Web server log files in WebTrends log analysis profiles, see Understanding Log Files on page Click Next > to skip the DNS Lookup dialog. This information is not necessary for this profile. 93

94 WebTrends Log Analyzer 5. Click Next > to skip the Home Page dialogs. This information is not necessary for this profile. The Filters dialog appears. 6. First highlight the default Include Everything filter and click Delete to remove it. Click OK to confirm that you want to delete it. 7. Click Add to add a new filter. The Type dialog appears. 8. Select the Include option, and click Next. The Name dialog appears. 9. Enter a name for the filter, and click Next. The Elements dialog appears. 10. Select the Include Activity Based Upon option, and select the Advertising box. Click Next to display the Advertising dialog. 94

95 Chapter 8. Ad Views and Clicks 11. Select IBM s ad from a complete list of the ads that you have defined. Click Next to display the Summary dialog where you can review your filter criteria. 12. Click Finish. 13. Click Close in the Add Web Log Profile Database and Real-Time dialog to save your new log analysis profile. For details about Web Log Analysis filter, see Chapter 4. Filtering Log Analyses on page Repeat steps 1-14 to add a separate log analysis profile for each or your clients. Customizing and Memorizing Settings for Ad Tracking Reports Now that you have your clients data broken down in log analysis profiles, you can establish and memorize the global report settings to use for your automated activity reports. These memorized report settings can be applied to any log analysis profile. See the Creating a Log Analysis Report section on page 33 for a more detailed description of the following process. To define and memorize your report settings: 1. From the WebTrends main console, select the IBM Advertisements profile. 2. Click Report. 3. In the Memorized Report Name field of the Create Report window, select the Advertising Summary memorized settings. 4. Select the date range for your Ad tracking reports; in this case, select Last month from the Report Range drop-down list. 5. Select the Format tab. Select from the list of possible report formats. In this case, select Microsoft Word Document. Note: You must have MS Office installed to use this format, rather than the stand alone version. 7. Select the Save As/Mail To tab to identify the location and file name in which to save your report. 8. Select the Style tab. Here you have the option to select either one of the pre-configured or one of your report languages or styles. 95

96 WebTrends Log Analyzer See Chapter 5. Modifying Reports on page 61 for more information about the WebTrends style and language editors. 9. Click Memorize to save your report settings. The Memorize Report dialog opens. 10. In the Description field, enter a name by which to identify these report settings (for example, Ad Tracking Reports ). 11. Click the Save button. 96

97 Chapter 9. Intranet Management In This Chapter: About Intranet Management Scenario: Configuring WebTrends for your Intranet About Intranet Management The use of Intranets has increased rapidly and continues to grow at a fast pace. Intranets provide a relatively simple and efficient means of sharing information and providing communication among users over a TCP/IP network without having to install various applications or clients on each workstation. Users can access and input information from various databases with nothing more than a Web Browser installed on their machine. The future of Information Management truly lies in Intranets, and WebTrends is there to help you analyze, report on, and manage this resource. WebTrends includes an Extended Company Database which translates domain names into organization names and geographic information and includes this information in WebTrends reports. Within large organizations Intranets, certain sub-nets or ranges of IP addresses usually represent a department, area or location of an organization, but they are not represented in the Extended Company Database. This is where the Intranet Management feature steps in. The WebTrends Intranet Management feature lets you provide a more detailed break-down of your organization's domain name. You can define multiple Intranet Domains which specify an area of your organization by country, state, city, department, or even down to individual workstations. Once you have added this information with the Intranet Management utility, it is automatically included in your WebTrends report data. As with any web site, having accurate and up-to-date statistics and access to information is essential. WebTrends helps you manage your site by reporting the what, where and when of user and department activities: 97

98 WebTrends Log Analyzer What pages are users accessing and how much time are they spending on them? What departments are accessing your Intranet and when? Where are your users and departments located? What operating systems are used most widely within the organization? What browsers are used? What are the most active and inactive days and times? What forms are users submitting? What scripts are run and when? Scenario: Configuring WebTrends for your Intranet In this scenario, you are the Webmaster for an international corporation, XYZ Corp. The good news is that your newly implemented company Intranet has become very popular; the bad news is that you now need to provide statistics about which departments are using the Intranet and how. No problem! Once you have created Intranet domains for each of your departments (you can also define individual machines or entire offices) with WebTrends Intranet Management, this information is automatically included in your WebTrends reports. Specifically, this information appears in the Most Active Organizations graph and table, as well as the geographic information in the graphs and tables relating to States, Cities and Countries. Adding an Intranet Domain Setting up domains and IP addresses within the WebTrends Intranet Management is a straightforward process. Once the information is added, it is automatically included in WebTrends reports. Follow these steps to create a definition for each department that you want to track: 1. To use WebTrends Intranet Management, click Intranet. (You may have to enlarge the WebTrends main console to see this button). The Intranet Management dialog appears. 98

99 Chapter 9. Intranet Management 2. Click Add to define a new Intranet domain. The Edit Intranet Domain Name dialog appears. 3. In the Intranet Domain field, enter the domain name of the department or division of your organization to be listed in your WebTrends report (for example, marketing.xyz.com). 4. In the Description field, enter the descriptive name of the organization or department as you want it to appear in WebTrends reports (for example, Marketing Dept.). 5. In the City field, enter the location of the department or division. This geographic information is used to produce the geographic tables and graphs in WebTrends reports. 6. Select a State from the drop-down list. 7. Select a Country from the drop-down list. 8. In the IP Address/Pattern field, enter the IP address, domain name or range of IP addresses or domain names, as they appear in your Web server log file (for example, marketing.xyz.com). Note: WebTrends performs pattern matching for Intranet Management entries after it has performed reverse DNS lookup, so you need to use an IP address in this field only if neither your Web server nor WebTrends is converting IP addresses to domain names. 99

100 WebTrends Log Analyzer 9. When you have finished, click OK to save the new Intranet domain information and return to the Intranet Configuration window. The new Intranet domain and corresponding description appear in the Intranet Configuration window. 10. Repeat the previous steps to define an Intranet domain for each department. Note: If you want to edit an existing Intranet domain, select it in the Intranet domain list in the Intranet Configuration window and click Edit. Note: To delete an existing Intranet domain, highlight it in the Intranet Configuration window and click Delete. Tip: Intranet Management data is stored in the wtintra.txt file in your WebTrends directory. If you have a comma-delimited list of domains with corresponding descriptions that you would like to add, simply edit this file, add your data, and it is incorporated in your WebTrends reports. Intranet Reporting Once you have defined each of your organization s departments, simply run a report on your Web or proxy server log file, and the departmental names and geographic information will automatically be included. 1. From the WebTrends main console, click once on your profile to select it. 2. Click Report. 3. In the Create Report window, select previously memorized report settings or define your own, and click Start View your departmental information in the Most Active Organizations graph and table. 100

101 Chapter 10. Notes for Netscape Web Server Users In This Chapter: Samples of Netscape Web Server Log Files Setting up WebTrends Netscape Plug-In This section provides sample Netscape web server log files, and describes how to install and use the WebTrends Netscape Plugin. Samples of Netscape Web Server Log Files Netscape NSAPI referrer/user agent log file: analogue.vip.best.com - - [03/Jun/1996:00:08: ] "GET /intro/intro.htm HTTP/1.0" /intro/intro.htm analogue.vip.best.com - Mozilla/3.0b3Gold (Win95; I) - analogue.vip.best.com - - [03/Jun/1996:00:08: ] "GET /gifs/articlbk.gif HTTP/1.0" /gifs/artick.gif analogue.vip.best.com - Mozilla/3.0b3Gold (Win95; I) analogue.vip.best.com - - [03/Jun/1996:00:08: ] "GET /intro/getstart.gif HTTP/1.0" /intro/getst.gif analogue.vip.best.com - Mozilla/3.0b3Gold (Win95; I) analogue.vip.best.com - - [03/Jun/1996:00:08: ] "GET /gifs/home.gif HTTP/1.0" /gifs/home.gif analogue.vip.best.com - Mozilla/3.0b3Gold (Win95; I) analogue.vip.best.com - - [03/Jun/1996:00:08: ] "GET /intro/ .gif HTTP/1.0" /intro/ .gif analogue.vip.best.com - Mozilla/3.0b3Gold (Win95; I) 101

102 WebTrends Log Analyzer The following table defines the values for each of the fields of the First Lines: (i.e., analogue.vip.best.com - - [03/Jun/1996:00:08: ] "GET /intro/intro.htm HTTP/1.0" 304 -) Field # Field Name Description Field 1 User Address The numeric IP address or domain name of the user accessing the site. Field 2 Rfc931 This field is used to log the domain for multihomed web servers. Field 3 User Authentication User name, if required. Field 4 Date/Time The date and time the user accessed the site. Field 5 GMT offset The number of hours from GMT (if this is it is logged in GMT time). Field 6 Action The particular operation of the hit (this must be in quotes). Field 7 Return Code The return code for the action tells whether it was successful and why. Field 8 Size The size of the file sent. The following table defines the values for each of the fields of the Second Lines: (i.e. /intro/intro.htm analogue.vip.best.com - Mozilla/3.0b3Gold (Win95; I)-) Field # Field Name Description Field 9 Referrer: The URL which linked the user to your site. Field 10 Browser/ Platform The Web browser and platform used by the visitor to your site. Setting up WebTrends Netscape Plug-In When you install WebTrends on a system running Netscape or Microsoft IIS Web server, you can choose to install a plug-in. WebTrends then automatically installs the WebTrends Plug-In Configuration Utility. 102

103 Chapter 10. Notes for Netscape Web Server Users Complete the following step to configure the WebTrends Plug-In for Netscape Web servers: 1. Double-click on the WebTrends Plug-In Configuration icon in your WebTrends program group. The Configure WebTrends Plug-In window appears. Note: If WebTrends detects only Netscape Web server, only the Netscape Plug-In tab appears. 2. Make the appropriate changes and selections: Item Enable Extended Logging Enable Cookie Description Select this option to have your Web server log referrer, agent and multi-homed server information. This option is selected by default when you install the Netscape plug-in. Select this option to identify a cookie for your Web server to use. Cookies help you more accurately determine user session statistics. (See the Cookie definition in the Glossary in Appendix C for more information about how cookies work.) 103

104 WebTrends Log Analyzer Cookie Name Options ZIP archived log files ZIP to NSLOG.ZIP ZIP as individual files The name of your unique user session cookie. This should be left as the default for more accurate statistics. Enter optional settings such as the expiration date for the cookie. Note: See your Web server administrator for more information about the benefits and format of these parameters. Check this option to have WebTrends automatically compress your archived log files. This saves disk space and transfer time if you will be retrieving log files from a remote workstation for analysis. Note: This option is only available if your Web server is configured to archive log files. Note: If this option is selected, WebTrends checks for and ZIPs archived log files every hour at 45 minutes past the hour (e.g., 1:45, 2:45, etc.). Select this option to ZIP archived log files to one file. WebTrends will automatically append new log files to the zipped log file unless an identical file name is added in which case it will overwrite the previous log file with the same name. Select this option to ZIP each archived log file into a separate.zip file. Extended Logging and Multi-Homing By default, Netscape Web servers do not log referring URLs, browser/platform, or multi-homed domain name information. It is possible, however, to configure your Web server via the interface to record this information. Please refer to your Netscape documentation for more details. 104

105 Chapter 11. Notes for Microsoft IIS Users In This Chapter: Samples of Microsoft IIS Web Server Log Files Microsoft IIS Plug-in for Extended Logging WebTrends Plug-In Configuration Utility Tips for Microsoft IIS Users This section provides samples of Microsoft IIS log files, and describes how to install and use the WebTrends Microsoft IIS Plug-in. Samples of Microsoft IIS Web Server Log Files Standard: , -, , 7:46:34, W3SVC, MEHWNT1, , 5688, 240, 979, 200, 0, GET, /egyeb/nemkorm/cws/chalk.jpg, -, Extended: , -, , 7:46:34, W3SVC, MEHWNT1, , 5688, 240, 979, 200, 0, GET, /egyeb/nemkorm/cws/chalk.jpg, Mozilla/2.0 (compatible; MSIE 3.0B; Win32), -, The following table defines the values for each of the fields: Field # Field 1 Field 2 Field 3 Field 4 Field 5 Description Client's IP address Client's User name Date (mm/dd/yy) Time Service 105

106 WebTrends Log Analyzer Field # Field 6 Field 7 Field 8 Field 9 Field 10 Field 11 Field 12 Field 13 Field 14 Field 15 Description Computer name Server IP address Processing time Bytes received Bytes sent Status Code Windows NT status Code Operation Target file Script or DLL variables IIS 4.0, W3C : This latest version of Microsoft s Internet Information Server is fully configurable by the user. WebTrends reads the #Fields line to determine what information is logged, and analyzes it accordingly. Note: It is highly recommended that all fields are enabled. The following is a sample #Fields line which specifies the fields to log and a corresponding log file entry line: #Fields: date time c-ip cs-username s-computername s-ip cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes time-taken cs(user-agent) cs(cookie) cs(referer) :27: QUEST GET /IISSamples/Default/MSFT.GIF Mozilla/2.0+(compatible;+MSIE+3.02;+Update+a;+Windows+NT ) EGSOFT_ID= ;+ASPSESSIONIDGGGQQGNB=AKGWACREOZRXAZP Z Note: For more information about Microsoft IIS log files, please refer to your IIS documentation. 106

107 Chapter 11. Notes for Microsoft IIS Users Microsoft IIS Plug-in for Extended Logging Microsoft IIS Web servers do not log referring URL, browser and platform information by default. In order to enable this capability, you must install an IIS plug-in which adds these additional fields to your Web server log file. If you are installing WebTrends on a Windows NT 4.0 server running Microsoft IIS, at the end of the install you will be asked if you want WebTrends to automatically install an IIS plug-in for extended logging. An icon pointing to the plug-in install utility is automatically created in the WebTrends program group. WebTrends Plug-In Configuration Utility When you install WebTrends onto a system running Netscape or Microsoft IIS Web server, you can choose to install plug-in. WebTrends then automatically installs the WebTrends Plug-In Configuration Utility. Complete the following step to configure the WebTrends Plug-In for Microsoft IIS Web servers: 1. Double-click on the WebTrends Plug-In Configuration icon in your WebTrends program group. The Configure WebTrends Plug-In window appears. Note: If WebTrends detects only Microsoft IIS Web server, only the Microsoft Plug-In tab appears. 107

108 WebTrends Log Analyzer 2. Make the appropriate changes and selections: Item Enable Extended Logging Enable Cookie Cookie Name Options Description Select this option to have your Web server log referrer and agent information. This option is selected by default when you install the Microsoft IIS plug-in. Select this option to identify a cookie for your Web server to use. Cookies help you more accurately determine user session statistics. (See the Cookie definition in the Glossary, page 145 for more information about how cookies work.) The name of your unique user session cookie. This should be left as the default for more accurate statistics. Enter optional settings such as the expiration date for the cookie. Note: See your Web server administrator for more information about the benefits and format of these parameters. 108

109 Chapter 11. Notes for Microsoft IIS Users Enable DNS Lookup Timeout (secs) Cache Size Log Virtual Sites The DNS Lookup option is enabled by default when the WebTrends Plug-In for Microsoft IIS is installed. Deselect this option if you do not want IIS to convert the IP addresses of visitors to the web site into their domain names. By changing the value in this field you can alter the length of time (in seconds) after which DNS Lookup will quit if the IP address has not been resolved. You can modify this value to suit your environment. The DNS cache speeds IP address conversion. You can modify this value to suit your environment. Click the Virtual Log Files button to enable logging for a virtual directory on your Web server. 3. When you click the Virtual Log Files button, the Virtual Site Logging window appears. This window displays the directories and corresponding locations as imported from your Microsoft server. Note: You cannot add or remove directories from this utility, only enable/disable and configure activity logging for existing directories. 4. Check the box to the left of the directory to enable logging for that directory. 109

110 WebTrends Log Analyzer 5. Click on the name of the directory to highlight it, and click Edit to configure the activity logging properties. The Virtual Site Property window appears: 6. Make the appropriate changes/selections: Item Virtual Directory Virtual IP Description The name and IP address of the directory that you are editing. Note: These values are read from the Microsoft server configuration and cannot be modified. Log File Location Allow Extended Logging Log File Format Enter the path where the log file will be stored. This log file will contain entries for this virtual directory/domain exclusively. Check this option to enable the logging of referrer and agent information for the virtual directory. Select the format in which to save the logged information for this virtual directory: IIS Format, or NCSA Format. 110

111 Chapter 11. Notes for Microsoft IIS Users Recycle Log Files Recycle into ZIP File ZIP to INETSRV.ZIP ZIP as individual files Choose Never to log the virtual directory activity to the same log file indefinitely. Choose one of the other four options to have WebTrends begin overwriting the log file for this virtual directory at the selected interval: either Daily, Weekly, Monthly, or when the log file reaches the designated Size (20 kilobytes minimum). Check this option to have WebTrends automatically compress your recycled log files. This saves disk space and transfer time if you will be retrieving log files from a remote workstation for analysis. Note: This option is only available if you have chosen to recycle your log files (see Recycle Log Files above). Select this option to ZIP archived log files to one file. WebTrends will automatically append new log files to the zipped log file unless an identical file name is added in which case it will overwrite the previous log file with the same name. Select this option to ZIP each archived log file into a separate.zip file. Tips for Microsoft IIS Users Multi-Homed Filtering MS IIS log files contain all numeric IP addresses for multi-homed sites. In order to include or exclude certain sites, you must specify the numeric IP address of the Web server you want to filter if you do not have Reverse DNS Lookup turned on. For example, (See Scenario: Filtering a Multi-Homed Log File on page 57 for more information about filtering for multi-homed domains.) 111

112 WebTrends Log Analyzer Home Page URL For Microsoft IIS servers, you must identify the Home Page URL as a numeric IP address unless you have Reverse DNS Lookup turned on. For example, If DNS Lookup is turned on, you must use the domain name that the IP address resolves to for Home Page URL and filter definitions. (See Adding a Web Log Analysis Profile on page 28 for more information about the Home Page URL and filter definitions.) Tip: To establish the domain name that an IP address resolves to, run ping -a followed by the IP address of the server, and the server will return the corresponding domain name. 112

113 Chapter 12. Remote Reporting In This Chapter: Scenario: Using Your Browser to Create a WebTrends Report Remote Reporting Configuration Options Scenario: Using Your Browser to Create a WebTrends Report Once you have the IP address, port, user name and password for a WebTrends remote reporting server, you can access the server through your browser to create your own WebTrends reports. See Scenario: Making WebTrends Reporting Available to Remote Users on page 126 for details on setting up WebTrends remote reporting feature. Note: You must be using Microsoft Internet Explorer browser version 3 or Netscape Navigator browser version 2 or later to access a WebTrends remote reporting server. The following steps explain how to access and use a WebTrends remote reporting server: 1. Launch your browser. 2. Access the WebTrends Remote Reporting Center via HTTP with the IP address, a colon, and the Port number of the system which has been defined as the WebTrends remote reporting server (for example., The Login window appears: 113

114 WebTrends Log Analyzer 3. Enter your Windows NT user name and password, and click the Login button. The following window appears: Creating a Report Remotely To create a report remotely: 1. Click New Report. 114

115 Chapter 12. Remote Reporting 2. Choose a profile from the Select a Profile window or click Go Back. 3. Define the settings for the report to be generated, and click Start. (See Creating a Log Analysis Report on page 33 for more information about report options.) View an Existing Report Remotely To view an existing report remotely: 1. Highlight the report name in the Completed Reports list in the main Remote Reporting Center window. 115

116 WebTrends Log Analyzer 2. Click View Report to load the selected report. Delete an Existing Report Remotely: To delete an existing report remotely: 1. Highlight the report name in the Completed Reports list in the main Remote Reporting Center window. 2. Click Delete to delete the selected report. Note: You can view and delete other users reports only if you have Administrator rights for remote reporting. See Remote Reporting Options on page 125 for more details. Remote Reporting Configuration Options Note: You will have access to the Remote Configuration Center only if you have Administrator rights for remote reporting. See Remote Reporting Options on page 125 for more details. From the Remote Configuration Center you can: Create new reports Add, edit or delete profiles Access the configuration options To access and use the Remote Configuration Center: 1. In the main Remote Reporting Center window, click Configuration Center. 116

117 Chapter 12. Remote Reporting 2. In the Remote Configuration Center window is a list of the existing profiles and buttons corresponding to the different actions that you can take. Running a New Report To run a new report: 1. Highlight the profile on which you want to report. 2. Click New Report. 3. Define your report settings, and click Start. (See Creating a Log Analysis Report on page 33 for more information about report options.) Working With Profiles To work with profiles: Click Add Profile to create a new profile, or select a profile and click Edit Profile to modify it, or click Delete Profile to delete it. For more information about the profile parameters, see Adding a Web Log Analysis Profile on page 28. Modifying Configuration Options To change the configuration options: 1. Click Options. The following window appears: 117

118 WebTrends Log Analyzer 2. Make your changes and click Save. Click Go Back to return to the Remote Configuration Center window without saving your changes. Note: The remote reporting configuration options are nearly identical to the WebTrends program configuration options. For definitions of the General Options and Web Log Analyzer Options, refer to the corresponding sections on page

119 Chapter 13. Configuration Options In This Chapter: General Options Scenario: Making WebTrends Reporting Available to Remote Users Web Log Analyzer Options The WebTrends configuration options are broken down by program cartridge and allow you to customize WebTrends for your environment.: General Options apply to the WebTrends program interface and general program functionality. Web Log Analysis Options impact the processing of Web server log files and the output of Web log analysis reports. General Options The WebTrends configuration options are grouped under separate tabs in the Options dialog box. To display the Options dialog box: 1. Click Options. 2. Click the General button on the left-hand side of the Options dialog. 119

120 WebTrends Log Analyzer Select the tab that corresponds to the option that you would like to change, and click OK when you have completed your configuration. Refer to the following sections for details on the General Options tabs. Locale You have the option to identify the source country for your WebTrends reports, for example what is considered domestic. To change the country of origin used by WebTrends: 1. Click Options on the toolbar. 2. Select the Locale tab in the Options dialog box. 3. Click in the Your Country field to choose from a list of the possible countries of origin (what is considered domestic ) in WebTrends reports. 4. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Selecting an HTML Browser By default, WebTrends launches your system default browser, such as Microsoft Explorer or Netscape, to view reports generated as HTML files. 120

121 Chapter 13. Configuration Options To specify a different browser to launch automatically: 1. Click Options on the toolbar. 2. Select the Browser tab in the Options dialog box. 3. Enter the location of the browser that you wish to use. You can click Browse to search for a specific location. 4. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Running WebTrends as an NT Service If you are running WebTrends on a Windows NT system, you can choose to run the program as a service. This assures that scheduled and real-time events will take place even if the system reboots accidentally, and in the case that you have configured a remote reporting service, that the server remains available if you log off. 121

122 WebTrends Log Analyzer To configure WebTrends to run as a service in Windows NT. 1. Click Options on the toolbar. 2. Select the NT Service tab in the Options dialog box. 3. To run WebTrends as a Windows NT service, check the Run WebTrends as an NT Service box. The service logs on as System User and can connect to UNC paths with the specified username and password. 4. In the Username field, enter the Windows NT Username for WebTrends to use if required for access to network drives. 5. In the Password field, enter the Windows NT Password for WebTrends to use if required for access to network drives. Note: If the Username and Password fields are left blank, WebTrends runs as a service using the System account. If you want to specify an alternate username, that account must have Log on as a service rights in the User Manager. Note: When running WebTrends as a service, all access to remote network drives should be through a UNC and not through a mapped drive letter. 6. Select another tab to make changes to other features. 122

123 Chapter 13. Configuration Options 7. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Proxy Server Settings If your organization accesses the Internet through a proxy server, you need to provide WebTrends with proxy server information. To specify a proxy server for WebTrends to use: 1. Click Options on the toolbar. 2. Select the Proxy tab in the Options dialog box. 3. Check the Connect through a Proxy Server box if you are accessing the Internet through a proxy server. 4. In the Type/Address of Proxy server to use field, enter the Host Name of the Proxy server to use. 5. In the Port field, enter the Port Number used by the Proxy server. Note: Consult your network administrator for the address and port as defined in this dialog. 6. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. 123

124 WebTrends Log Analyzer Options Complete the following steps to have WebTrends to automatically reports: 1. Click Options on the toolbar. 2. Select the tab in the Options dialog box. 3. Select one of the following options: SMTP (Simple Mail Transfer Protocol) to use the protocol used by most Internet mail programs (Eudora and Netscape, for example). MAPI (Mail Application Programming Interface) is an industry-wide standard which is usually the default method for accessing large mail systems like Microsoft Mail and cc:mail. 4. If you select SMTP, then complete the following fields, otherwise go to step 5. Server The host name or IP Address of your mail server, e.g., mail.webtrends.com. Note: Either see your Network Administrator or refer to your e- mail program configuration for this information. 124

125 Chapter 13. Configuration Options From The address that will be placed in the From field of the ed WebTrends report (e.g., ). Reply To The address that any replies to the ed WebTrends Report should go to. Usually this is the same as the From field, but in some cases it can be different. 5. If you select MAPI, then complete the following fields: Profile Enter the name of the profile (for example, jamesb ) to use for ed WebTrends reports. Password If applicable, enter the password for the profile selected. 6. In the Subject field, enter the text for the subject line of the ed WebTrends report. 7. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Remote Reporting Options You can configure your Windows NT system to run as a remote reporting Web server. Doing so allows authorized users to log in and create reports remotely using a browser. Users can create, view and delete reports as HTML, Microsoft Word, Microsoft Excel, or text documents. The reports can either be displayed immediately or ed as an attachment to anyone on the Internet. Note: You must be running Windows NT to set your system up as a remote reporting server. 125

126 WebTrends Log Analyzer Scenario: Making WebTrends Reporting Available to Remote Users In this scenario, you are the most popular employee since implementing your company Intranet and investing in WebTrends, but now you re being asked to customize reports for everyone. What s the solution? Let them do it themselves! You have installed your copy of WebTrends on a Windows NT system, so now, with no other Web server software needed, you can enable WebTrends to run as its own remote reporting server, with reporting and configuration functionality available to authorized users through a browser. Tip: When you enable the WebTrends remote reporting feature, you may also want to run WebTrends as a service (see Running WebTrends as an NT Service on page 121 for details) so that, if you do log off of your system, the remote reporting server is still available to users. Complete the following steps to get your WebTrends Remote Reporting Server up and running: Step 1: Define your user accounts in Windows NT Step 2: Enable and configure the WebTrends Remote Reporting option Step 3: Instruct users how to access the server with their browsers. Defining Windows NT Accounts for WebTrends Remote Reporting Server Access Users who will be accessing the WebTrends remote reporting server must have the appropriate rights under Windows NT. Note: Even if the Windows NT system on which you are setting up WebTrends as a remote reporting server is part of a domain, you still must set up your user accounts locally because WebTrends does not recognize domain assigned rights. 1. Within the Windows NT User Manager, set up user names and passwords for each user. 2. Each user must have read/write access to the directory where WebTrends is installed as well as to its subdirectories. 126

127 Chapter 13. Configuration Options 3. Assign each user the Logon Locally right (under Advanced User Rights). Setting up a Remote Reporting Server Complete the following steps to set up the WebTrends remote reporting feature: 1. Click Options. 2. Click the General button on the left side of the Options window. 3. Select the Remote Reporting tab. Note: This option is only available if you are running WebTrends under Windows NT. 4. Check the Enable Remote Reporting Server box to set up your system as a remote reporting server. 5. Identify the IP address of your remote reporting server. The primary IP address of the machine you are using appears as the default address. 6. Enter the Port number (the default is 99 ) for the remote reporting server. 7. Check Bind all IP Addresses box if the machine that you are using has multiple IP addresses assigned to it, and you would like all of them to identify the machine as a remote reporting server. 8. Select a person or group from the Administrator list (as defined in the Windows NT User Manager; see above) to whom you would like to grant Administrator rights. This gives the person or group of people the right to view or delete other people s reports, and exempts them from reporting limitations. (See Limit No. of Reports and Delete Reports below.) 9. Check the Limit No. of Reports box and enter a number in the Reports per User field to specify the number of reports each user is able to generate. Once this limit is reached, the user is prohibited from generating new reports until he or she has deleted some of his or her existing reports. Note: This limit does not apply to Administrators. (See the Administrator feature above.) 127

128 WebTrends Log Analyzer 10. Check the Delete Reports box and enter a number in the days or older field to specify how long users can keep their reports on the remote reporting server. Reports that reach this limit are deleted. Note: This limit does not apply to Administrators. (See the Administrator feature above.) 11. Check the Enable logging of Server activities option to have WebTrends maintain a log file in NCSA format for this remote reporting server. This file is named remote.log and is stored in the WebTrends directory. 12. Deselect Allow Report Creation option to make the remote reporting server available only for viewing or deleting existing reports; users cannot create new reports when this option is turned off. 13. Click OK to save your selections and make your WebTrends remote reporting server available to other users. Note: Once you have enabled the Remote Reporting feature, a Remote Reporting tab is available when you add or edit your log analysis profiles. In this tab you can identify who should have access to the profile by groups or individuals. By default, log analysis profiles are available to anyone. SNMP Agent You can turn your WebTrends machine into a WebTrends SNMP agent through this dialog. As an SNMP agent, you can monitor the status of WebTrends remotely through a management console. You can also perform some administrative functions through the management console. Once the agent is activated, the wtagent.mib (management information base) is installed on your system. The mib file defines the functions that can be performed on the management console. 1. Click Options on the toolbar. 2. Click the General button in the Options window. 3. Select the SNMP Agent tab. 4. Select the Activate SNMP Agent box to turn on this feature. 5. Click OK to close the Options window and activate your changes. 128

129 Chapter 13. Configuration Options Web Log Analyzer Options The WebTrends Log Analyzer configuration options affect only the Web log analysis profiles and reports. To access Web Log Analysis Options: 1. Click Options. 2. Click the Web Log Analysis button on the left-hand side of the Options dialog. File Types You can tell WebTrends what types of files to include in the graphs and tables that relate to downloaded files or document files. For example, the Page Views item represents the sum of all hits to all document file types. If you would like this number to reflect only hits to.html and.htm pages, remove all other document file type extensions from the list. Complete the following steps to add or remove the desired file extensions: 1. Click Options. 2. Click the Web Log Analysis button on the left-hand side of the Options dialog. 3. Select the File Types tab in the Options dialog box. 4. Select one of the following file types that you would like to modify: 129

130 WebTrends Log Analyzer Download File Extensions and Types Add or remove the file types that are included in the WebTrends Top Downloaded Files table and graph. Document File Extensions and Types Add or remove the file types that are included in WebTrends report tables and graphs that pertain to documents (for example, Most and Least Requested Pages, Top Entry and Exit Pages). Document File Types define Page Views by appropriate hits. 5. Click Edit. The Edit Download/Document File Extensions and Types dialog appears. The extension list indicates the file type extension, and the condition displays when the request for the file type is included. 6. Choose one of the following options: Edit Select a file type and click Edit to display the Edit File Type dialog where you can modify when the file type is included. See Add or Edit File Types immediately following this section for details. Add To add an extension, type the file extension in the text entry field and click Add. See Add or Edit File Types immediately following this section for details. Remove Select a file type and click Remove to remove a file type from the list. 7. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Add or Edit File Types You can add a file type to the default list or define when a file type is included through the Add File Type dialog if you are adding a file type, or through the Edit File Type dialog. You can access this dialog from the Download/Document File Extensions and Types dialog. 130

131 Chapter 13. Configuration Options Here you can make the following changes: File Extension Indicates the file extension selected in the Download/Document File Extensions and Types dialog. Always Includes every file request for the selected file type. Only if they are not from a script or dynamic web page Includes only file requests that are not from scripts or dynamic web pages. If the URL includes this file type without a (?), the request is included. Only if they are from a script or dynamic web page Include only file requests from scripts or dynamic web pages. If the URL specifies this file type with a (?), the request is included. Modifying Domain Name Groupings You have the option to add or remove domain name suffixes from the list that WebTrends includes in the domain name groupings (United States Domains, Government Domains, Military Domains, etc.). 131

132 WebTrends Log Analyzer To make changes to the domain name groupings, follow these steps: 1. Click Options. 2. Click the Log Analysis button on the left-hand side of the Options dialog. 3. Select the Domains tab in the Options dialog box. 4. Select the domain grouping that you would like to modify and click Edit. The Edit Domains dialog appears displaying the domain suffixes included in the selected grouping. To remove an existing suffix, highlight the suffix in the list and click Remove. To add a suffix, type the suffix in the text entry field and click Add. 5. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. General Web Log Analyzer Settings Several of WebTrends Web log analyzer settings can be modified to suit your environment, log file size and content: 132

133 Chapter 13. Configuration Options 1. Click Options. 2. Click the Web Log Analysis button. 3. Select the General tab in the Web Log Analysis Options dialog box. 4. In the DNS Cache Size field, enter the number of entries you want stored in the cache. DNS Lookups can slow down log file processing substantially. If you run WebTrends on a system with a large amount of memory, you can speed up log file processing by increasing the size of the DNS cache. The range supported is from 1,000 to 60,000 entries; each entry requires 8 bytes of memory. If your DNS cache is cluttered with unresolved entries, click the Flush DNS Cache button to clear the DNS cache. 5. Enter the interval of time between list re-readings to suit your environment (the size and location of your log file entries) in the Log File List Refresh Rate field. The profile list on the WebTrends main console is refreshed automatically by default every 60 seconds. The maximum is every 60 minutes (1 hour). You can set this value to zero to disable this option. Note: If you have a large log file and want to speed up processing, you can set this value to zero to turn off the refresh option. 133

134 WebTrends Log Analyzer 6. Use the User Session Length field determines how long a visitor can view the site idly before the session is considered terminated. The default setting is 30 minutes. 7. The Retrieve HTML Page Titles box is selected by default. This option tells WebTrends to find and display the page title of your web site pages in related report tables. If this option is not selected, only the URL of the page appears. This process slows report generation somewhat. However, if you are reporting on the same site multiple times, you can speed it up by caching the page titles. Note: To retrieve HTML page title in a log file, you must have specified the Home Page directory for the profile. See Home Page Directory in the Adding a Web Log Analysis Profile section on page Check the Cache x Titles for x Days box to cache your site s HTML page titles and speed subsequent report generations. Specify the number of titles to cache and for how many days. 9. Click an image type to use in the WebTrends reports generated as HTML Documents by selecting one of the following options: Use GIF Images in HTML Reports Use JPEG Images in HTML Reports 10. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Microsoft Word and Excel Report Options Use the MS Word and Excel configure options to define the author and company name to specify in your WebTrends reports. By default, this information is taken from the registry of your system. Note: You can only generate WebTrends reports in Microsoft Word and Excel formats if you have Microsoft Office 95 or 97 installed on your system. Stand-alone versions of Microsoft Word and Excel do not provide the macro language necessary to create these reports. 134

135 Chapter 13. Configuration Options 1. Click Options. 2. Click the Web Log Analysis button. 3. Select the MS-Word and Excel tab in the Options dialog box. 4. In the Author field, enter your name as you want it to appear in WebTrends reports generated in Microsoft Word format. 5. In the Company field, enter your company name as you want it to appear in WebTrends reports generated in Microsoft Word format. 6. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Cookies If your Web server uses cookies to identify repeat visitors, you can tell WebTrends to use this information to more accurately identify user sessions. Tip: See the cookie definition in the Glossary, page 145, for more information about what cookies are and how they work. 135

136 WebTrends Log Analyzer 1. Click Options. 2. Click the Web Log Analysis button. 3. Select the Cookies tab in the Options dialog box. 4. Check Use Cookies to have WebTrends look for the existence of Cookie user session IDs in log files. When they are found, WebTrends uses these session IDs rather than the individual IP Addresses to more accurately chart a user s activity. If you don t use this option, and you have several users from the same IP, you won t be able to distinguish one user session from another. 5. Check the Check for Valid Cookies option to tell WebTrends to verify that a cookie is a WebTrends cookie before it is included as user session data. Leave this option unselected if you know that the Cookie field in your log file contains cookie information, in a format different from WebTrends cookies. (If you were to enable the option in this case, the cookie information would be rejected.) Note: Valid WebTrends cookies are generated by the WebTrends plug-in for Microsoft or Netscape Web servers. 6. Select another tab to make changes to other features. 7. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. 136

137 Chapter 13. Configuration Options Log File Cache Options Complete the following steps to determine the frequency with which WebTrends should download your log file via FTP. This option works only for log file retrieval via FTP. 1. Click Options. 2. Click the Web Log Analysis button. 3. Select the Log File Cache tab in the Options dialog box. 4. Select one of the following options: Always download the file Select this option to have WebTrends retrieve the log file via FTP every time a report is generated on it, regardless of whether there has been any new activity recorded in it. Note: Selecting this option impacts performance. You should only select this option if you want to manually check for new activity by looking at the date and size of the file. 137

138 WebTrends Log Analyzer Download the file once per session Select this option if you want to retrieve the log file via FTP only one time per WebTrends session, regardless of the number of reports generated on it or whether there has been any new activity recorded in it. Use this option for best performance when creating several reports successively. Download the file changes Select this option if you want to retrieve the log file via FTP only when new activity has been recorded in it. Each time you run a report, WebTrends determines whether the log file has changed since the last report was run and retrieves the updated log file only if it has changed. 5. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Real-Time The Real-Time Analysis options let you define the real time reporting options. Real-Time reporting lets you automatically create live reports every 5-10 minutes. Users can access these reports through a browser from their systems. 138

139 Chapter 13. Configuration Options 1. Click Options. 2. Click the Log Analysis button in the Options window. 3. Select the Real-Time tab. 4. In the Report Range field, select the time/date range of the log file to be included in all real-time reports. 5. In the Memorized Report Name field, select the report settings to apply to all reports that are generated in real time. 6. In the CPU Usage field, click and drag the CPU Usage button to set the amount of system resources to be dedicated to the generation of reports in real time. Note: The default setting is max which dedicates all CPU resources. 7. Click OK to save your selections, or click Cancel to exit the Options window without saving your changes. Language Complete the following steps to access the language editor for Web log analysis reports: 1. Click Options. 2. Click the Web Log Analysis button. 139

140 WebTrends Log Analyzer 3. Select the Language tab in the Web Log Analysis Options window. For details about the Language Editor, see the Adding or Editing Report Languages on page

141 Chapter 14. Performance In This Chapter: Using Filters to Optimize Performance Running Reports without DNS Lookup Cache the Log File Accessing the log file/site: file, ftp, http Report Type DNS Cache Size Retrieving HTML Page Titles Zip Archived Log Files Many factors impact how WebTrends performs. In this chapter you ll learn how to run WebTrends most efficiently for your environment. Using Filters to Optimize Performance You can exclude the directory, file, or user activity that you are not interested in from your analysis. Here are a few examples: Create a profile for each directory, modifying the Include Everything filter to include just the directory for this profile. See Directory on page 50 for details. Modify your profile, by creating an exclude filter that eliminates the files that are not relevant to your analysis (such as graphics files). See File Filter on page 52 for details. Running Reports without DNS Lookup Reverse DNS lookups translates the numeric IP address into a domain name. This can be done either by the web server when logging activity or by WebTrends when it analyzes the log files 141

142 WebTrends Log Analyzer DNS Lookups are performed more efficiently by the web server as the log is created, rather than by WebTrends. Running Reports without DNS Lookup Reverse DNS lookups translates the numeric IP address into a domain name. This can be done either by the web server when logging activity or by WebTrends when it analyzes the log files. DNS Lookups are performed more efficiently by the web server as the log is created, rather than by WebTrends. Cache the Log File WebTrends FastTrends feature lets you collect data for the current profile in a database so that future reports can be generated more quickly than the initial report. To turn on the FastTrends feature, select the FastTrends and Real Time tab in the Edit Web Log Profile dialog, and check the FastTrends Database box. Accessing the log file/site: file, ftp, http The fastest way to access the log file or site is through file retrieval. If you are performing a Web Log Analysis and you can retrieve the log file locally, doing so increases the speed of analysis when compared to ftp or http retrieval. Report Type WebTrends can create html reports quicker than it does any other report type. Unless the report must be generated in another format, you should always create html reports. See Creating a Log Analysis Report on page 33 for details on report settings. 142

143 Chapter 14. Performance DNS Cache Size You may need to increase the DNS cache size if you have DNS Lookup turned on. This is because the domain name is stored in a permanent cache to make future reports faster. Once the database capacity is reached, the oldest addresses are replaced with the new entries. See Log File Cache Options on page 137 for details. Retrieving HTML Page Titles WebTrends Log Analyzer can retrieve page titles for URLs, but doing so can impact the speed of the report unless the web site resides locally on your WebTrends machine. If you turn this feature off, URLs instead of page title appear in your WebTrends reports. 1. Click the Options button on the toolbar. 2. Click the Web Log Analysis button. 3. Select the General Options tab. 4. Select the Retrieve HTML Page Titles box, removing the check. Zip Archived Log Files WebTrends can report on zipped log files. This feature lets you save space on your system s hard drive by zipping your archived log files using a tool such as WinZip. 143

144

145 Appendix A. Glossary This section provides definitions for WebTrends and common Internet terminology. Term Browser Client Client Errors Combined Log File (Format) Common Log File (Format) Company Database Content (Report) Definition A program used to locate and view HTML documents. Netscape, Mosaic, and Microsoft Internet Explorer are Web browser applications. The browser (see above) used by a visitor to a web site. An error occurring due to an invalid request by the visitor s browser. Client errors have codes in the 400 range. (See Return Codes. ) Two additional fields (Referrer and User Agent) are added to the Common Log File (see below) to create the Combined Log File. A log file format developed by NCSA which has become the standard logging format for most Web servers. Note: A sample line and field definitions for common and combined log files are in the Samples: Common and Combined (Extended) Log File Format on page 16. The proprietary database installed and used by WebTrends to look up the company name, city, state and country corresponding to a specific domain name. Each time you generate a WebTrends report, you have the option to select the graphs and tables to include as well as the scope of each report item and the style of each graph. These selections are made in the Content tab of the Create Report Window. 145

146 WebTrends Log Analyzer Term Cookies DNS Cache Domain Name Domain Name Lookup (DNS Lookup) FastTrends Cache Filters FTP GIF Definition Persistent Client-State HTTP Cookies are files containing information about visitors to a web site (e.g., user name and preferences). This information is provided by the user during the first visit to a Web server. The server records this information in a text file and stores this file on the visitor's hard drive. When the visitor accesses the same web site again, the server looks for the cookie and configures itself based on the information provided. WebTrends maintains a DNS cache to speed IP address conversion and report generation. The range supported is from 1,000 to 60,000 entries; each entry requires 8 bytes of memory. The text name corresponding to the numeric IP address of a computer on the Internet (e.g., The process of converting a numeric IP address into a text name (for example, is converted to This patent-pending technology makes it possible to store the results of log file analyses in a cache to significantly speed future reports based on the same log file. A means of narrowing the scope of a log file report or view by specifying ranges or types of data to include in or exclude. File Transfer Protocol is a standard method of sending files between computers over the Internet. Graphics Interchange Format is an image file format commonly used in HTML documents. 146

147 Appendix A. Glossary Term Hit Home Page Home Page URL HTML HTTP In-line Image IP Address JPEG Language (Report) Log File Log File URL Definition An action on the Web server, such as when a user views a page or downloads a file. Note: The Number of Hits in WebTrends reports indicates the number of times that item was requested, whereas User Sessions specifies the number of sessions (regardless of the number of times within a particular session) the item was requested. The main entry page for a web site. The local path or Internet URL to the default page of the web site for which the report is being generated. Hyper Text Markup Language is used to write documents for the World Wide Web that specify hypertext links between related objects and documents. Hyper Text Transfer Protocol is a standard method of transferring data between a Web server and a Web browser. A graphic image displayed within an HTML document. The Internet Protocol Address identifies a specific machine attached to the Internet. Joint Photographic Experts Group is a method of storing an image in digital format. You can select the language for the text of your reports, either English, French or German. You can also create your own report languages. You access the Language Editor through the Language tab in each of cartridge s Options dialog. A file created by a Web or proxy server which contains all of the access information regarding the activity on that server. The local path or Internet URL for the log file to be used for the report. 147

148 WebTrends Log Analyzer Term MAPI Memorized Report Settings MPEG Multi-homed Domain Multi-homed Log File Multi-homed Web Server Multithreading ODBC Platform Plug-In Profile Definition Mail Application Programming Interface is an industrywide standard which is usually the default method for accessing large mail systems like Microsoft Mail and cc:mail. In the WebTrends Create Report window, there is a Memorize button which you can click to save your report settings so that you can apply them to other profiles and scheduled reports. The settings that are saved are: Time/Date Range, Format (i.e., HTML, MS Word/Excel or Text), Destination (i.e., Save As/Mail To information), Report Title, Report Language, Report Style, and Report Content. Moving Picture Experts Group is a method of storing movie files in digital format. The domain name or IP address of one of the sites in a multi-homed log file (see below). A single log file that contains the access information for multiple web sites. A single computer that is hosting more than one web site. See Threads. Open DataBase Connectivity is an API that allows a programmer to extract data from a database. The operating system (e.g., Windows 95, Windows NT, etc.) used by a web site visitor. A software module that adds a specific function or service to another software program. For example, WebTrends plug-ins for Netscape and Microsoft servers allow these servers to save additional information in their log files. A file containing all rules defining access to a log file, DNS lookup options, and filters. 148

149 Appendix A. Glossary Term Protocol Proxy Server Real-Time Analysis Real-Time Reporting Referrer Remote Reporting Report Definition An established method of exchanging data over the Internet. A proxy server is a server that acts as a go-between between an organization and the Internet. They serve to improve performance by filling a request directly rather than forwarding the user to the Internet if the necessary information is available. Proxy servers also serve to block unauthorized activity outgoing or incoming (referred to as firewalls ). A technique allowing WebTrends to continuously collect data in the background to speed up creation of reports for large log files. The production of reports with regularly updated, upto-the-minute data. The URL of an HTML page from which a visitor clicks to access your web site. A function allowing authorized users access to WebTrends remotely using only an Internet browser. The user must be connected to WebTrends' Remote Reporting server, from which he or she can configure WebTrends options as well as create, display and delete reports. A document (in HTML, MS Word, MS Excel, commadelimited or text format) created by WebTrends to present in graphs and tables the result of its analysis. 149

150 WebTrends Log Analyzer Term Return Code (Web Server) Definition The return status of the request which specifies whether the transfer was successful and why. Possible Success codes are: 200 = Success: OK 201 = Success: Created 202 = Success: Accepted 203 = Success: Partial Information 204 = Success: No Response 300 = Success: Redirected 301 = Success: Moved 302 = Success: Found 303 = Success: New Method 304 = Success: Not Modified Possible Failed codes include: Client Errors: 400 = Failed: Bad Request 401 = Failed: Unauthorized 402 = Failed: Payment Required 403 = Failed: Forbidden 404 = Failed: Not Found Server Errors: 500 = Failed: Internal Error 501 = Failed: Not Implemented 502 = Failed: Overloaded Temporarily 503 = Failed: Gateway Timeout 150

151 Appendix A. Glossary Term Server Server Errors (Web Server) SMTP Style (Report) Tag TCP/IP Threads TIFF URL Definition A computer that hosts information available to anyone accessing the Internet. An error occurring at the server. Web server errors have codes in the 500 range. (See Return Codes. ) Simple Mail Transfer Protocol: used by most Internet mail programs (Eudora and Netscape, for example). The report style defines the colors, fonts, table and page layouts of your WebTrends HTML reports. WebTrends ships with several default styles which you can use as is or modify, or you can create your own style(s) from scratch. To access the Style Editor, click the Style Editor button on the WebTrends main console. An instruction, in the form <Text>, placed in an HTML page to tell the browser how to process the information following it. Transmission Control Protocol/Internet Protocol comprises the rules defining the method by which data is transferred between computers on the Internet. Threads are the parts of a program that can run independently and concurrently. A multithreaded application can execute multiple threads at the same time to greatly enhance performance. Tag Image File Format is an image file format. Universal Resource Locator is a means of identifying an exact location on the Internet. (For example, is the URL which defines the use of HTTP to access the Web page Default.htm in the /html/info/ directory on the WebTrends Corporation Web server). As the previous example shows, a URL is comprised of four parts: Protocol Type (HTTP), Machine Name (webtrends.com), Directory Path (/html/info/) and File Name (default.htm). 151

152 WebTrends Log Analyzer Term User Address User Agent User Session View Visit Visitor Web Wild cards World-Wide Web WWW Definition The domain name or IP address for the remote user/visitor. The fields in an extended Web server log file indicating the browser and the platform used by a visitor. A session of activity (all hits) for one user of a web site. A unique user is determined by the IP address or cookie. By default, a user session is terminated when a user is inactive for more than 30 minutes. See General Web Log Analyzer Settings on page 132 for instructions on how to change the default setting. An ASCII-text document created by WebTrends that lists filtered data from a log file with optional color coding. (See also Report ) See User Session One user of a web site. See World Wide Web. A wild card is a symbol or combination of symbols that stand for one or more characters. WebTrends filters support wildcards to make defining your filter easier. For example, image* might stand for all files that begin with image (image1, image2, image3). Similarly, image*.gif stands for all image files with a.gif extension (image1.gif, image2.gif). The Web is a hyper-text-based, distributed system developed to provide Internet users an easy, intuitive means of accessing information. See World Wide Web. 152

153 Appendix B. Sample WebTrends Report Web Log Analysis Report Sample General Statistics This section tells you where your visitors come from geographically, helping you determine what percentage of your users are domestic or international. The location of the user is determined by the suffix of the domain name. You can use the Domain tab of the Options dialog box to specify how suffixes are interpreted. By default, WebTrends classifies the suffixes.com,.net,.edu,.mil,.org,.gov and.us, as part of the US domain. If a suffix is not identified in this list and is not a country code suffix, WebTrends looks up the country or region of origin in the Company Database before defaulting to "Unknown." Note: The origin of the user can only be determined if reverse DNS lookups have been performed. This section provides an overview of your site's activity. These important statistics help you quickly determine the growth and the needs of your site. The table shows the date and time the report was generated, as well as the time frame for the report. The number of hits for the home page is the number of actual successful hits for the HTML document that is your home page, not including any graphics on the page. The total number of hits are all the successful hits including HTML pages, pictures, forms, scripts and files downloaded. The USA, International and Unknown sections summarize the origin of your users in percentages of hits. The Average Hits per Day and Average User Sessions per Day are the average number of successful hits and user sessions your site has had on any given day for the report period. 153

154 WebTrends Log Analyzer Most Requested Pages This section identifies the most popular pages on your site, and can help you determine which pages are viewed the most for advertising, billing, promotional or design purposes. The number of hits includes only the successful hits for the HTML page itself. It does not include any hits for graphics, audio or video files. The percentage of total hits is the percentage of hits for that document compared to all other HTML documents. Tips: The types of files included in this table can be configured using the File Types tab in the Options dialog box. You can list all pages on your site by setting the number of items to a number higher than the number of pages on your site. Note: You can view the complete sample report by visiting Webtrends web site at : Least Requested Pages This section identifies the least popular pages on your web site. In the table, pages are listed in increasing order of to the number of hits. The number of hits only includes the successful hits for the HTML page itself. It does not include any hits for graphics. The percentage of total hits is the percentage of hits for that document compared to all other HTML documents. Tips: The types of files included in this table can be configured using the File Types tab in the Options dialog box. You can list all pages on your site by setting the number of items to a number higher than the number of pages on your site. 154

155 Appendix B: WebTrends Sample Reports Top Entry Pages This section identifies the pages users first saw when they entered this site. This is most likely your home page but, in some cases, it may also be specific URLs that users enter to access a particular page directly. For example, if a user enters he/she would "enter" at the WT-QA.HTM page. The table lists the pages in decreasing order of the number of hits, and specifies the percentage of total hits and the number of user sessions. Top Exit Pages This section identifies the most common pages users were on when they left your site. Single Access Pages This section identifies the pages on your web site that visitors access and exit without viewing any other page. This demonstrates where visitors enter and leave immediately. This information can be helpful when considering the design of your web site or when ascertaining the quality of visitors to your site. Top Paths Through Site This section identifies the paths people most often follow when accessing your web site. The path begins at the page of entry and shows the next six consecutive pages viewed. The information contained in this table can help with the redesign and ongoing maintenance of your web site. Advertising Views and Clicks This section calculates the percentage of ads viewed that were then clicked on (the "Click Thru Rate %"). This information helps gauge the appeal of an advertisement and the quality of the potential customers seeing it. Advertising Views This section identifies the frequency with which an ad is viewed. If you are selling advertising space on your web site, this graph and table can be used for billing, accounting and marketing purposes. 155

156 WebTrends Log Analyzer Advertising Clicks This section identifies the frequency with which ads were clicked. If you are selling advertising space on your web site, this graph and table can be used for billing, accounting and marketing purposes. Most Downloaded Files This section identifies the most popular file downloads of your web site. The number of downloads indicates the number of times the file was downloaded whereas the number of user sessions indicates the number of individuals who downloaded the file. If an error occurred during the transfer, that transfer is not counted. Tip: You can use the File Types tab of the Options dialog box to specify the types of files included in this computation. Most Active Organizations This section identifies the companies or organizations that accessed your web site the most often. If the Reverse DNS option is set to "Always" or "Automatically," WebTrends searches for the domain name in the company database, and includes the company name and geographic information in the graph and table. If reverse DNS lookups are not performed, either by WebTrends or by the server, only IP addresses will be listed. The table lists companies and organizations in decreasing order of the number of hits. Most Active Countries This section identifies the top locations of the users of your site by country. The country of the user is determined by the suffix of their domain name. If reverse DNS lookups have not been performed, WebTrends cannot determine the country of origin and this section will not be included in the report. The table lists the top countries in decreasing order of the number of hits. 156

157 Appendix B: WebTrends Sample Reports Summary of Activity by Day This section outlines general server activity, comparing the level of activity on weekdays and weekends. The Average Number of Users and Hits on Weekdays are the averages for each individual weekday. The Average Number of Users and Hits for Weekends groups Saturday and Sunday together. This table also lists the most and least active days of the week, the most and least active days of the report period, and the number of hits for each. Averages in the table do not include erred hits. This table is useful for determining the best day of the week to perform system maintenance. Activity Level by Day of Week This section shows the activity for each day of the week for the report period (i.e. if there are two Mondays in the report period, the value presented is the sum of all hits for both Mondays.) The table lists the number of hits, percentage of total hits and user sessions for each day of the week for the report period. The Total Weekdays line indicates the number of hits occurring Monday through Friday for the report period. The Total Weekends line indicates the number of hits occurring Saturday and Sunday for the report period. The values in this table do not include erred hits. Activity Level by Hour of the Day This section shows the most and the least active hour of the day for the report period. The second table breaks down activity for the given report period to show the average activity for each individual hour of the day. The table lists the percentage of total hits and user sessions, as well as the totals for work hours (8:00am - 5:00pm) and after hours (5:01pm - 7:59am). This information is useful in determining what hour of the day is best for system maintenance. Technical Statistics and Analysis This section is useful in determining the reliability of your site. This table shows the total number of hits for the site, how many were successful, how many failed, and calculates the percentage of hits that failed. Failed hits are hits where a server or client error occurred. Cached hits are those where the page was found in the cache of the browser, so the server did not need to transfer the file. 157

158 WebTrends Log Analyzer Client Errors This section identifies the type of errors which were returned by the Client accessing your server. The table lists all the errors which occurred in order of number of failed hits. Server Errors This section identifies by type the errors which occurred on your server. The table lists the errors in decreasing order of the number of failed hits. Most Downloaded File Types and Sizes This section identifies the download file types and the total kilobytes downloaded for each file type. Cached requests and erred hits are excluded from the totals. The table lists the types of files downloaded in decreasing order of the number of file downloads, and gives for each type the number of kilobytes transferred. Tip: You can use the File Types tab in the Options dialog box to specify the types of files included in this table. Organization Breakdown This section provides a breakdown by types of organizations (.com,.net,.edu,.org,.mil, and.gov. The table lists the types of organizations in decreasing order of the number of hits. Also shown is the percentage of total hits and user sessions and a grand total for each. This information can only be displayed if reverse DNS lookups have been performed. North American States and Provinces This section breaks down web site activity to show which of the North American States and Provinces were the most active on your site. The table lists the States and Provinces in decreasing order of the number of user sessions. This information is based on where the domain name of the visitor is registered, and may not always be an accurate representation of the actual geographic location of this visitor (for example, individual visitors will often be seen as coming from the state where their ISP is registered.) This information can only be displayed if reverse DNS lookups have been performed. 158

159 Appendix B: WebTrends Sample Reports Most Active Cities This section further break down your web site's activity to show which cities were the most active on your site. This information is based on where the domain name of the visitor is registered, and may not always be an accurate representation of the actual geographic location of this visitor (for example, individual visitors will often be seen as coming from the city where their ISP is registered.) This information can only be displayed if reverse DNS lookups have been performed. Bandwidth This section helps you understand the bandwidth requirements of your site by indicating the volume of activity kilobytes transferred. Most Accessed Directories This section analyzes accesses to the directories of your site. The table lists the most accessed directories in decreasing order of the number of hits. Non-Cached % represents the percentage of hits that were not already in the user's browser cache. This information can be useful in determining the types of data most often requested. Top Referring Sites This section identifies the domain names or numeric IP addresses with links to your site. The table shows the Domain names if reverse DNS lookups have been performed. This information will only be displayed if your server is logging this information. Tip: You can exclude referrals from your own site by specifying your URL in the profile filters. Top Referring URLs This section provides the full URLs of the sites with links to your site. The table shows the Domain names if reverse DNS lookups have been performed, and IP addresses if not. This information will only be displayed if your server is logging the referrer information, and doesn't include visitors who typed in your URL. 159

160 WebTrends Log Analyzer Tip: You can exclude referrals from your own site by specifying your URL in the profile filters. Top Search Keywords The first table identifies, for each keyword, which search engines led visitors to your site. The second table identifies keywords which led the most visitors to your site. Totals in this table represent the nomber of keywords (regardless of search engine). Most Used Browsers This section identifies the most popular WWW Browsers used by visitors to your site. This information will only be displayed if your server is logging the browser/platform information. Netscape Browsers This section gives you a breakdown of the various versions of Netscape browsers that visitors to your site are using. This is useful in determining the percentage of visitors using newer browsers and whether version- specific features (such as Java Scripts) should be implemented on your site. This information will only be displayed if your server is logging the browser/platform information. Microsoft Explorer Browsers This section gives you a breakdown of the various versions of Microsoft Explorer browsers that visitors to your site are using. This is useful in determining the percentage of visitors using newer browsers and whether version specific features (such as Java Scripts) should be implemented on your site. This information is only displayed if your server is logging the browser/platform information. Visiting Spiders This section identifies all robots, spiders, crawlers and search services (i.e. Alta Vista, Lycos, and Excite) visiting your site. This information is important for a Webmaster trying to block spiders that tax the server. This information will only be displayed if your server is logging the browser/platform information. 160

161 Appendix B: WebTrends Sample Reports Most Used Platforms This section identifies the operating systems most used by the visitors to your web site. This information will only be displayed if your server is logging the browser/platform information. 161

162

163 Appendix C. Reference In This Chapter Report/View Ranges Examples: Defining Log Files in a Log Analysis Profile Product Support Report/View Ranges At the time that you generate a web log report, you have the option to specify the date or time range within the log file on which to report. In the Range tab of the Create Report window, you can specify your own or select from a drop-down list of predefined time and date ranges. Note: While WebTrends attempts to analyze and report on the specified Report Range within the log file processed, you need to ensure that the specified range corresponds to existing dates in the log file. For example, if the analyzed log file contains data for only the last week of activity, WebTrends is not be able to provide meaningful monthly averages. The following definitions apply to the Report/View Ranges table: Quarters are divided as follows: First Quarter January 1 - March 31 Second April 1 - June 30 Quarter Third Quarter July 1 - September 30 Fourth Quarter October 1 - December 31 6 month periods are divided as follows: January 1 - June 30 July 1 - December

164 WebTrends Log Analyzer Range All of Log Specify Date/Time Definition Reports on all data in the log file. Reports on the time frame specified from Start Time and Date to End Time and Date. Time formats should be specified in military time with hours, minutes and seconds (e.g., 14:30:00). Dates should be specified using the mm/dd/yy format (e.g., 01/10/97). Last 15 minutes Last hour Reports on the activity that has taken place in the last 15 minutes. Reports on the activity that has taken place in the last hour. Last 12 hours Reports on the activity that has taken place in the last 12 hours. Today Yesterday Reports on activity for the current day from midnight to 11:59:59. Reports on the activity for yesterday from midnight to 11:59:59. This week Last week These 2 weeks Last 2 weeks This month Last month This quarter Last quarter Reports on activity for the current week from Sunday up to the point the report is started. Reports on activity for the last week from Sunday to Saturday. Reports on activity from Sunday of last week up to the point the report is started. Reports on activity for the last two full weeks. Reports on activity for the current month up to the point the report is started. Reports on activity for the last month. Reports on activity for the current quarter up to the point the report is started. Reports on activity for the last quarter. 164

165 Appendix C. Reference Range This 6 months Last 6 months Definition Reports on activity for the current 6 month period. Reports on the activity for the previous 6 month period. This year (by equal 4-week periods) This year (by months) Last year (by equal 4-week periods) Last year (by months) Last day of log Previous day of log Last week of log Previous week of log Last 2 weeks of log Previous 2 weeks of log Last month of log Reports on activity for the current year, starting Jan. 1 st, up to the point the report is started. Data is graphed with each bar representing a 4-week period. Reports on activity for the current year, starting Jan. 1 st, up to the point the report is started. Data is graphed with each bar representing one month. Reports on activity for the year previous to the current year. Data is graphed with each bar representing a 4- week period. Reports on activity for the year previous to the current year. Data is graphed with each bar representing one month. Reports on all activity from midnight to 11:59:59 for the day including the very last entry in the log file. Reports on all activity from midnight to 11:59:59 for the day previous to the day of the very last entry in the log file. Reports on activity from Sunday to Saturday for the week including the very last entry in the log file. Reports on activity from Sunday to Saturday for the full week previous to the week of the very last entry in the log file. Reports on activity from Sunday to Saturday for the 2 weeks including the very last entry in the log file. Reports on activity from Sunday to Saturday for the 2 full weeks previous to the week of the very last entry in the log file. Reports on activity from the first day of the month to the last entry in the log for the month including the very last 165

166 WebTrends Log Analyzer Range Previous month of log Last quarter of log Definition entry in the log file. Reports on activity from the first day of the month to the last day of the month for the month previous to the month of the very last entry in the log file. Reports on activity from the first day of the quarter to the last entry in the log for the quarter including the very last entry in the log file. Previous quarter of log Last year of log (by equal 4-week periods) Last year of log (by months) Previous year of log (by equal 4-week periods) Previous year of log (by months) First day of log First week of log First 2 weeks Reports on activity from the first day of the quarter to the last day of the quarter for the quarter previous to the quarter of very last entry in the log file. Reports on activity from January 1 to the last entry in the log for the year including the very last entry in the log file. The data is graphed with each bar representing a 4-week period. Reports on activity from January 1 to the last entry in the log for the year including the very last entry in the log file. The data is graphed with each bar representing one month. Reports on activity from January 1 to December 31 for the year previous to the year of the very last entry in the log file. The data is graphed with each bar representing a 4-week period. Reports on activity from January 1 to December 31 for the year previous to the year of the very last entry in the log file. The data is graphed with each bar representing one month. Reports on activity for the full day from midnight to 11:59:59 for the day beginning with the very first entry in the log file. Reports on activity for the week from Sunday to Saturday for the week beginning with the very first entry in the log file. Reports on activity for the 2 weeks from Sunday to 166

167 Appendix C. Reference Range of log First month of log First quarter of log First year of log (by equal 4-week periods) First year of log (by months) Definition Saturday for the 2 weeks beginning with the very first entry in the log file. Reports on activity for the month for the month beginning with the very first entry in the log file. Reports on activity for the quarter beginning with the very first entry in the log file. Reports on activity for the year from January 1 to December 31 for the year beginning with the very first entry in the log file. The data is graphed with each bar representing a 4-week period. Reports on activity for the year from January 1 to December 31 for the year beginning with the very first entry in the log file. The data is graphed with each bar representing one month. If you choose the Specify Date/Time option, the following fields become active: Note: If you access your log file remotely through ftp or http, these fields read N/A. Start Time Start Date End Time End Date Specify a beginning time for the report range. This field uses a 24-hour clock (military time). Specify a beginning date for the report range. Specify an ending time for the report range. This field also uses a 24-hour clock (military time). Specify an ending date for the report range. Examples: Defining Log Files in a Log Analysis Profile Working with Profiles Profiles tell WebTrends the log file that you want to report on, including the log file location and how the log file should be analyzed (such as, reverse DNS lookup, filters). 167

168 WebTrends Log Analyzer Once you have created a profile, you can edit, copy or delete it from the main console: To edit any existing profile, highlight the profile in the profile list and click Edit. To copy an existing profile, highlight it and select Copy profile from the File menu. To delete an existing profile, highlight it and click Delete. Note: If you are working with Agent and Referrer Logs, they must be analyzed individually: you must add a separate log profile for each. We recommend configuring your server to log in a combined format to get the most cross-correlation of data. Local File If you have a drive mapped to your web or proxy server, you can specify the file:/// option in the URL Path and enter the exact path to your log file (for example, c:\netscape\servers\http-web\logs\*.log ). Remote (FTP) For FTP you enter a user name and password login information for the specified computer. Remote (HTTP) WebTrends takes advantage of Web servers which support the HTTP1.0 Byte- Ranges protocol when it uses HTTP to gain remote access to a log file. Almost all major Web servers support this standard including Netscape, Microsoft, O Reilly and Apache. When this standard is used, WebTrends only retrieves the records which were added to the log file since the last analysis. This means the log file can grow, and you will not have to retrieve the entire log file every time you want to run a report, as opposed to what happens with FTP, or HTTP without byte-range support. With byte-range support, only the new additions will be retrieved. Multiple (Rotated) To add multiple log files (also referred to as rotated log files), enter a pipe character ( ) between log file/path names or use wildcard characters (* or?). This capability is available with the file:/// and ftp:// options only. 168

169 Appendix C. Reference Examples: d:\logfiles\logfile.log logfile2.log Includes "logfile.log" and "logfile2.log" in the "logfile" directory on drive d: \server\*.log \server2\*.log Includes ALL of the.log files in the "server" and "server2" directories on the current drive. c:\server\logfile.log d:\logfiles\*.log Includes "logfile.log" in the "server" directory on drive c: and ALL of the.log files in the "logfiles" directory on drive d: ODBC Source WebTrends can analyze log file data stored in an ODBC database (Microsoft Access or Microsoft SQL). To use the ODBC feature, the database must be in the following format: ClientHost varchar(255) username varchar(255) LogTime datetime service varchar(255) machine varchar(255) serverip varchar(50), processingtime int bytesrecvd int bytessent int servicestatus int win32status int operation varchar(255) target varchar(255) parameters varchar(255) Complete the following steps to analyze log file data from an ODBC database: 1. Create a Data Source Name which accesses the ODBC source. 169

170 WebTrends Log Analyzer 2. In WebTrends, in the Log File URL Path field, select ODBC from the drop-down list and click Browse. 3. Select the DSN for your log file. Note: If WebTrends is retrieving your log file data from an ODBC data source, you cannot use the FastTrends caching option. Product Support If you have any questions during the installation or use of WebTrends, please refer to the WebTrends Corporation Knowledge Base online at: If you are unable to resolve the problem, do not hesitate to contact our Product Support Department: Fax: (503) , Telephone: (503) WebTrends Corporation will attempt to answer your technical support request concerning the software. However, this service is offered on a reasonable efforts basis only and WebTrends Corporation may not be able to resolve every support request. WebTrends Corporation supports the software only if it is used under conditions and on operating systems for which the software is designed. 170

171 Index A about ad views and clicks 89 FastTrends cache 83 Intranet management 97 real-time analysis 83 real-time reporting 83 remote reporting 125 scheduler 69 style editor 61 this manual 13 views 39 activity level by day of week 157 activity level by hour of the day 157 activity volume 159 activity, summary by day 157 Ad Click ID String 92 Ad View File Name 91 ad views and clicks about 89 adding 90 deleting 93 description 90 editing 93 tracking exit URLs 89 using 90 adding ad views and clicks 90 agent and referrer logs 168 file types 129 Intranet domain 98 report styles 62 scheduled reports 73, 77 Web log analysis profiles 28 adding logo to reports 64 advertising clicks 156 advertising filter 55 advertising views 155 agent and referrer logs adding 168 alignment data, in table cells 64 available items 67 B bandwidth 159 browser defined 145 selecting 120 browser filter 55 examples 55 formatting 56 browsers, microsoft explorer 160 browsers, most used 160 browsers, netscape

172 WebTrends Log Analyzer C caching about FastTrends 83 HTML page titles 134 changing font and point size in schedule log 80 font and point size in views 44 general Web log analyzer settings 132 MS Word and Excel report options 134 scheduled reports 78 cities, most active 159 clearing schedule log 81 click throughs 89 clicks, advertisement 89 clicks, advertising 156 client defined 145 client errors 158 defined 145 Close command 70, 87 column items, selection 63 combined log file defined 145 sample 16 common log file defined 145 sample 16 company database, defined 145 configuring cookies 135 domain name groupings 131 options 124 file types 129 general Web log analyzer settings 132 HTML Browser 120 log file cache options 137 Microsoft IIS plug-in 107 MS Word and Excel report options 134 Netscape plug-in 102 NT Service 121 proxy server 123 real-time reporting options 85 remote reporting options 116 remote reporting server 127 content 145 content 66 content, defined 145 cookies defined 146 cookies, configuring 135 copying, profiles 168 countries, most active 156 CPU usage, real-time reports 85, 139 creating D log analysis views 39 scheduled reports 73, 77 Web log analysis reports 33 date macros for file name 37 date macros 37 date range error 17 date ranges 34, 72, 77, 85, 95, 139, 163 day filter 56 day of week, activity level

173 Index defining domain types 131 definitions log file fields 17 server 151 deleting ad views and clicks 93 Intranet domain 100 profiles 168 scheduled reports 78 description ad views and clicks 90 Intranet domain 99 description and report title Web log analysis profile 28 descriptions table and graph, including in reports 63 detailed view example 41 directories most accessed 159 directory filter 50 examples 51 formatting 52 disabling scheduled events 75 DNS cache clearing 133 DNS Cache defined 146 DNS lookup explained 30 Web log analysis profile 30 documentation, overview 13 domain name defined 146 groupings, changing 131 domain name lookup defined 146 domestic visitors 153 dynamic web pages, in reports 130 E editing ad views and clicks 93 Intranet domain 100 profiles 168 report styles 62 elements, graph and table 68 options, configuring 124 ing Web log analysis reports 34 enabling remote reporting server 127 error no data for date range 17 errors, client 158 errors, server 158 examples browser filter 55 detailed view 41 directory filter 51 file filter 52 hour filter 57 multiple/rotated log files 169 referrer filters 54 standard view 41 user address filter 49 user address filters 49 username filter

174 WebTrends Log Analyzer view, order by country 42 Excel and MS Word report options 134 Exit & Unload command 70, 87 exit URLs tracking 89 F FastTrends cache about 83 clearing 87 defined 146 file extensions, adding or editing 130 file extensions, edit 130 file filter 52 examples 52 formatting 53 file name Ad View 91 file name macros 37 file retrieval of log file 28 file types 129 file types and sizes, most downloaded 158 file types, adding or editing 130 file types, edit 130 files log files 16 files, most downloaded 156 filters adding a filter 46 advertising 55 browser 55 combining filter elements 47 combining include and exclude 48 day 56 defined 146 directory filter 50 elements 48 exclude filters 45 file filter 52 filtering a multi-homed web site 57 hour 57 include filters 45 multi-homed domain filter 50 referrer 53 return codes 48 user address 48 username 56 web log analysis 45 flush DNS cache 133 font and point size changing in schedule log 80 changing in views 44 formatting browser filters 56 directory filters 52 file filters 53 referrer filters 54 frame HTML reports 64 frame width table of contents 64 tables 63 FTP defined 146 FTP log file retrieval

175 Index G general options WebTrends 119 general settings Web log analyzer 132 general statistics report 153 GIF defined 146 using GIF images in reports 134 glossary 145 graph and table elements 68 graph types 67 H hit defined 147 hits home page number 153 hits per day 153 home page defined 147 home page file names Web log analysis profile 31 home page hits number of 153 home page URL defined 147 hour filter 57 examples 57 hour of the day. activity level 157 HTML defined 147 HTML browser selecting 120 HTML page titles caching 134 displaying in reports 31 HTML reports frame width 64 table of contents frame 64 HTTP defined 147 HTTP log file retrieval 29 I ID String Ad Click 92 including items in reports 67 table and graph descriptions in reports 63 in-line image defined 147 installing Microsoft IIS plug-in 22 Netscape Server plug-in 22 installing WebTrends 21 international options 120 international visitors 153 Internet advertising tracking 90 Intranet domain adding 98 deleting 100 description

176 WebTrends Log Analyzer editing 100 IP Address/Pattern 99 location 99 Intranet management about 97 IP Address defined 147 IP Address/Pattern Intranet domain 99 J JPEG K defined 147 using JPEG images in reports 134 keywords, top search 160 L language defined 147 language editor Web log analysis 139 least requested pages 154 license agreement 22 locale options 120 location Intranet domain 99 log analysis web 14 log file agent and referrer, adding 168 combined (extended), sample 16 common, sample 16 defined 147 general information 16 log file cache options configuring 137 log file fields defined 17 log file format Web log analysis profile 30 log file retrieval FTP 29 HTTP 29 ODBC 29 log file retrieval methods 28 log file url path 28 log file URL path defined 147 Web log analysis profile 29 log file URL path retrieval 28 log files understanding 16 logo adding to reports 64 M macros date for file name 37 main console WebTrends 24 main screen 24 manual 176

177 Index overview 13 MAPI defined 148 memorized report name real-time reports 85, 139 memorized report settings defined 148 memorizing view settings 40 Web log analysis report settings 36 microsoft explorer browsers 160 Microsoft IIS date formats in log files 17 error, 17 plug-in, configuring 107 plug-in, installing 22 tips 111 most accessed directories 159 most active cities 159 most active countries 156 most active organizations 156 most downloaded file types and sizes 158 most downloaded files 156 most requested pages 154 most used browsers 160 most used platforms 161 MPEG defined 148 MS Word and Excel report options 134 multi-homed domain adding a profile 84 defined 148 filtering 111 log file defined 148 Web server, defined 148 web site filtering 57 multi-homed domain filter 50 multiple log files examples 169 multiple reports from same log file 84 multithreading defined 148 N netscape browsers 160 Netscape plug-in configuring 102 Netscape Server plug-in installing 22 North American states and provinces 158 NT Service, configuring 121 O ODBC defined 148 ODBC log file retrieval 29 ODBC source log files 169 online registration 23 options Web log analysis 129 Order View By option 40 organization breakdown 158 organizations, most active

178 WebTrends Log Analyzer P page impressions 153 page impressions per day 153 page titles 143 page views 153 paths, top through site 155 pattern Intranet domain 99 performance WebTrends 141 platform defined 148 platforms, most used 161 plug-in defined 148 Microsoft IIS, configuring 107 Netscape, configuring 102 TNG 23 point size and font changing in schedule log 80 changing in views 44 printing schedule log 80 views 44 product support 170 profile defined 148 profile list sorting 24 view options 24 profiles copying 168 defining, for real time 86 deleting 168 editing 168 multi-homed domain 84 Web log analysis, adding 28 program performance 141 protocol defined 149 provinces, North American 158 proxy server configuring 123 defined 149 R ranges report 34, 163 report and view, predefined 163 view 40 real-time analysis about 83 defined 149 Real-Time Analysis generating reports 84 real-time reporting about 83 defined 149 options, configuring 85 real-time reports CPU usage 85, 139 memorized report name 85, 139 report range 85, 139 referrer defined 149 filter 53 referrer filters 178

179 Index examples 54 formatting 54 referring sites 159 referring URLS, top 159 registering WebTrends 23 remote reporting about 125 configuration options 116 defined 149 using 113 Windows NT accounts 126 remote reporting server configuring 127 removing file types, log & proxy 129 report defined 149 report language defined 147 report range real-time reports 85, 139 report ranges, predefined 163 report style adding and editing 62 defined 151 report style editor about 61 reporting remotely 113 reports adding logo 64 graph types 67 HTML, frame width 64 HTML, table of contents frame 64 scheduling consecutive 70 scheduling simultaneous 70 specifying items to include 67 Web log analysis, creating 33 requirements, system 21 retrieve html page titles 31, 143 return code defined 150 return code filter 48 rotated log files examples 169 running WebTrends as an NT service 121 S sample Web log analysis report 153 saving schedule log 80 views 44 Scenarios Automating WebTrends Reports, Quick Method 70, 75 Configuring WebTrends for your Intranet 98 Filtering Multi-Homed Log File 57 Generating Reports in Real Time 84 Making WebTrends Reporting Available to Remote Users 126 Modifying WebTrends Report Content 66 Modifying WebTrends Report Language 64 Modifying WebTrends Report Style 61 Tracking Internet Advertising

180 WebTrends Log Analyzer Using Your Browser to Create a WebTrends Report 113 web site Activity Reporting 27 schedule log changing font and point size 80 clearing 81 printing and saving 80 searching for a text string 79 viewing 79 scheduler about 69 adding reports 73, 77 disabling scheduled events 75 Memorized Type 73, 77 running on demand 81 Save Report To 74, 78 Schedule Start Time & Date 74, 78 scheduling Web log analysis reports 73, 77 scripts, in reports 130 search keywords, top 160 searching for a text string schedule log 79 views 43 selecting a browser 120 server defined 151 server errors 158 defined 151 single access pages 155 SMTP defined 151 snmp agent 128 software license agreement 22 sorting profile list 24 tables 63 spiders, visiting 160 standard view example 41 Start Now! feature 81 states, North American 158 style defined 151 style editor about 61 styles adding and editing 62 successful hits 153 summary of activity by day 157 support, technical 170 system requirements 21 T table and graph elements 68 table of contents frame HTML reports 64 tables cell alignment 64 column items 63 frame width 63 sorting 63 tag defined 151 TCP/IP defined 151 technical statistics and analysis 157 technical support

181 Index terminology defined 145 text string searching for in schedule log 79 searching for in view 43 threads defined 151 TIFF defined 151 tip views 39 TNG integration utility 23 top entry pages 155 top exit pages 155 top paths 155 top referring sites 159 top referring URLS 159 top search keywords 160 tracking Internet advertising 90 U understanding web log analysis 14 uninstalling WebTrends 24 URL defined 151 user address defined 152 user address filter 48 examples 49 user agent defined 152 user session defined 152 user sessions International 153 US 153 username filter 56 examples 56 using V ad views and clicks 90 view defined 152 view options profile list 24 View Range option 40 view ranges, predefined 163 View Type option 40 viewing schedule log 79 views about 39 ad view 89 changing font and point size 44 color codes 42 creating 39 detailed example 41 order by country example 42 page view 129, 130 printing and saving 44 searching for a text string 43 standard example 41 tip 39 views per day

182 WebTrends Log Analyzer views, advertisement 89 views, advertising 155 virtually hosted sites 16 visit defined 152 visiting spiders 160 visitor defined 152 visitors origin 153 W web log analysis 14 features 14 filters overview 45 how it works 15 overview 14 understanding 14 Web log analysis language editor 139 options 129 Web log analysis profiles adding 28 description and report title 28 DNS lookup 30 log file format 30 log file URL path 29 web site URL 31 Web log analysis reports destination 34 format 34 language 35 range 34 sample 153 style 35 title 35 Web log analyzer general settings 132 web log filters advertising 55 browser 55 day 56 directory filter 50 file filter 52 hour 57 multi-homed domain 50 referrer 53 return codes 48 user address 48 username 56 web site activity reporting 27 web site URL Web log analysis profile 31 WebTrends general options 119 installing 21 main console 24 online registration 23 performance 141 running as a service 121 uninstalling 24 width table of contents frame 64 wild cards, defined 152 Windows NT Service configuring 121 World-Wide Web 182

183 Index defined

184 184

185 Index 185