Why are application reports missing data?

50381 | Reporting FAQ | Web Security Solutions | Updated 22-Oct-2013


Applies to:	Websense Web Filter, Web Security, Web Security Gateway, and Web Security Gateway Anywhere, v7.8

If the charts on the Browser and Source Platform tabs on the Reporting > Applications page show no data, or if some of the data you expect to see doesn't appear, check the sections below for more information.

No data appears on the Applications page

If you have just installed or upgraded to a version that includes application reports, the database job that populates the Browser and Source Platform tables and charts may not have run yet.

As users connect to the Internet, new user agent strings appear on the Search tab, but are not parsed into recognized browsers or platforms until a nightly job runs.

If your Web Security solution is managing or monitoring traffic in your network, and raw strings are appearing on the Search tab, check the charts on the Browser and Source Platform pages again tomorrow.

Note that once a string has been parsed and recognized, future requests originating from that browser or platform are added to application reports without the overnight delay.

Application reports data is not available for deployments that are integrated with a third-party proxy, cache, firewall, or other device. The integration product does not send user agent strings to Websense Filtering Service.

In a distributed logging environment, remote Log Server instances cannot pass user agent string information to the central Log Server, so application reporting is not available.

Some data is missing from the Applications page

The data that appears on the Browser and Source Platform tabs of the Applications page is generated by a nightly database job. As users connect to the Internet, new user agent strings appear on the Search tab, but are not parsed into recognized browsers or platforms until that job runs.

Once a string has been parsed and recognized, future requests originating from that browser or platform are added to application reports without the overnight delay.

Traffic originating from unsupported browsers or platforms may not appear in application reports because the associated user agent strings are not recognized. In some cases, an unsupported browser or platform that is very closely related to a supported browser or platform may appear as if it were its supported cousin.

Use the Search tab to view data related to browsers or platforms that do not appear on the Browser or Source Platform tabs.

Websense Log Server receives browsing data that includes the user agent header, user name, and source IP address. All requests that share the identical user agent, user, and source IP address during a 60-second period are combined into a single record that provides the total number of requests and the volume of bandwidth associated with those requests. That record is then forwarded to the Log Database.

Log Server holds in memory the user agent information that it combines to create the record sent to the database. If Log Server is restarted while user agent information is held in memory, that data is lost and cannot be recovered. It is expected that user agent strings for the same browser and source platform have been or will be generated so the basic discovery and reporting of browsers or platforms will not be impacted. The total requests and bandwidth, however, will be affected.

If you have set the time period to Today on the Browser or Source Platform page, the Browser Use Trend and Platform Use Trend charts do not show any data. This occurs because the smallest unit of time plotted on the trend chart is one day. Select a longer time period to populate the chart.