Log Server Configuration Utility > Configuring consolidation options

Configuring consolidation options

 

Related topics: Configuring Log Server connections Configuring Log Server database options Configuring log cache files Configuring WebCatcher

Use the Consolidation tab of the Log Server Configuration Utility to enable consolidation and set consolidation preferences.

Note  Managing Log Database size is an important concern in high-volume networks. Enabling consolidation is one way to control database size and growth.

Consolidation decreases the size of your Log Database by combining Internet requests that share the following elements:

Domain name (for example: www.websense.com)

Category

Keyword

Action (for example: Category Blocked)

User/IP address

Reports run faster when the Log Database is smaller. However, consolidating log data may decrease the accuracy of some detail reports, as separate records for the same domain name may be lost.

Important  Enabling consolidation may skew the accuracy of some report data, such as Internet Browse Time calculations.

1.	Check Consolidate Log Records to enable consolidation, which combines multiple similar Internet requests into a single log record.

When this option is deselected, the default, the Log Database retains full hits or visits detail for each Internet request (depending on your selection on the Settings tab, see Configuring log cache files). This provides greater reporting detail, but a larger Log Database.

Selecting this option creates a smaller Log Database with less reporting detail.

Important  To assure consistent reports, consider creating a new database partition whenever you enable or disable consolidation. Also, be sure to generate reports from partitions with the same consolidation setting.

If you have installed Websense Web Security Gateway, scanning activity is always reported as separate hits on the reports that are specific to scanning, even when consolidation is enabled. In this situation, the numbers shown on Web filtering reports that include traffic blocked by scanning will be lower than the numbers shown on scanning reports.

2.	For the Consolidation time interval, specify the maximum time between the first and last records to be combined.

This represents the greatest time difference between the earliest and latest records combined to make one consolidation record.

Decrease the interval to increase granularity for reporting. Increase the interval to maximize consolidation. Be aware that a larger interval can also increase usage of system resources, such as memory, CPU, and disk space.

If you enabled the full URL option on the Settings > Reporting > Log Database page in TRITON - Web Security, the consolidated log record will contain the full path (up to 255 characters) of the first matching site Log Server encounters.

For example, suppose a user visited the following sites and all were categorized in the shopping category.

www.domain.com/shoeshopping

www.domain.com/purseshopping

www.domain.com/jewelryshopping

With full URL active, consolidation would create a single log entry under the URL www.domain.com/shoeshopping.

3.	Click Apply to save any changes, and then use the Connection tab to stop and restart Log Server.

Log Server Configuration Utility > Configuring consolidation options