Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Use Reports to Evaluate Internet Activity > Application reporting > How is user agent data collected?
How is user agent data collected?
Web Security Help | Web Security Solutions | Version 7.8.x
Related topics:
*
Application reporting
*
Browser use details
*
Platform use details
The user agent is an HTTP header that web browsers and other web applications use to identify themselves and their capabilities. Your web security software captures and logs user agent data when users browse the Internet. If the user agent data includes browser and platform information, that information is parsed and displayed in application reports.
*
If a browser or platform is installed in your network, but is not used for Internet access, it does not appear in application reports.
*
Because there are no widely-adopted standards for user agent headers, your web security software is not able to identify all Internet-accessing applications.
Some applications, in fact, deliberately disguise their identity in the user agent header in an attempt to avoid detection.
The application browsing data that Websense Log Server receives includes the user agent header, user name, and source IP address. All requests that share the identical user agent, user, and source IP address during a 60-second period are combined into a single record that provides the total number of requests and the volume of bandwidth associated with those requests. That record is then forwarded to the Log Database. How soon browser and platform reports are updated with data about current Internet activity depends on whether a user agent has previously been seen and analyzed:
*
If the user agent corresponds to a browser, browser version, or platform that has not previously been parsed and identified, information about requests from that browser and platform do not appear in application reports until after the nightly Trend job (see Database jobs).
In other words, there is a delay of up to 24 hours before information about new browsers, browser versions, and platforms appears in browser and platform reports.
As a result, the Browser and Source Platform tabs do not initially show any reports after a new installation or upgrade to v7.8.
*
If the user agent corresponds to a browser, browser version, and platform that have previously been parsed and identified, information about requests from that browser and platform appear in browser and platform reports as soon as they are recorded in the Log Database.
Data on the Search tab is not subject to the same delays as the browser and platform reports. User agent strings are available for search as soon as they are recorded in the Log Database. This includes both the strings associated with browsers and platforms, and strings used by other types of web apps.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Use Reports to Evaluate Internet Activity > Application reporting > How is user agent data collected?
Copyright 2016 Forcepoint LLC. All rights reserved.