topic Re: application Session Duration report in Firewall and Security Management

application Session Duration report

NorthernNetGuy — Fri, 28 Jun 2024 13:22:44 GMT

I'm being asked to generate a report that would show total session duration for specific apps (i.e. youtube), over the course of a given time period.

From the session logs, I see the session duration, but generally it just shows 0:0 or only a few seconds, not the actual session duration used by the client. in some application control logs I see an elapsed time field, but i'm unsure how I woudl compile it, nor know the accuracy of it.

I have all the blades but the QoS blade enabeld, i'm unsure if that would be a requirement to get the desired logs.

any help is apprecitated.

Re: application Session Duration report

Alex- — Fri, 28 Jun 2024 14:39:36 GMT

You should have Accounting enabled for application rules.

Re: application Session Duration report

NorthernNetGuy — Fri, 28 Jun 2024 15:00:35 GMT

I do have accounting enabled for those rules.

The best I get for the report is this. The "allowed videos" was a custom application I tried to make to whitelist a specific youtube video for all users that was requested. (kinda works but not the best, app details included in screenshtos)
I don't feel the durations shown are accurate to the actual durations of the users. Has anyone else made such a report?

Re: application Session Duration report

Amir_Senn — Sun, 30 Jun 2024 15:59:17 GMT

I think that better than session duration is browse time for this.

You can check the following view I created a while ago:

https://community.checkpoint.com/t5/SmartEvent/Browse-Time-Report/m-p/135663#M28

Re: application Session Duration report

NorthernNetGuy — Tue, 02 Jul 2024 13:01:01 GMT

Thats fantastic, I didn't see the browse time attribute.

I'll need to find out if this value will increase if say, youtube is open in a non primary tab/window or minimized. Unsure how the connection and browse time attribute is handled for that.

Re: application Session Duration report

NorthernNetGuy — Tue, 09 Jul 2024 19:33:10 GMT

Unfortunatley after some testing, it looks like the session duration and browse time don't show accurate results. I set up a test client, which viewed youtube from for 30 mintues in the morning, clsoed the browser, and then did 20 minutes in the late afternoon for 50 minutes total time.

Logs show a 4 minute browse time and a 3hr 20min Duration. Were you able to run tests and validate the accuracy of your report? I'm wondering if either I may need to do some configuration changes, or that this type of report isn't something checkpoint can accuratley get.

Re: application Session Duration report

Amir_Senn — Wed, 10 Jul 2024 07:57:50 GMT

Was the Youtube tab open when you tested this?

Re: application Session Duration report

Amir_Senn — Wed, 10 Jul 2024 08:24:47 GMT

I created a new view for Session Duration Time.

Check it out:

https://community.checkpoint.com/t5/SmartEvent/Session-Duration-Time-View/td-p/220190

Re: application Session Duration report

NorthernNetGuy — Wed, 10 Jul 2024 12:25:43 GMT

Yes I had it as the only open tab and application at the time of the test, helping isolate the communications.

Re: application Session Duration report

NorthernNetGuy — Wed, 10 Jul 2024 15:36:59 GMT

After some digging, I belive the Duration is being affected by the "Session Unficiation", which automatically combined all sessions within a certain timeframe into a single session, the default duration is 180 minutes. This means a 10 minute session at the beginning and 10 minutes at the end of the 3 hour period will display as a full 3 hours.

I'll be looking into modify this attribute to see what results I can get. If anyone has input on this attribute and recommended durations to get accurate logs, it would be appreciated.