application Session Duration report

[NorthernNetGuy]

I'm being asked to generate a report that would show total session duration for specific apps (i.e. youtube), over the course of a given time period.

From the session logs, I see the session duration, but generally it just shows 0:0 or only a few seconds, not the actual session duration used by the client. in some application control logs I see an elapsed time field, but i'm unsure how I woudl compile it, nor know the accuracy of it.

I have all the blades but the QoS blade enabeld, i'm unsure if that would be a requirement to get the desired logs.

any help is apprecitated.

[Alex-]

You should have Accounting enabled for application rules.

[NorthernNetGuy]

I do have accounting enabled for those rules.

 

The best I get for the report is this. The "allowed videos" was a custom application I tried to make to whitelist a specific youtube video for all users that was requested. (kinda works but not the best, app details included in screenshtos)
I don't feel the durations shown are accurate to the actual durations of the users. Has anyone else made such a report?

[Amir_Senn · Accepted solution]

I think that better than session duration is browse time for this.

You can check the following view I created a while ago:

https://community.checkpoint.com/t5/SmartEvent/Browse-Time-Report/m-p/135663#M28

[NorthernNetGuy]

Thats fantastic, I didn't see the browse time attribute.

I'll need to find out if this value will increase if say, youtube is open in a non primary tab/window or minimized. Unsure how the connection and browse time attribute is handled for that.

[NorthernNetGuy]

Unfortunatley after some testing, it looks like the session duration and browse time don't show accurate results. I set up a test client, which viewed youtube from for 30 mintues in the morning, clsoed the browser, and then did 20 minutes in the late afternoon for 50 minutes total time.

Logs show a 4 minute browse time and a 3hr 20min Duration. Were you able to run tests and validate the accuracy of your report? I'm wondering if either I may need to do some configuration changes, or that this type of report isn't something checkpoint can accuratley get.

[Amir_Senn]

Was the Youtube tab open when you tested this?

[NorthernNetGuy]

Yes I had it as the only open tab and application at the time of the test, helping isolate the communications.

[NorthernNetGuy]

After some digging, I belive the Duration is being affected by the "Session Unficiation", which automatically combined all sessions within a certain timeframe into a single session, the default duration is 180 minutes. This means a 10 minute session at the beginning and 10 minutes at the end of the 3 hour period will display as a full 3 hours. 

I'll be looking into modify this attribute to see what results I can get. If anyone has input on this attribute and recommended durations to get accurate logs, it would be appreciated.

[Amir_Senn]

I created a new view for Session Duration Time.

Check it out:

https://community.checkpoint.com/t5/SmartEvent/Session-Duration-Time-View/td-p/220190