WebSpy Analyzer Giga 2.2 Getting Started Guide This document is intended to help you get started using WebSpy Analyzer Giga 2.2. For more detailed information, please see the Analyzer Giga online help. This can be accessed via Help | Contents on the main menu. Please send all issues or queries to WebSpy Support (support@webspy.com) WebSpy Analyzer Giga 2.2 Getting Started Guide Table Of Contents Overview ...............................................................................................3 Importing Data.......................................................................................4 Analyzing Data .......................................................................................5 Creating Reports.....................................................................................7 Using Aliases..........................................................................................8 Using Profiles .........................................................................................9 Scheduling Tasks .................................................................................. 11 Summary ............................................................................................ 13 Contact WebSpy ................................................................................. 14 Copyright © WebSpy 2006 page 2 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Overview Thank you for installing Analyzer Giga. This tutorial guides you through Analyzer Giga's main functions to help you get started analyzing and reporting on your Internet and email traffic. These functions include: Importing log data into a storage. Analyzing the data in your storage. Reporting on the data in your storage. Using aliases. Using profiles. Creating tasks to schedule common actions. Throughout this tutorial you will notice Show Me! items followed by a URL. Enter this URL into your web browser to view a video demonstration of the process. This guide uses an example Microsoft® Proxy log file to demonstrate the processes of importing and analyzing data. Once you are comfortable with these processes, please try importing and analyzing your own log files. Copyright © WebSpy 2006 page 3 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Importing Data To start using Analyzer Giga, you need to import the log files you wish to analyze. Analyzer Giga imports your log files into a file called a storage. Try this: Import a log file into a storage: 1. Select Views | Storages on the main menu or click the Storages Sidebar icon. 2. Click the Import log files link in the Files task pad to launch the Import Wizard. Click Next on the first page of the wizard. 3. On the Storage page, select the 'Create a new storage for your log files' radio button and give the storage the name 'My Storage' by entering this into the edit box. Click Next. 4. On the Input Format page, select the 'Microsoft Proxy' radio button in the list of supported log file formats. Click Next. 5. On the Input Location page, click the Add button and select File from the drop down menu. This launches an Open dialog at your default log file location (specified in Location Options). By default this is My Documents\WebSpy\\Logs. 6. When you installed the application, an example log file was installed to your default log location called 'Example.log'. Select this log file using the Open dialog and click Open. Click Next on the Input Location page. 7. Click Next on the Selection page without checking any check boxes. 8. On the Final page of the Import Wizard, ensure the 'Import hits from selected files or folders' checkbox is checked and click Finish. This begins the importing process. Show me! http://www.webspy.com.au/links.aspx?Page=0521 Log files can take a while to import depending on the amount of data they contain. You can click the Stop button on the toolbar to stop loading the log files at any time. To resume the loading, click the Import new hits link in the Files task pad. After the import is complete, the imported log files are listed in the Storages Screen. If an issue is encountered when importing a log file, those logs are displayed in red. You can review these issues at any time using the Review log file issues link in the Files task pad. To import your own log file data, simply choose your log file format in step 4 (Such as Cisco, or Microsoft ISA Server), and navigate to the location of your logging devices log files in step 5. Once you have imported some log files, you can analyze your data in Summaries, create reports, and use aliases and profiles to retrieve useful information from your log files. Copyright © WebSpy 2006 page 4 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Analyzing Data To view and analyze the data in your storage, you need to run an analysis in Summaries. Running an analysis is the process of reading the information in your storage and creating Summaries. Summaries can be interactively browsed enabling you to drilldown into all areas of your organization's activity. Try this: Run an analysis: 1. Select Views | Summaries from the main menu, or click the Summaries Sidebar icon. 2. Click the Run analysis link in the Summaries task pad to launch the Analysis Wizard. Click Next on the first page of the Analysis Wizard. 3. On the Select Analysis page, select the 'Full Analysis' radio button and click Next. 4. Check the checkbox next to the storage 'My Storage' that you created in the previous topic. Click Next. 5. Click Next on the Selection page without checking any checkboxes. 6. On the Final page of the Analysis Wizard, click Finish to begin the analysis. Show me! http://www.webspy.com.au/links.aspx?Page=0522 During the analysis Analyzer Giga generates a list of Summaries. This may take some time depending on the size of your storage. Once an analysis has been run, the Overview screen is displayed. All the Summaries that were generated during the analysis are displayed as hyperlinks down the right side of the screen. View the complete list of summaries. Clicking a summary hyperlink displays the full summary. This includes the list of items for the summary, along with aggregate columns such as hits, incoming and outgoing size, and browsing time. Try this: Click the 'Sites' summary to display all the web sites that have been visited along with the number of hits to each web site, and the browsing time for each site. Once you have clicked a summary, you will notice that each Summary item is also hyperlinked. Clicking one of these hyperlinks will calculate all the summaries specific to that Summary item. This process is called 'drilling down'. You can specify the summary you want to view by rightclicking an item, selecting Drilldown from the pop-up menu, and choosing the desired summary. Try this: Right-click a web site name, select Drilldown from the pop-up menu, and select Users from the sub-menu. All the users that visited that web site are now displayed. You can continue this process to drilldown into any area of your organization's activity. Hint: Some drilldowns can take some time to generate. Drilling down first into periodical summaries like 'Dates', 'Days' and 'Weeks' reduces the number of periods analyzed and improves drilldown time. The Location bar at the top of the screen displays your drilldown path to help you keep track of where you are. Each part of the drilldown path is hyperlinked, so you can quickly return to any previous level. The location bar can be dropped down to select a different summary at the current level. Try this: Using the Location bar: 1. Go back to the Overview screen by clicking the 'Summaries' hyperlink in the Location bar at the top of the screen. 2. Drilldown into the Protocols summary by clicking the 'Protocols' hyperlink. 3. Right-click a Protocol and select Drilldown | Users from the pop-up menu to display the users that used that Protocol. Copyright © WebSpy 2006 page 5 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide 4. View the dates the Protocol was used by dropping down the Location bar at the top of the screen and selecting 'Dates' from the list. You can also use the up and down arrow buttons on the toolbar to go up a level or drilldown into a selected item. Show me! http://www.webspy.com.au/links.aspx?Page=0523 Copyright © WebSpy 2006 page 6 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Creating Reports Analyzer Giga enables you to generate printable and online reports which you can distribute, print or archive. Try this: Generate a report: 1. Select Views | Reports from the main menu, or click the Reports Sidebar icon. 2. Click the Generate a new report link in the Reports task pad to launch the Report Wizard. Click Next on the first page of the Report Wizard. 3. On the Report Type page, select the 'Template Report' radio button. Click Next. 4. On the Storages Page, check the checkbox next to the storage 'My Storage' that you created in the topic Importing Data. Click Next. 5. The Templates page lists all the pre-defined reports that come with Analyzer Giga. Select the 'Organization' radio button, ensure the 'Edit Template Settings' checkbox is un-checked and click Next. 6. Click Next on the Selection page without checking any checkboxes. 7. The Document Format page lists all the report formats you can choose from. Select the 'Web Document (HTML)' radio button and click Next. 8. On the Publish page, ensure the report document has a name (it should default to the name of the template, in this case 'Organization'). Check the 'Display the report using the default viewer' checkbox and leave all other checkboxes unchecked. Click Next. 9. On the Final page of the Report Wizard, click the Finish button to generate the report. Analyzer Giga then generates the report and displays it using your default Internet browser. Use the navigation tree to the left of the report to view the report's various sections. Show me! http://www.webspy.com.au/links.aspx?Page=0524 You can create other types of reports such as Comparison Reports (where you can specify up to four drilldowns), and Session Based reports (how long have users been browsing) using the Report Wizard. You can also edit any of the pre-defined report templates using the Templates View. Tip: Some reports can take a long time to generate. You can reduce this time by filtering your data. For example, instead of reporting on all users and all sites, filter the report by top 20 users and top 50 sites. Copyright © WebSpy 2006 page 7 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Using Aliases Aliases enable you to define an alternative name for a data item or group of data items, which you can choose to display when viewing your data in Summaries or Reports. Aliases can be used translate names or IP addresses into a more useful form. This means that a user's or web site's name can be viewed instead of its IP address, or a type of file rather than the file extension. For example, 'Bob Smith' will be displayed instead of '192.168.0.213', or 'image file' instead of '.gif'. Analyzer Giga comes with a list of aliases that you can use for common reporting requirements, including: Usernames Departments Files Sitenames Browsing Try this: Applying aliases in Summaries: 1. Go back to the Summaries View by selecting Views | Summaries from the main menu, or by clicking the Summaries Sidebar icon. 2. Ensure you have an analysis run and drilldown to the Extensions summary. 3. Select the 'None' radio button in the Aliases task pad. All the file extensions in your storage are displayed such as .gif, and .exe. 4. Now click the 'Files' radio button in the Aliases task pad. All the file extensions are now grouped into File Types such as 'Image File' and 'Web Document'. View the users that have downloaded script files by right-clicking the 'Script File' item and selecting Drilldown | Users from the pop-up menu. Show me! http://www.webspy.com.au/links.aspx?Page=0525 You can add Summary items to aliases when browsing your data on the Summaries View. Try this: Adding a user to the Usernames alias from Summaries: 1. Ensure you are on the Summaries View and an analysis has been run. 2. Drilldown to the Users summary. 3. Right-click a user in the list and select Add to alias... from the pop-up menu. Tip: By holding down the Shift and Ctrl keys, you can select multiple items and group them into the one alias. 4. Select the 'Usernames' alias from the 'In alias:' drop down list. In the 'As' edit box, enter 'John'. Click OK. 5. Select the 'Usernames' radio button in the Aliases task pad. You will notice that the user you aliased is now displayed as 'John'. You can also manually add items to aliases as well as import users and departments from your domain controller on the Aliases View. Show me! http://www.webspy.com.au/links.aspx?Page=0526 Copyright © WebSpy 2006 page 8 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Using Profiles Profiles are used to categorize the Internet resources accessed by members of your organization. A profile is a collection of keywords that are matched against the names of web sites and downloaded Internet resources, as well as email subject lines. A hit that does not contain any keywords will be assigned to the 'Miscellaneous' profile. You can view the results of profile matching by drilling down into the Profiles Summary on the Summaries View. You can also select the Profiles summary when creating reports. Try this: Viewing Profiles in Summaries: 1. Ensure you are on the Summaries View and an analysis has been run. 2. Drilldown into the Profiles Summary. This summary shows how many hits in your storage were categorized into each profile. Included in this list is the Miscellaneous Profile that contains all the hits that did not match any profile. 3. Right-click the Search Engines Profile and select Drilldown | Sites from the pop-up menu. This summary displays the Search Engine web sites that have been used. 4. Go back up to the Profiles summary by clicking the Up arrow on the toolbar. 5. Right-click the Web Mail Profile and select Drilldown | Users from pop-up menu. This summary displays all the users that have been using Internet email sites. 6. View the Internet email sites that these users visited by selecting the Sites summary from the Location drop down bar at the top of the screen. Show me! http://www.webspy.com.au/links.aspx?Page=0527 You can also maintain the list of keywords in your profiles to more accurately reflect your organization's browsing habits. Try this: Maintaining Profiles: 1. Ensure you are on the Summaries View and an analysis has been run. 2. Drilldown into the Profiles Summary. 3. Right-click the Miscellaneous Profile and select Drilldown | Sites from the pop-up menu. This summary displays all the web sites that did not get categorized into a Profile. 4. Right-click one of these web sites and select Include in profile... 5. In the 'Include' edit box, edit the site and remove characters like 'www' and '.com' so that you have a keyword that can be used for matching any URL. For example, adding the keyword 'google' to a profile will categorize hits to 'www.google.com' as well as hits to 'images.google.com'. Whereas adding the keyword 'www.google.com' will only categorize hits to 'www.google.com'. 6. Select the Profile you want to add the keyword to from the Profile drop down list. Alternatively, you can create a new profile by entering the name of the Profile in this list. 7. Click OK. Show me! http://www.webspy.com.au/links.aspx?Page=0528 For any changes made to your profiles or keywords to be reflected in Summaries, you need to re-run the analysis or run a new analysis in Summaries. You can also view the why some hits are being categorized into a profile using the Individual Hits Summary. This is useful for maintaining your list of keywords so that URLs are not incorrectly categorized. Try this: View keyword matching using the Individual Hits Summary: 1. Ensure you are on the Summaries View and an analysis has been run. 2. Drilldown into the Profiles Summary. 3. Right-click the Sports profile and select Drilldown | Individual Hits from the pop-up menu. All the hits that were categorized into the Sports profile are displayed. Copyright © WebSpy 2006 page 9 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide 4. Ensure the Site/Recipient and Resource/Subject fields are shown by clicking the Choose columns link in the Advanced Task pad and checking the 'Site / Recipient' and 'Resource / Subject' checkboxes. Click OK. 5. You will notice that some of the text in the Individual Hits summary is bold. The bold text indicates the keyword that was matched to categorize the hit into the Sport profile. Show me! http://www.webspy.com.au/links.aspx?Page=0529 If you notice a hit that has been incorrectly categorized, you can ensure it is excluded from that profile by adding an 'excludes' keywords to the profile on the Profiles View. You can edit your Profiles and list of include and exclude keywords using the Profiles View. Copyright © WebSpy 2006 page 10 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Scheduling Tasks Analyzer Giga enables you to schedule the following actions to execute at a later time: Import into new or existing storages. Reload all hits in an existing storage. Split a storage. Import Windows Users. Resolve IP addresses. Run a report. This is especially useful for dealing with large amounts of data as you can set the task to run overnight. Note: To schedule tasks within Analyzer Giga, you need to have Windows® Scheduled Tasks installed and running. One of the most common tasks you want to schedule is importing data and running a report on that data. Try this: Schedule a task to import data and run a report each day: A. Name the Task: 1. Select Views | Tasks from the main menu, or click the Tasks Sidebar icon. 2. Click the New task dialog link on the Tasks task pad. This launches the Task Properties dialog. 3. On the General Tab, enter 'Daily Import and Report Task'. B. Schedule the Task: 1. Click the Schedules tab and click the Add button on the toolbar. This launches the Schedule Wizard. Click Next on the first page of the Schedule Wizard. 2. Select the 'Daily' radio button and click next. 3. On the Daily page set the 'Start date' to tomorrows date, and the 'Start time' to 01:00:00 AM. Also set 'Perform this task every 1 day(s)'. Click Next. 4. When the task runs, it will run as the user you are currently logged in as. Enter your Windows login password in both the 'Password' and 'Confirm Password' edit boxes. Click Next. 5. On the Final Page of the Schedule Wizard click Finish to add the schedule. C. Add Actions to the Task: Import Action: 1. Click the Actions tab and click Add | Import log files into new storage on the toolbar. This launches the Import Wizard. Click Next on the first page of the Import Wizard. 2. On the Storage page, name the storage 'Daily Storage' and check the 'Prefix with the current date' checkbox. This ensures that each time the import runs, a new storage with a unique name is created rather than over writing the same storage each time. Click Next. 3. On the Import Format page, select Microsoft Proxy and click Next. 4. Click Add | Folder on the toolbar to launch a folder browser dialog. Navigate to your logging devices log file location. Alternatively, you can import the example log file that comes with Analyzer Giga by navigating to My Documents\WebSpy\Analyzer Giga\Logs and click OK. 5. On the Folder Properties dialog ensure the 'Use this folder when importing new hits' checkbox is checked as well as the 'Search this folder for new files when importing new hits' checkbox. Uncheck the 'Search subfolders for files checkbox, and select '*.log' as the file Mask. Click OK. 'Example.log', or your logging devices log files should appear on the Input location page. Click Next. 6. If you are importing the example log (see step 4), click Next on the selection page without checking any checkboxes. Otherwise, check the 'Select dates' checkbox. Click Next. Copyright © WebSpy 2006 page 11 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide 7. Skip this step if you are importing the example log (see step 4). On the Select Dates page, select/enter 'Show Past 1 Days'. This limits the import to only get yesterday's data. Click Next. 8. On the Final page of the Import Wizard, click Finish to add the import action. Report Action: 1. On the Actions tab of the Task Properties dialog, click Add | Run a report on the toolbar. This launches the Report Wizard. Click Next on the first page of the Report Wizard. 2. On the Report Types page, select the 'Template Report' radio button. Click Next. 3. On the Storages page, check the checkbox next to the '[date] Daily Storage' storage. Each time this report action runs, the report will be run on the storage with the date prefix that matches the current date. Click Next. 4. On the Templates page, select the 'Organization' radio button and un-check the 'Edit Template Settings' checkbox. 5. Click Next on the Selection page without checking any checkboxes. 6. On the Document Format page, select the 'Web Document (HTML)' radio button and click Next. 7. On the Publish page, ensure the report document has a name (it should default to the name of the template, in this case 'Organization'). Check the 'Prefix with the current date' checkbox and leave all other checkboxes unchecked. This ensures that each time the task runs, a new report with a unique name is created, rather than overwriting the existing report each time. Click Next. 8. On the Final page of the Report Wizard, click the Finish button to add the Report Action. 9. Click OK on the Task Properties dialog to add the new task. Once you have added the task, it is a good idea to check that it works. Try this: Run the Task Manually: 1. Ensure you are on the Tasks View by selecting Views | Tasks from the main menu or clicking the Tasks Sidebar icon. 2. Right-click the 'Daily Import and Report Task' in the Task and select Run from the pop-up menu. The import action runs first then the report action runs. The results of each task action are displayed in the Tasks View. Show me! http://www.webspy.com.au/links.aspx?Page=0530 If your task runs correctly, then you can be confident that it will run at the scheduled time as desired. Copyright © WebSpy 2006 page 12 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Summary This concludes the Analyzer Giga Quick Start Tutorial. You should now have a good idea how to import, analyze and report on your data. If you have further questions, please consult the help file for more detailed information on each area of the application. You can access the help file by selecting Help | Contents from the main menu, or by pressing F1 from anywhere within the application. If you still have trouble getting started or would like to purchase this application, please visit www.webspy.com for support and contact information: Copyright © WebSpy 2006 page 13 of 14 WebSpy Analyzer Giga 2.2 Getting Started Guide Contact WebSpy WebSpy North America (Servicing North and South America) Suite 202 137 7th Ave West Kirkland, Washington 98033 Toll free: 888-862-4403 Phone: +1 425-828-4400 Fax: +1 425-828-7115 Email: sales@webspy.com WebSpy Europe (Servicing Europe, Middle East and Africa) 3rd Floor, Unit 19 Angel Gate 326 City Road London, EC1V 2PT Phone: +44 (0) 207 239 7500 Fax: +44 (0) 207 239 7539 Email: europesales@webspy.co.uk WebSpy Australia (Servicing Australia, Asia and the Pacific) Level 3 Mercury House 33 Richardson Street West Perth, Western Australia 6005 Toll Free: 1800 801 121 Phone: +61 8 9321 3322 Fax: +61 8 9321 3377 Email: sales@webspy.com.au WebSpy Support To contact WebSpy Support, please email support@webspy.com Copyright © WebSpy 2006 page 14 of 14