Custom Reports Overview

Custom Reports Overview

Use the Custom Report page to create or edit a report. Enter the Report Name, Description and Owner. For Report Type, if Demand is chosen, select the Date Range. For Scheduled Reports, select the Interval and Start Date and for Continuous Reports, choose the Interval.

·       Demand Reports are run once and are usually used to run searches or one-time reports.

·       Scheduled Reports are like Demand Reports but are run periodically. These reports are usually used to process weekly or monthly summary reports.

·       Continuous Reports are also run regularly, like Scheduled Reports, but the data is compiled, cumulatively, into one report. They are usually used to generate data for graphs that show high-level usage over a period of time.

Filters: Use this section to add one or more filters for your Report. Filters are optional for Reports and allow you to restrict included data to that which matches your filter. Select the field you wish to filter and one or more conditions and their values. You can also load filters from existing Reports.

Report Output: There must be at least one report output option added to the report. This section determines the content that will be displayed in the report. Each output type allows you to add one or more Presentation and can be sorted by any fields that are included.

·       Add Summary Group: Summary groups can be used to group related data together and show results for each grouping. You can add summary fields such as total requests or if no fields are selected, they can be used to group data for subsequent groups.

·       Add Top Estimation: Top Estimation uses a reporter algorithm to reduce the time to generate reports like 'Top 10 Denied URLs' making reports work much faster without requiring temporary space. These reports show the same type of information as summary groups; however, they are always added as the final output and there can only be one.

·       Add Report Details: Report Details shows each individual request (excluding those removed by the report filters). These detail reports are only available as tables and will appear as the final output and therefore be grouped by any summary groupings that are present.

Delivery Options: Use this section to choose how you want your Reports emailed. You can specify how to handle empty reports and you can also set conditional sending settings that will only send reports when certain conditions are met. Delivery Options are not available for Continuous Reports.

Additional Custom Report Settings

Custom Report Settings

The Settings icon at the top opens the ‘Settings’ window. It allows you to set the Report’s Language, Timezone, Paper Size, Expiry Time, Show Static Filter, Domain Definitions, Average Page Browsing Time, and Run Only on Servers.

Option

Description

Report Language

This displays the Account Language. This field cannot be edited.

Report Timezone

Each Lenovo NetFilter Report can have its own timezone setting that affects only that report. By default, this is the current operating system timezone. See 'Timezones' documentation for more information.

PDF Document Paper Size

You can choose from letter, legal, A3, A4 and A5.

Report Instances Expiry Time

The default for this setting is 0 which means that the report does not expire. You can use this setting to set the number of days until the Report is deleted.

Show Static Filter

Enabling this option will display the static filters in the filter section. The static filters will display above filters added by the user and cannot be removed or edited.

Domain Definition

See ‘About Domain Definitions’ below.

Average Page Browsing Time

This setting is used in conjunction with ‘Online Time Estimation’. By default, this is set to 10 seconds. This is approximate amount of time that users spend on a given web page or for one request.

Run Only on Servers

This option lets you restrict the Reporter servers that can process a Report. A Restricted Reporter will not run any Reports unless specified in the ‘run only on servers’ field. It displays when there are more than one remote Reporter and the when the ‘Restricting a Reporter’ option is enabled in the Reporter Settings page under the Servers tab. See “Run only on Servers’ below.

About Domain Definitions

The Reporter can extract only part of the host name (e.g. the two upper levels domains). It treats host names such as ‘www.company.com’, ‘mail.company.com’, ‘sales.company.com’ as one common name: ‘company.com’.

The ‘Edit Domain Definitions’ section offers a way to specify definitions for this "Domain of URI" part of the host name.

By default, ‘Domain of URI’ in the Custom Reports is the last two domain names (two upper-level domains). However, when larger companies register their names in different national domains, some of the host names don’t comply with this "two upper-level domain" rule. As an example, Google has domain names ‘google.ca’ in Canada and ‘google.de’ in Germany. However, it also has ‘google.co.uk’ in the United Kingdom and ‘google.co.jp’ in Japan.

Use one of the options below.

Domain List File and Custom List:

Use a list of domains from the file supplied with Reporter. It contains all the popular domains (e.g. com, net, ca, on.ca, co.uk, etc.). Use your own list of exceptions from the "two upper level domain" rule. An exception is a two or more level domain that should be treated as a single solid top-level domain (e.g. co.uk or on.ca).

Domain List File and Custom List: This option combines the ‘Domain List File’ option and the manually filled in exceptions for the ‘Custom Domain List’ field.

Regular Expression: Extract the part of the host name with the specified regular expression. This option offers the most flexible way to extract information in that it can extract three or more upper domain parts or a single name from the middle of the host name.
Regular Expression examples:
[^.]*\.[^.]*$ - Second Level Domain
[^.]*\.[^.]*\.[^.]*$ - Third Level Domain
[^.]*\.[^.]*$|[^.]*\.(co|gov)\.[^.]*$ - Third Level Domain for addresses like *.co.* or *.gov.* and Second Level Domain for others
/([^.]*)\.[^.]*$/\1/ - Extract only second part of Domain

Modify Definition

Use the Modify Definition window to copy or modify the Report definition. This page can display the filters, groupings, presentation options, timezone, language, and email thresholds.

Run Only on Servers

The ‘Run only on Servers’ option lets you restrict the Reporter servers that can process a Report. By default, it will run on any non restricted servers, if you select all servers it will run on any server, and if you select specific servers it will run on only those servers.

This option displays in the ‘Settings’ window of Custom Reports, Create Reports or Report Templates when there are more than one remote Reporters.

The field displays a dropdown list of Reporters and allows you to restrict the Reporter servers that can process a Report.

A Restricted Reporter will not run any Reports unless specified in the ‘Run only on servers’ field.

Restricted Reporters

The 'Run Only on Servers' display when the ‘Restricted’ option is enabled in the Reporter Settings page under the Servers tab.

Go to Administration > Services and expand your WebAdmin Server.

Select Global Reporter Settings from the Reporter dropdown.

Click the Edit link beside the Reporter Server you wish to 'Restrict'.

In the Edit Server window, place a checkmark beside the Restricted option and click Submit,

The Reporter is now marked with the Restricted X.

Custom Report Name, Description, Type, and Owner Section

At the top of the Custom Report window, enter the Report Name and Owner as well as the Report Type.

Owner

The Owner dropdown displays a list of available Accounts. You can assign the Report to one of these SysOp or Admin Accounts or you can set the Report so that anyone can view it. By default, the Report is assigned to Admin.

Report Type

There are three Report Types. The Report Type chosen dictates additional settings such as Date and Interval.

Demand Reports are run once and are usually used to run searches or one-time reports. When Demand Report is chosen you can also assign a ‘Date Range’.

Scheduled Reports are like Demand Reports but are run periodically. These reports are usually used to process weekly or monthly summary reports. When Scheduled Report is chosen, you can also choose an Interval and a Start Date.

Continuous Reports are also run regularly, like Scheduled Reports, but the data is compiled, cumulatively, into one report. They are usually used to generate data for graphs that show high-level usage over a period of time. When Continuous Reports are chosen, you can assign an Interval.

Filters Section

Use this section to add one or more filters for your Report. Filters are optional for Reports and allow you to restrict included data to that which matches your filter. Select the field you wish to filter and one or more conditions and their values. You can also load filters from existing Reports.

Add Filter

In ‘Add Filter’ select the field you wish to filter by. The ‘Condition’ and ‘Value’ fields display.

Filter Field Descriptions

Some of the fields below are not enabled by default. If you do not see a field, go to Reports Settings section of WebAdmin Settings and select the fields.

Option

Description

Date

The Date filter is only available when creating Demand Reports. It includes requests that occurred during the time you specify and filters out all others. When entering the date, use the format shown on the screen or click the calendar icon to select a date from the calendar. Each Demand report should have a Date filter. By default, a filter for the previous day is automatically assigned.

Since logs are not stored forever, the report cannot include data from dates that are no longer stored in the logs.

Time Interval: Time of Day

Condition options include: Equal to, Less Than, Less Than or Equal To, Greater Than or Equal To, Greater Than, Not Equal To, and Between. The ‘Value’ displays the ‘Relative Time’ in seconds.

Time Interval: Week Day

This option can be used to include data that was logged after, before, or on a specific day or between two days during the week. Condition options include: Equal to, Less Than, Less Than or Equal To, Greater Than or Equal To, Greater Than, Not Equal To, and Between. Choose from the ‘Value’, the day of the week.

Time Interval: Month Day

This option can be used to include data that was logged after, before, or on a specific day or between two days during the month. Condition options include: Equal to, Less Than, Less Than or Equal To, Greater Than or Equal To, Greater Than, Not Equal To, and Between.

Client IP Address

Every computer on your network is assigned a unique IP address. In most cases, each computer on the filtered network uses a static IP address, which means each computer is always assigned to the same IP address. The IP Address filter is most useful when specifying a range of IP addresses.

For example, a department in your organization has four computers connected to the network. The IP addresses of these computers are 192.168.2.45, 192.168.2.46, 192.168.2.47, and 192.168.2.48. If you want to include only requests from this department, add 192.168.2.45 in the from field and 192.168.2.48 in the to field. Please note that the addresses provided are for example purposes only.

You can enter a netmask length. e.g. 192.168.4.0/24 in the 'from' field. It allows you to specify a group of IP addresses in a single field.

If you want to include several users that don't have sequential IP addresses or you do not know the users' IP addresses, use the Client Name or Group Policy filters instead. Some deployments may use dynamically assigned IP addresses (users are assigned a new IP address each time they connect to the network) using DHCP along with some form of external authentication. These deployments should also use the Client Name filter instead of the IP Address filter.

Destination IP Address

Enter the remote server IP address.

You can enter a netmask length. e.g. 192.168.4.0/24 in the 'from' field. It allows you to specify a group of IP addresses in a single field.

Client Name

 

The Client Name is the name that you (or another Lenovo NetFilter administrator) have assigned to a user. You can enter multiple Client Names in this field, separated by commas and no spaces. For example:user1, user2, user3, user4

Each Client belongs to a Group. Select Clients from the Policies menu to view the Client Names assigned to you. Note that not all administrators have the necessary permissions to access the 'Clients' window.

If you want to include an entire Group (or several Groups), use the Policy Groups filter instead.

Policy Group

The Policy Groups filter includes only the requests made by users (Clients) in the Group you specify. Groups can contain more than one Client. To include an entire Group in the report (and exclude all others), enter the name of the Group in the Policy Groups filter, separated by commas with no spaces. For example: group1, group2, group3

Policy Name

(Optional)

This field is used for reporting on the Policy Name in a Group.

 

URI

Each web request is identified by a Uniform Resource Identifier (URI). The URI is the full address that appears in the address bar of your browser whenever you visit a web site. When you enter a URI (or several URIs) in this filter, the URI is included in the report and requests to all other URIs are excluded.

A URI identifies a specific page at a web site, not the entire web site. For example, http://www.netfilter.lenovo.com/Contact is a different URI than http://helpdesk.netfilter.lenovo.com

If you wish to include all the pages at a web site (such as netfilter.lenovo.com), use the Host filter instead.

Host of URI

Unlike URLs, hosts can house multiple web resources, such as an entire web site; not just a single web page. To include requests to all URLs that have the same host, enter the host in the Host filter. You can enter multiple hosts, separated by commas with no spaces. For example:

http://example1.com,http://example2.co.uk,http://example3.ca

Domain of URI

Enter the domain of the URI you wish to filter by. You can enter multiple hosts, separated by commas with no spaces. See ‘Edit Domain Definitions’ section below for more information.

Search Terms

Use this field to parse and determine search keywords and search terms that customers are using. Search term filtering and grouping is case insensitive. If you wish to search for a plus sign (+) specifically, use the encoded value %2B.

Denied Flag

The Denied Flag indicates whether the request was denied. “Yes” if the request was denied and ‘no’ if it was not. The Denied Flag filter can be used to include Only Denied Requests or Only Allowed Requests. By default, All Requests are included in the report unless you change this filter.

Denied Categories

This will filter for denied Categories only. To apply this filter, choose the Edit button and select the Categories you want to include. Note that if no Categories are selected, this filter is not applied, and all categories are included in the report. See ‘All Categories’ below.

All Categories

 

This will filter for all Categories logged for both denied and allowed requests. To apply this filter, choose the Edit button and select the Categories you want to include. Note that if no Categories are selected, this filter is not applied, and all categories are included in the report.

Denied Category Numbers

(Optional)

This will filter for denied Category numbers.

All Category Numbers
(Optional)

This will filter for all Category numbers.

HTTP Method

The HTTP Method can be filtered with this field. It will display the method being performed. There is a dropdown list of possible methods: Not HTTP Request, GET, POST, PUT, HEAD, CONNECT, TRACE, PURGE, and OPTIONS. You can select multiple methods.

User Agent
(Optional)

This is a string to specify the application that is performing the request. For example, Firefox, Chrome, and Internet Explorer have their own User Agent. This is available in Capture Module.

Referrer URL
(Optional)

This is the URL that the request was made from. Clicking a link on any web page will set the referrer to that web page. This is available in Capture Module.

Log File Name Tag

(Optional)

This field can be used in conjunction with the 'Log File Name Tag' set in the Group's General tab. In the Group's page, this option is used to write logs for Groups into the same file. In the Reporter, this field is used to report on Groups listed in this tab.

Policy Event

(Optional)

Policy Events are special tags that allow you to differentiate requests by their Event Type.  

Policy Event Data

(Optional)

The Policy Event Data is a string that can represent different additional information for each Policy Event Type. Currently Policy Event Data is used for Bandwidth, Interim Bandwidth. and Virus Event Types

Module Name (Optional)

The Module Name.

Workstation Name (Optional)

The Workstation Name.

Screenshot (Optional)

The Screenshot/Image.

Protocol (Optional)

This will filter for the Protocol.

Interceptor IP Address

(Optional)

This is the address of the router, proxy cache or client filter that intercepted the request and passed it to the filtering system.

You can enter a netmask length. e.g. 192.168.4.0/24 in the 'from' field. It allows you to specify a group of IP addresses in a single field.

Note: This field (and Policy Server ID) is optional. It has no place in the binary log format. If a Policy Server uses 'extended binary' log format, these fields are not included into records by default. A customer should set special policy server settings to get these fields in log files.

Policy Server ID

(Optional)

This is the ID of the Policy server that processed the request. This ID is used if a deployment includes a few Policy Servers that send request log records to one logger server. In this case, common request logs contain requests processed in different Policy Servers. The Policy Server ID allows you to distinguish requests that were processed by that Policy Server.

Note: This field (and Interceptor IP Address) is optional. It has no place in the binary log format. If a Policy Server uses 'extended binary' log format these fields are not included into records by default. A customer should set special policy server settings to get these fields in log files.

Exclude Range of Values for Report Filters

There is the ability to exclude a range of values for Report Filters. A 'Not Between' operation can be used with all field types that have a 'Between' filter.

Report Data and Date Warnings

When creating reports, the Demand Report will warn if there is no log data

The Scheduled Report warns if the interval is too large for the available log data.

Run Interval Options for Scheduled Reports

There are Run Interval options that display, if enabled, for Scheduled Reports. The Relative Time option is dependent on the time chosen in Run Interval.

These options are enabled by default in WebAdmin Settings:

·       Relative Time

·       Time of Day

·       Week Day

·       Month Day

Time of Day

If 1 Hour is chosen as the ‘Interval’:

The ‘Add Filter’ displays the ‘Relative Time’ with the Hours and Minutes.

Time of Day

If Day is chosen as the ‘Run Interval’ in the Custom Report:

The ‘Add Filter’ displays the ‘Relative Time’ with the Days, Hours and Minutes.

Week Day

If Week is chosen as the ‘Interval’:

The ‘Add Filter’ displays the ‘Relative Time’ with the number of days in the week as well as the Days, Hours, and Minutes.

Month Day

If Month is chosen as the ‘Interval’:

The ‘Add Filter’ displays the ‘Relative Time’ with the number of days in the month as well as the Days, Hours and Minutes.

Load Filters

You can copy filters from one report to another. Select the Load Filters link.

Select the ‘Report Type’ to display the existing Report and copy the filters.

Condition

Once you choose a ‘Field’ in add or edit filter it lets you set a condition’ to specify a string comparison.

These comparisons sort the entries chronologically, numerically, alphabetically and include only the entries that fall in the range you specify. Use the following guidelines when setting advanced filters:

·       2006-12-26 15:41:01 is less than 2007-01-05 03:40:55 because it occurs first chronologically.

·       a is less than b because a occurs first in the alphabet. For example, apple is less than orange and ape is less than apple.

·       IP addresses are typically displayed as four octets in dotted decimal notation (that is, four numbers between 0 and 255, separated by decimals). When comparing IP address, the first octet is compared first, followed by each subsequent octet, as necessary. So, 10.1.1.1 is less than 192.168.2.1 (because 10 is less than 192). and 192.168.2.45 is less than 192.168.2.59

Report Output: Grouping Report Data

Report Output defines how the information in the report is grouped together. You can group data based on the user name, website, or category information using summary groups or show a detailed log of each request using detail groups. Each output type allows you to add one or more Presentations and can be sorted by any fields that are included.

Each report must have at least one Group. A report can use more than one Group in a report, including multiple summary Groups and up to one Report Details Group. However, you can not include multiple detail groups in the same report. In effect, this means you can create multiple reports in a single file. However, reports can get quite large when you include more than one Group.

Types of Grouping Overview

·       Summary groups can be used to group related data together and show results for each grouping. You can add summary fields such as total requests or if no fields are selected, they can be used to group data for subsequent groups.

·       Add Top Estimation uses a reporter algorithm to reduce the time to generate reports like 'Top 10 Denied URLs' making reports work much faster without requiring temporary space. These reports show the same type of information as summary groups; however, they are always added as the final output and there can only be one.

·       Report Details shows each individual request (excluding those removed by the report filters). These detail reports are only available as tables and will appear as the final output and therefore be grouped by any summary groupings that are present.

Summary Groups

Report data can be grouped together using one of the summary fields. Based on the Report Type, other summary fields are available.

The Summary Group is the primary field used for the report. For example, if you select Host of URI, all requests made to a host are counted and displayed. In a table, each host appears as an item in the first column; in a pie chart, each host composes a “slice” of the pie; and in a line or bar graph, each host represents a point on the horizontal axis.

Category Groups Settings

The Denied Categories and All Categories fields in the Reporter Summary Groups page contain drop-down menus that display Category Groups which act as a filter for Categories used for grouping. It drops all Categories that don't belong to the Category Group. The default ‘All Categories’ option means that there is no filtering and it groups the Categories in the usual way. The Summary Groups page allows you to specify the same Category field multiple times if each grouping has a different Category Group. The menu hides groups that are already used from up level grouping.

Add Top Estimation Group

The Top N estimated summary grouping option uses a Reporter algorithm to reduce the time to generate reports like 'Top 10 Denied URLs' making reports work much faster without requiring temporary space. This allows for Top URL reports to be made on terabytes of secure logs.

Use the Add Top N Group link in the Custom Report. Its functions are like the Summary Group option but there are differences:

·       It doesn't allow a ‘nested grouping’ in that you can't add a new level grouping if the Top N group is already chosen.

·       It always sets the Request Count as the Report Field.

·       The Report skips the sorting page because in these reports all records are sorted by the Request Count in descending order.

·       The Presentation page is the same as the Summary Groups’, but it is recommended to limit the number of displayed records. The Custom Report doesn't do it automatically. Without a limit, the Report shows the whole buffer using 2000 entries by default. This default is set in the ‘Buffer Size for fast ‘Top N’ grouping’ found in ‘WebAdmin Settings’. A bigger buffer provides results with better precision but increases memory consumption. The minimal size is 100. The WebAdmin does not validate it but the Reporter replaces small numbers with 100. There is no upper limit for this setting but 2000 provides almost precise results at least for the first 10 entries.

 

See ‘Reporter - Use Cases’ documentation for an example on how to create a Top N Group Report.

Top N Report Performance Tests

The Lenovo NetFilter Reporter in 5.2.3 and above can create Summary Groups using a new algorithm called ‘Top N’ that can take a report processing time from hours to seconds in some cases. This type of reporting grouping is recommended to be used when customer want fast single level summary groups. The best performance increases are for fields with highly variant data. For example, Top URL or Top Hostnames have many different values. However, a very small performance increase would be noticed for Top Categories since there are generally only a few hundred categories. When the field used for a Summary Group has over 5000 unique items, the report performance will tapper rapidly.

Report Details Groups

Report Details grouped reports show each individual request (excluding those removed by the report filters). These detail reports are only available as tables. Since each request is stored in the Request Log as a single entry with seven fields, each of the fields can be included in the report as one of the columns headings in the table.

When selecting these fields, the order in which you select affects the order they are displayed in the report. You can move a field up or down in the ordering by press-and-dragging it up or down in the list of selected fields.

Choosing Summary Group Fields

A Summary Group shows graphs or tables that provide an overview of the data and general trends on your network, not detailed information about each request. When creating your summary Groups, remember that selecting multiple summary Groups can cause your report to grow very large and possibly exceed the maximum report size limit on your server.

Group Data By

The ‘Group Data By’ options are:

·       Client IP Address

·       Destination IP Address

·       Client Name

·       Policy Group

·       Policy Name (Optional)

·       URI

·       Host of URL

·       Domain of URL

·       Search Terms

·       Denied Flag

·       Denied Categories

·       Denied Category Numbers (Optional)

·       All Category Numbers (Optional)

·       All Categories

·       Protocol

·       1 Minute

·       5 Minute

·       10 Minute

·       30 Minute

·       1 Hour

·       2 Hours

·       6 Hours

·       12 Hours

·       1 Day

·       2 Days

·       1 Week

·       1 Month

Fields

The ‘Fields’ options are:

·       Request Count

·       Request Count Percent

·       Requests Allowed

·       Requests Denied

·       Page Count

·       Page Count Percent

·       Pages Allowed

·       Pages Denied

·       File Count

·       File Count Percent

·       Files Allowed

·       Filed Denied

·       Input Bytes

·       Output Bytes

·       Online Time Estimation

Field Descriptions

Once you have decided how to group the data, you can choose from the following fields to include in the report:

Option

Description

Request Count

The total number of requests made by the summary Group.

Request Count Percent

The proportion (percentage) of requests made by the summary Group out of all the requests made.

Requests Allowed

The total number of requests made by the summary Group that were allowed.

Requests Denied

The total number of requests made by the summary Group that were denied.

Page Count

The total number of pages that were requested by the summary Group.

Page Count Percent

The proportion (percentage) of pages that were requested by the summary Group out of all page requests.

Pages Allowed

The total number of page requests made by the summary Group that were allowed.

Pages Denied

The total number of page requests made by the summary Group that were denied.

File Count

 The total number of non-page files that were requested by the summary Group.

File Count Percent  

The proportion (percentage) of non-page files requests by the summary Group out of all non-page file requests.

Files Allowed  

The total number of non-page file requests made by the summary Group that were allowed.

Files Denied  

The total number of non-page file requests made by the summary Group that were denied.

Online Time Estimation

A calculated reporting field that estimates the length of time a specific user, groups of users, IP addresses have spent actively looking at web content.

Show - Category Grouping Type

The ‘Show’ dropdown only displays in the Custom Report if you have Category Filter and a Category Grouping.

Multiple Categories – Show as ‘Unknown Category’

If ‘Show as ‘Unknown Category’ is selected and there are 2 or more Categories such as ‘Pornography’ and ‘Canada’, it will display as ‘Unknown Category’ since the request has multiple Categories. If it is not selected, each Category will be counted and displayed individually for each request. This option only displays if the ‘Show’ option above is available.

Sorting Your Report

Reports can be sorted to appear in many ways. Choose the order that columns and rows appear in a table or the order of items along x-axis in a bar or line graph. The first step in sorting your report is to choose the fields in the report.

Column Sorting

The order you choose the fields in is the order of the columns (in a table) or the order of each item on the x-axis, or horizontal axis, is displayed in (in a 2D or 3D bar graph). Note that line graphs simply use a separate line for each field and pie charts can only include one field.

For example, in the following Detail Group example, the fields DateIP AddressUser, and URI Host were selected in that order. Thus, a table created with these fields has four columns ordered from right to left in that same order. To adjust the order after selecting the field, press-and-drag a field up or down the list in the Report Fields column.

If you are creating a summary Group, you will have to choose one field to Group the information (URI, Host of URI, IP address, User, Policy Group, Category, Denied flag, or a Date Range) before choosing additional fields. This field is always used as the first column in a table or as the x-axis values in a bar or line graph. The remaining summary Group fields are then sorted in the order you select them as shown in the following example:

Row Sorting

The order that rows (in a table) or groups of bars (in a 2D or 3D bar graph) appear in can be sorted alphabetically, numerically, or chronologically, depending on the field. For example, the Client Name field can be used to sort the rows alphabetically, the Date Range fields can sort them chronologically, and the IP address field can sort them numerically.

Each field can be sorted in Ascending or Descending order. When choosing your row sorting, the screen looks similar to this, though the Available Fields will vary.

To sort the rows, select Ascending or Descending beside the field you want to sort by.

For example, if you selected the following fields in order in a summary Group...

·       Requests Denied Ascending

·       Pages Allowed Descending

·       File Count Descending

...the report would be ordered from the highest number of Requests Denied down to the lowest. If two or more groups had the same number of Requests Denied, that block of groups would be sorted from lowest number of Pages Allowed to highest. If two groups had the same number of Requests Denied and Pages Allowed, the one with the lowest File Count would be listed first.

If a tie still exists after all the sorting options are exhausted, the remaining fields are used to break the tie in the order they were selected.

Trend Columns in Scheduled Reports

There is the ability to view the 'trends' between a configurable number of report instances.  The data indicates a trend for the selected Counter through the previous Reports.

Trend Fields

Options

 

Description

Change from Previous
(percent)

 

The Counter shows the relative difference from the previous instance.

Average
(The counter or Percent)

 

The average value among the previous values including the current value.

Change from Average
(percent)

 

The relative change from Average.

Standard deviation

(Counter or Percent)

 

Standard deviation (square root of Variance)

Change to Deviation Rate

 

Change from Average in comparison to the Standard deviation

Linear Regression Slope

 

The slope of the Linear regression line.

Change from Linear Regression
(percent)

 

Change from the calculated trend.

Trend Depth

The number of instances (in a row) used for the trend calculation

Additional Information on Trend Fields

·       Any one of the Trend indicators can be used in conjunction with any Counter or Percent column: Total Requests, Requests Allowed, Requests Denied, Total Pages, Pages Allowed, Pages Denied, Total Files, Files Allowed, Files Denied, Request Percent, Page Percent, File Percent.

·       Although some trend columns use other columns results (e.g. "change from Average in comparison to the Standard deviation") you can specify only the final column and the script implicitly will calculate all needed intermediate results.

·       Any Trend column can be used for rows ordering.

·       The Trend columns should be correctly calculated in any level nested Summary Group but can significantly slow down calculation because of internal structure of multi-level grouped instances. Therefore, it is recommended to use such columns only in the top-level grouping.

Report Presentations

When adding Summary Group or Top N Groupings, you are provided the option of choosing what format the information is presented in. The Reporter has these different presentation formats available:

·       Data Tables

·       Pie Charts

·       2D Bar Graphs

·       3D Bar Graphs

·       Scatterplot

·       Map (only displays if Country Categories are selected in the Summary Group)

Presentation

Click the Add Presentation link in the Summary Group.

Presentation Options

Click the Options link in the Summary or Top N Group page to open ‘Presentation Options’.

Presentation Options allows you to specify display options for each Summary or Top Estimation grouping. Use this page to set the Layout of horizontal or vertical and how you want to handle exported data.

Options

·       Layout: The Layout options for the report dictates whether the report should be horizontal or vertical and whether to display upstanding report data as headings. The layout will be vertical by default unless 'horizontal' is provided. The layout will not display upstanding report data as headers unless 'headers' is provided.

·       Show Group Parent Header: This option only displays if there is a parent group for the Report.  If this is checked, the Parent Group displays before displaying the data for the Child Group.

Exported Data

·       Enable Options for Exported Data: If this option is not enabled all options below are not enabled.

·       Maximum Records: This sets the maximum number of records to display.

·       Other Sum, if checked, will display the sum of all records beyond the maximum number of records.

·       Totals: Select whether to display the Totals row, which sums up the total number (or percentage) of request, pages, or files out of all the records in the report. This option is only available for summary groups.

·       Item Counter: If this is checked the Report will display the number of different Groups within a Summary Grouping. As an example, if there are 23 different Categories in your report, the 'Different Categories' option will display this number.

Tables

Tables are the most common format used for presenting reports and are always available when creating a Scheduled Report or a Demand Report. Selecting the table and modifying its options are the final steps in creating a report Group.

When customizing the tables in your report, you may have some or all the following options:

·       Columns: Select which fields should be used as Columns in the table. By default, all fields in the report Group are selected.

Rows Data

o   Group Details: Select whether the individual Group Details rows should be displayed. Typically, you should leave this option selected. This option is only available for Summary Groups.

Options:

·       Maximum Records: Limit the number of records in the report by selecting Display. As an example, if 10 is entered, it will show only the top 10 entries in the report.

·       Include parent group column: When this is enabled, the presentation will include the parent group's name for that grouping. This option only displays when there are two parent groups.

·       Clickable URL Fields (when available): Choose whether any URLs listed in the report should be hyperlinks pointing to the actual URL by selecting Clickable URL fields (when available). This field is selected by default.

·       Timeline View (Table Display): This will display a Timeline style of output.

·       Other Sum, if checked, will display the sum of all records beyond the first specified number of records.

Timeline View

A Timeline View option is available with a Table display for Scheduled Reports.

Below is an example of the Timeline Report.

Pie Chart

Pie Charts are useful for comparing a single field in the report. These graphs are only available for summary groups. Each ‘slice’ of the pie is a different color and represents one of the summary groups (this is the IP address, user, Policy Group, category, or denied flag setting that you will select when creating the report.) Pie charts are not available for URI or Host of URI summary groups.

Data

·       Select which Data field to use in the pie chart. Remember, you can create several pie charts, each with a different Data field.

Legend Type

·       Select the Legend Type. The legend is a table used to identify which Group is associated with each slice of the pie. You can choose a legend with or without the numerical values displayed or you can choose to display labels for each slice surrounding the pie chart. In general, ‘Legend Without Values’ is not recommended for large reports. To limit the label display, check 'Hover Text Only'. The Pie Chart will show no labels or values until you hover over a slice.

Options

·       Maximum Records: Limit the number of records in the report by selecting Display first 10 records. That is, show only the top 10 entries in the report. You can also increase or decrease the limit by editing the number in the text box.

·       Explode Sectors: Select Explode Sectors to break up the slices. That is, this option adds some space between the slices so that smaller slices are more easily distinguished from each other.

·       Transparent Colors to display the bars using transparent colors.

·       Other Sum, if checked, will display the sum of all records beyond the first specified number of records.

·       Grouped Categories: Select Grouped Categories to group the Categories by their top-level group. This option only displays if you are using a Category grouping.

Grouped Categories

If Grouped Categories is selected for the pie charts, Categories will be grouped by their top-level group.

When the report is generated, you will see the Report grouped by the top-level Category such as 'Web Content'.

Clicking the pie section will explode the Categories.

Bar Charts

Bar Charts have the following options:

Data

·       Remove or add any Data fields. Each selected field is included as a different colored bar.

Chart Type

Select how each set of bars should be displayed using Chart Type. Options are:

·       Stacked Bars

·       Side by Side Bars

·       Front to Back Bars

Options

·       Maximum Records: Limit the number of records shown in the report by selecting Display first X records. You can also change the number of records the report is limited to by editing the number in the text box. See also ‘Others Sum’ below.

·       Add a Polynomial Trendline to chart the direction of changes in activity. This option is only recommended for Date Range summary groups. You can also edit the order of the trendline.

·       Display a 3D border around each bar. This option helps to make small, hard-to-see bars more visible on the graph.

·       Transparent Colors to display the bars using transparent colors.

·       Others Sum – This is the sum of all results that are listed as ‘Other’ when the option ‘Display first X records’ is used.

3D Bar Chart

3D bar Charts have the following options:

Data

·       Remove or add any Data fields. Each selected field is included as a different colored bar.

Chart Type

Select how each set of bars should be displayed using Chart Type. Options are:

·       Stacked Bars

·       Side by Side Bars

·       Front to Back Bars

Options

·       Maximum Records: Limit the number of records in the report by selecting Display first 10 records. That is, show only the top 10 entries in the report. You can also change the number of records shown.

·       Display Trendline to chart the direction of changes in activity.

·       Transparent Colors to display the bars using transparent colors.

·       Others Sum – This is the sum of all results that are listed as ‘Other’ when the option ‘Display first X records’ is used.

Map Chart

The Map charts icon display for Scheduled and Demand Reports when the Countries Category is used in Summary Groups.

·       Select the Data fields you want.

·       There is only one Legend Type

·       Maximum Records: Limit the number of records in the report by selecting Display first 10 records. That is, show only the top 10 entries in the report. You can also change the number of records shown.

In the map above, each country is coloured to a corresponding value using the gradient shown in the bottom right. The higher the number of requests, the darker the gradient.

Scatter Graphs

Scatter Graphs allow for the display of multiple data fields for a single grouping. To use these charts, you must have at least two fields to display in the chart. One X field is mandatory and multiple Y fields can be selected, however at least one must be selected. The remote reporter will display a table as it currently does not support scatter charts.

Legend Types

·       Legend Without Values

·       Legend With Values

·       Labels With Values

·       Hover Text Only

You can hover over the plot points to view more information.

Delivery Options Section

In the Delivery Options section, you can choose how you want your reports delivered. You can specify how you want to handle empty reports and you can also set conditional sending settings that will only send reports when certain conditions are met.

Email Options

Enter your email address in the Email Address field and the report will be sent as an email shortly after it is processed. If you want to send the report to more than one address, you can enter multiple email addresses, separated by commas with no spaces. For example:

example1@netfilter.lenovo.com,example2@netfilter.lenovo.com

If you leave the Email Address field blank, the report is not emailed but you can still view the report using the WebAdmin.

Email Subject

The ‘Email Subject’ field is optional. If the field is filled in, it will override the default subject line for the Report Email.

Variables for Report Date, Owner and Report Name can be added to the Email Subject line for Reports. You can use %D for Report Date, %O for Owner and %N for Report Name. For the Date option, there are different substitutions depending on the Report Type. For Demand Reports, it just shows the time the Report was made. For Scheduled Reports, it displays the interval (hours, day week, month) for the time/date the report was made.

Email Contents

You can write a message that will be sent when the Report is sent.

In the email contents, you can use the following macros:

·       %N for report name

·       %D for report date

·       %R for link to the report itself

·       %RC and %RT for links to the report in CSV and text formats

Emails Format

How you want the Reports emails can be set under ‘Email Formats’.

·       Email Reports – This is the default option. This HTML based format can be read by most email clients and can contain all table and graph formats.

·       Email Links to Report – The email sent includes only links that you can use to download the report in various formats. The report is served from your Lenovo NetFilter Server.

·       Email Report as Attached XXX File – Attach the report as:

o   Attached PDF

o   Attached HTML (text only)

o   Attached CSV

o   Attached Plain Text

o   Attached XLS

o   Attached GZipped CSV

Empty Reports

Select an Empty Reports option to decide what to do if a report contains no data.

The options are:

·       Do not email the Report – No email is sent to the addresses you entered.

·       Email a Notification about such a Report – Instead of a report, an email is sent that explains that your report was empty.

·       Do not email Reports but email a Notification about empty Reports – This setting overrides all the above settings. Reports are never sent by email, but in the event that an empty report is generated, a notification email is sent.

Sending Conditions

In the ‘Sending Conditions’ section of the ‘Delivery Options, click the Add Condition link to display ‘Email Thresholds’. Use this window to specify a condition or threshold for when the report should be sent. If a condition is set, the Report will only be sent if the condition is true. You can also write a message that will be sent instead of the Report when the condition is true.

Adding a Condition

Click the Condition dropdown to choose from the list.

Set your condition by selecting Greater Than and entering zero in the field. This will mean that any browsing to a site categorized as ‘Pornography’ will send an email when the Report is generated. Click save.

The page displays with the Condition.

 


    • Related Articles

    • Reports Templates

      Report Templates are pre-made reports that can act as a starting point for your reporting needs. Report Templates can be used with the Create Report feature to give you a limited selection of values to be modified for simple Report creation.  Report ...
    • Quick Reports

      Quick Reports displays the available (enabled) Scheduled Report Templates. Each template can be enabled for different enabled frequencies which include daily, weekly, and monthly. Click the Manage Reports button and select the check box beside the ...
    • Policies Overview

      Policy Management Overview What is a filtering policy? A filtering policy is a set of rules or settings that the Lenovo NetFilter Policy Service uses in making decisions about whether requests for Internet content should be allowed or denied. The ...
    • Managing and Modifying Reports

      This document explores how to manage and modify Reports in the WebAdmin. View / Edit / Clone Reports The Reports pages allow you to View, Edit and Clone Reports. Deleting Reports To delete one of more Reports, go to one of the Reports windows, select ...
    • Templates Overview

      WebAdmin, Policy, and Category Templates WebAdmin Template-driven WebAdmin and Policy management allows you to standardize Group settings using Group, Policy, and Category Templates.  Category Templates let you assign specific Categories to a ...