[squid-users] User browsing time estimate

Much to my dismay, I've got a boss asking for user web-browsing reports from
our Squid cache. I used 'sarg' to give him a general idea of the browsing
patterns, but he wants more specific hours. He wants to know "roughly how
much time has <blank> spent browsing the internet?"

I attempted to explain that we don't really have enough data to produce such
a report - all we know is when someone asked for a webpage, we don't know
how long that person spend reading it. However, upon further discussion it
was decided that we could get a rough estimate by applying a "moving window"
analysis to browsing logs. Basically if a user hits pages roughly every 30
seconds between at 9:05AM and 9:20AM, we could safely assume that he/she was
browsing the internet for ~15 minutes that morning.

If our moving window was 5 minutes, and the user didn't hit any pages after
9:20AM until 11:15AM, we can assume that they stopped browsing at ~9:20, add
15 minutes to their "total time on the internet" report, and then start
accumulating time all over again based on the 11:15 session.

Surely I could sit down and write a Perl log analyzer which makes these
assumptions, but I'm hoping someone else already has. I looked at all the
analyzers linked from squid-cache.org, and didn't really find anything that
seems to fit. Anyone have ideas on this?

--Josh
Received on Wed Oct 09 2002 - 19:26:41 MDT