WSS reports showing 1000s of page views and browse times with 0 value

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

When looking at WSS reports available in Portal, Administrator noticed that a large number of URLs reported page views and browse times with a value of 0

User using WSS agent as access method into WSS. 

Username in HTTP raw logs not recognised as valid user within the AD user store, and seems to be related to laptop name - some service was generating this request into WSS with the username the service run under

 

Environment

WSS Agent 6.1.1 (independent of version)

Cause

In each case where the loglines were reported with a count of 0, we failed to meet the conditions to be considered a page view. To have a page view an access log must have all the following:

1. status = 200
2. content-type = text/html
3. isolation url must be empty
4. exception id must either be empty or "allowed"
5. category != Web Ads/Analytics

Resolution

Need to make sure that the conditions for reporting above match what is returned from origin server.

Additional Information

Sample raw HTTP logs for these requests showed following style entries:

"2021-02-08","05:27:20","8108","129.17.1.254","BCOM-L01947\lenovo_tmp_JOFD","","OBSERVED","""Technology/Internet""","","ssl","ncp101.prod.do.dsp.mp.microsoft.com","443","/","","","","173.222.29.157","Italy","CERT_VALID","","","none","","","none","","ICAP_NOT_SCANNED","","""Ambiguous - Special Use""","1","","","","","","10558","","-"