Clever log analysis-the network administrator's "four-two-pronged"

Log files are always a good tool for network administrators to find "disease sources" when checking for faults and troubleshooting network errors.

However, due to the large number of Web log records, the analysis is difficult and the log records are uncertain.

In fact, the clever analysis of Web log records allows network managers to understand the fun of network management.

Do you know the access to the company site? If you just calculate the access volume, it means that you have not actually used the Web site to serve the Enterprise. In fact, detailed analysis of site access conditions, especially Web log analysis, can help enterprises make better business decisions. Simply put, for the manufacturer, it is necessary to determine whether a certain type of product is necessary to continue production; or it is more attractive to carry out targeted improvements to the site, and enables efficient access by customers and internal enterprise users. To achieve this goal, you can manually analyze Web logs, use commercial Web analysis tools for automatic analysis, and use outsourcing services.

For the network supervisor, it is difficult to manage a large number of Web log records, and the analysis and "cracking" of log data is a huge project. Some supervisors cannot even start with the accumulation of log data. This is even true for users who are using Web log analysis software. Generally, Web servers are configured with site access logging. Most of them are using commercial software to analyze log file data, and the data analysis cycle (weekly or daily) is performed, however, few enterprises make site improvements based on the conclusions drawn from analysis tools. So what is the significance of Website access analysis?

Functions to be implemented by Web Analysis
Web log files are actually separated "fragments". The function of the log analysis software is to combine these fragments to analyze useful information and improve website access efficiency, and then provide support services for business decision-making.

For example, a medium-scale e-product wholesaler analyzed the website communication for several months and found that users are very interested in security products, such as smart cards. As a result, the company launched a marketing campaign for the security products it provided. Two months later, the company's revenue improved significantly, and the performance of some subsidiaries that had been selling poorly before began to rank among the top.

A simple log analysis method is to use the telnet command to log on to the Web server to view log file updates in real time. In this way, a large amount of data is viewed, but only the most basic analysis can be performed. By observing the communication on the server, you can determine whether the user has encountered an access error, whether the user wants to access the internal Web site or enter the search engine. If the user points to a search engine, you can view the search type and keywords to help the enterprise establish relevant content management solutions and develop corresponding marketing strategies.

However, there is a problem here, and it is impossible for users to stay at the machine side to view log information updates. Therefore, the best way to conduct deep analysis on communication is to use specialized log analysis software.

Almost all large and medium-sized enterprises have dynamic Web sites, which can generate various site information based on databases, making it difficult to analyze user access behavior. Because all site URLs are similar, site analysis tools may mistakenly treat them as the same access, such as URL: www.mydomain.com/products.aspx? Productid = 20 and www.mydomain.com/products.aspx? Productid = 21. Most log analysis software regards them as the same page, and ignores the additional parameter, that is, the product number to be accessed. Therefore, the Web log analysis software should be able to identify parameters and analyze Website access behavior based on the complete access string.

For example, the WebTrends analysis tool of NetIQ provides the URL parameter analysis function in its advanced management function options to analyze specific page content. After the user submits the Page name (products. aspx) and Parameter Name (productid), the tool can obtain detailed analysis results based on the parameter analysis report, such as the number of browsing visits to a specific product page. The administrator can obtain more useful information, such as the most visited or least visited products on the site, and use the conversion file to intuitively express the information.

Path and parameter analysis are equally important
WebTrends does not analyze parameters as part of the entire path. Parameter pick-up analysis only occurs in the formation of the parameter analysis report. However, this parameter analysis method is useful in the logon, exit, or path analysis report.

By analyzing the path of the user or client to access the Web site, it is found that visitors do not necessarily enter the site from the home page. After searching for the required information, they may not exit from the home page. In fact, users may frequently bypass the site information that you think is important, including the core content on the home page. This requires adjustments to the site content to truly cater to the user's "taste ". For example, you can use the heuristic Q & A service to test the user's access orientation.

Most log analysis software provides certain types of path analysis reports. There is a "5% rule": If the access volume to a specific page of a Web site (such as a product page) exceeds 5% of the total site access volume, the page should be considered as the same access priority as the home page; accordingly, it can be set as interesting dynamic content, advertisements or specialized links. 5% rules can also be used to exit the page, so that users can access the Web site for a longer period of time and attract them to buy more products or search for more information.

The fact is that most visitors spend several minutes on the site and seldom buy products. Analyze the exit page to determine the page from which the visitor leaves the Web site. If you do not exit from the expected target page, such as listing only product categories without any specific product pages, you can change the site architecture or reposition the user access on the page content. In addition, there are many reasons for a visitor to exit the page. The reason may be that the content of the page to exit is too long or too short, or that the visitor is bored with the content, or that the link is interrupted, or the image loading time is too long. Therefore, it is time and effort-consuming to determine the real reason why a visitor exits a specific page. One simple way is to change the content to view users' access behavior.

WebTrends separates parameter analysis from path analysis. Therefore, you need to view the complete URL (including the query string) in the report to obtain useful results based on the logon and exit pages ). In Path Analysis (including logon and exit page reports), more detailed information is required for management. You can create customer code every time a product is ordered or canceled, write the code to the database, and write a program to report in detail which products in the database are frequently purchased or replaced. To implement this complex log analysis, Datanautics provides the G2 platform, which has the data mining function and can associate log file data with database information.

Error Analysis
When a user browses a site, an error message of one or another occurs, usually "Error 404 file not found ".

There are three possible causes for 404 errors: first, the user clicks the page link that does not exist instead of the desired Web site homepage (for example, on the search engine result page; the second is a link error on the same Web site, and the third is a URL error.

Obviously, it is important to effectively manage links within or to external sites. The common log analysis software not only shows the cause of the 404 error, but also tells the competent visitor which page to access and which file to access (internal or external) an error occurs.

The reason for the external 404 error is that the Web site has been re-designed, such as updating the Web architecture, adding access address records or changing the file naming method. Thousands of external sites may be linked to the same page and the page does not exist. This is the same as storage change, and does not necessarily notify the customer where the storage location has changed. There is no way to automatically manage external 404 errors, but you can try to reduce or eliminate such links. For example, using log analysis software, you can discover links from external Web sites through Error 404, and send emails to such Web site directors to inform them of link updates. In most cases, the link will be instantly repaired and the customer can access it normally. More importantly, users who have already linked to the site can jump from one Web site to another without interruption.