Concurrency using iis logs without duration / end time

[That1Guy]

we are looking to estimate concurrency of users based on iis logs. this is proving to be very tough because in the web log, there is no concept of logon/logoff, its just logging requests to to various resources on the webserver e.g. files, pictures, pages, etc. so one person's "session" could consist of 5000 log entries.

if we assumed a value for duration (would be nice to do in a slicer), do you have guidance on how i might estimate concurrency using the below data?

i have created various visuals to show this but i am concerned the values are over projected. as an FYI, i have about 2 million rows for 24 hours that look similar to this

Timedate	User	Classification	Common event	Rule
4/14/2020 0:14	john	Access Success	Object Accessed	PROPFIND Method
4/14/2020 0:14	john	Access Success	Object Accessed	PROPFIND Method
4/14/2020 0:14	john	Access Success	Object Accessed	PROPFIND Method
4/14/2020 0:14	Sally	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	Sally	Error	HTTP 403 : Request Error - Forbidden	HTTP - 403 - Req Error - Forbidden
4/14/2020 0:14	Sally	Error	HTTP 403 : Request Error - Forbidden	HTTP - 403 - Req Error - Forbidden
4/14/2020 0:14	Sam	Error	HTTP 401 : Request Error - Unauthorized	HTTP - 401 - Req Error - Unauthorized
4/14/2020 0:14	Sam	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	Sam	Error	HTTP 403 : Request Error - Forbidden	HTTP - 403 - Req Error - Forbidden
4/14/2020 0:14	John	Error	HTTP 401 : Request Error - Unauthorized	HTTP - 401 - Req Error - Unauthorized
4/14/2020 0:14	john	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	Sam	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	John	Access Success	Object Accessed	PROPFIND Method
4/14/2020 0:14	Sally	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	Sally	Access Success	Object Accessed	PROPFIND Method
4/14/2020 0:14	john	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	Tim	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	Jane	Information	HTTP 200 : Success Reply - OK	HTTP - GET - 200 : Success Reply - OK
4/14/2020 0:14	John	Access Success	Object Accessed	PROPFIND Method

Any help/guidance would be GREATLY appreciated 

[v-yingjl]

Hi @That1Guy ,

Based on the table you have previously posted, I'm not certain what is the logic to determine the 'duration' since the timedate is only '4/14/2020 0:14' but the user like john has different classification, common event and rules in this table.

In addtion, since you have created various visuals to show this, could you please show some example pictures as a reference output? There is only a table under this post without any visuals as your said previously. Or the table is the sample visual but have other data pictures?

Best Regards,
Yingjie Li

If this post helps then please consider Accept it as the solution to help the other members find it more quickly.

[That1Guy]

Hi @v-yingjl ,

Thanks for your reply. Here are some of the visuals i'm creating right now and the issue of not having 'duration' to show a users's continual use

 

[Greg_Deckler · Accepted solution]

So, I would think that you would have to make a decision about what constitutes a "session". For example, if you see activity from John at (I'm not sure what 0:14 represents). Is that 0 hour 14 minutes or 12:14 AM? Let's say it is. So you have entries for John on 4/14/2020 at 12:14 AM and you have additiona requests let's say at 4/14/2020 at 12:18 AM and even more at 4/14/2020 at 12:24 AM and then even more on the same day at 8:09 PM, 8:10 PM, 8:15 PM and 8:22 PM. So, what does that represent? Is that 7 sessions? 2 sessions or 1 session or some mix in between? You need to decided on that first because if you say that is 1 session and you assume they were on from 12:14 AM until 8:22 PM then that is vastly different then if they were on from 12:14 AM until 12:24 AM and then again from 8:09 PM until 8:22 PM.

[That1Guy]

Hi @Greg_Deckler ,

You're 100% right - i think we need to determine what a sesssion really is - e.g. how long do folks typically use this thing? I have heard both 30 seconds as well as 3 hours can be considered valid so (it is a content management system). To your point on the timestamp, you nailed it - that 00:14 is indeed 12:14am thus your example resonates. I will model a few scenarios based with variable where seessions are 1 > x > 120 minutes and see how this plays out. I very much appreciate the guidance