RE: User connected for long periods ... any ideas?

by Chuck Evans <Chucke(at)captura.com>

 Date:  Wed, 15 Mar 2000 11:31:06 -0800
 To:  "'HWG Techniques'" <hwg-techniques(at)hwg.org>
 Cc:  "'choicemag(at)hotmail.com'" <choicemag(at)hotmail.com>
  todo: View Thread, Original
Mike,

I ran into something like this when I took over webmastering for my
company's site. We were logging 25 different users who were each requesting
the home page (and associated graphics) every hour on the hour, all month
long (approx. 18,000 user sessions!). It turned out they were nearly all
from a single source -- a web site "monitoring" service that does this for
big ecommerce sites. They had given us a four-day demo that they never
turned off.

All that traffic was accounting for 70-80% of our site use. Once I brought
it to their attention, they turned it off.

I would suggest you look at your raw logs and pull out that particular
user's hits to see if they are recurring on a regular (ie, hourly,
quarter-hourly) basis. That might point to a robot at work. If you then
email the customer and innocently ask the reason for the repeated accesses,
they might decide to stop it on their own (or they may have a simple,
legitimate reason for the hits).

Good luck.

---------------------------------------------------------
Chuck Evans
Web Marketing Manager
Captura Software, Inc.
(425) 424-1155
chucke(at)captura.com
www.captura.com

-----Original Message-----
From:	Mike Kear [SMTP:choicemag(at)hotmail.com]

No, and that's the puzzle.  The client's a consumer rights organisation. We 
have some polls that could be used by the consumer rights advocates for 
their campaigns,  we have some petitions we're asking users to sign, but 
this user is hitting the front page all the time, not the polls or the 
activists pages.  And not the shop either.

I's doing us no harm that I can see, and I'm content for him to keep on at 
it.  The only impact is on bandwidth, and that's really minor - we have 
heaps of capacity before we start to be affected on performance,  but I 
guess what I'm asking everyone is ... can you think of a malicious reason 
why this person might be doing this?   do you think I should be worried?

>----- Original Message -----
>From: Mike Kear <choicemag(at)hotmail.com>
>
>It's Media House Live Stats v5.0
>
>And right now, the package says this about that particular user:
>
><ip address>  NET: <name of his host computer>  RDNS: n/a
>Origin:   Sao Tome    Time:   641 min   Hits / Kb:    412 / 6298.53Kb
>
>
>So, for now he's been attached in a session for 641minutes, he's hit the
>page 412 times, and downloaded 6.2MB.
>
>A "session" expires after fifteen minutes of inactivity, meaning no hits
>have been made on the Web site for 15 minutes.
>
>So why would one computer want to keep hitting our site  hour after hour on
>the same page?

HWG hwg-techniques mailing list archives, maintained by Webmasters @ IWA

This page is part of a preserved archive of archives.hwg.org. The site is no longer active and its content is not maintained. For enquiries about this archive, write to archive(at)iwanet.org.