WebSpy is a Fastvue Product

Support Center

Name is required.
Email address is required.
Invalid email address
Answer is required.
Exceeding max length of 5KB

Web URLs or Web Domains in User report

Brian Oakes Oct 08, 2014 10:00AM PDT


I am kinda lost. I am trying to build a report for a single users's activity between date ranges. I know the users machine name and the IP address of their PC. I need to what they have been up today, and I can't seem to accomplish that.

We are using kiwi syslogger to capture data from our Sonicwall.

Anyone have a good walkthrough? Thanks!

Up 0 rated Down
Fastvue Sep 17, 2014 05:49PM PDT FASTVUE Agent
Hey Brian,

Thanks for getting in touch about this.

There are two basic steps here:
1. Find or create a report template to provide the report 'content' that you need
2. Work out the best way to filter the report for this user - whether that be Source IP, hostname or authenticated username.

Here's a zip file that contains a couple of SonicWall Report templates and a new Productivity alias to get you started:

Extract the zip and the go to the Aliases tab in Vantage. Click Open Aliases and then select the UberProductivity.Alias file in the zip. Click Merge when prompted. The report templates rely on this alias.

Next, go to the Templates tab and click Open Templates, then select the Individual User Report (SonicWall).Template file. There is also a Department report, so feel free to try that too :)

You'll now have a new template called Individual User Report (SonicWall). This should show you all you need to know about your user's activity, including a full activity log and search engine search terms.

Now you can select the Report Template and click Generate report. Go through the wizard, but on the Filters tab, click Add Field Value Filter.

Here you have a few options. If you're sure about the IP address of the user, then select the Source Address Summar. Then click the Add button and enter the IP address of the user.

Another option is the 'Username' Summary, and then add the authenticated username of the person you want to report on. This assumes that SonicWall is authenticating the user's traffic.

On more option is to use the 'Source Name' Summary which is the host name of the source machine.

The best way to find out what Summary to use and what values to filter on is by running an Ad-hoc Analysis on the summaries tab. You can then select the various Summaries and see what values are contained in each one. For example, select Usernames to see if authenticated usernames are being recorded, and what string is expected (domain\username or just 'username' for example).

For more information, also check out our video on reporting on a user here:

I hope this helps! Please let me know how you go!


Post Your Public Answer

Your name (required)
Your email address (required)
Answer (required)

Contact Us

seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
Invalid characters found