Architecture for User behaviour tracking

Point value changed by question poster.

Session Tracking is a flexible, lightweight mechanism that enables stateful programming on the web. It has a general implementation that serves as a basis for more sophisticated state models, such as persistent user profiles or multi-user sessions. A session is a series of requests from the same user that occur during a time-period. This transaction model for sessions has many benefits over the single-hit model. It can maintain state and user identity across multiple page requests. It can also construct a complex overview of user behavior that goes beyond reporting of user hits.

Session Tracking gives servlets and other server-side applications the ability to keep state about a user as the user moves through the site. Server-side applications can use this facility to create more stateful user experiences and track who's doing what on the site.

Java Web Server maintains user state by creating a Session object for each user on the site. These Session objects are stored and maintained on the server. When a user first makes a request to a site, the user is assigned a new Session object and a unique session ID. The session ID matches the user with the Session object in subsequent requests. The Session object is then passed as part of the request to the servlets that handle the request. Servlets can add information to Session objects or read information from them.

Using Session Tracking from a Servlet:

The following example uses the doGet method from a servlet that prints the number of times users access a particular servlet.

See this link for the example and the entire article explaining the process:

http://mysun-mail.sun.com/system/doc/session_track/SessionTr.html#130

(REMOVE SPACES from the pasted URLs.)

----------

Third party solution - Determine different user group behaviour:

http://www.global-linxs.de/content/pdf/Tracker.pdf

Good luck,

Maxwell

thanks, maxwell edison. has anybody any suggestions to other points?

Here is another link to a page on Session Tracking with Java:
http://www.apl.jhu.edu/~hall/java/Servlet-Tutorial/Servlet-Tutorial-Session-Tracking.html
(please remove any spaces)

As is this link also:
http://java.sun.com/docs/books/tutorial/servlets/client-state/session-tracking.html
(again, remove any spaces)

And this is a 6 page article with sample HTML script:
http://www.developerfusion.com/show/2076

hope this helps

I am not completely sure of what you are trying to accomplish. It looks like you are basically trying to implement a system where you can determine the behavior of users on the sytem. Is that right?

User requests can be captured on the web server or the app server. The web server will get you aggregate data, while the app server will enable you to detail all of the requests made by individual users (if session tracking is enabled).

Tracking in the DB tier is possible, but it may not help you. All it will have will be the queries that your app server is generating. If it is a custom written web app, then you should know all of the possible queries that can generated for any particular URL request.

Here is the thing that makes it difficult. VOLUME. Here at TechRepublic, we once hired a company that went through all of our data and categorized users for us. I was not involved in the project, but I did hear some of the discussions involved in it.

One of the things thatwas mentioned was a change to the server request logs to include any user/parameter data that could be of importance. This is HUGE.

In the end, I am not sure it was worth the effort or the $$$ (IMHO).

For the most part, you can get a picture of what your users are doing by generating your own reports on your own request logs. This task is made much easier when related items are grouped by directory.

I am not sure if any of this is in the slightest bit helpful.

Some more information that would be useful in helping your problem would be:
types of user behavior that you anticipate
scale/clicks that are inticipated
more specifics on the architecture (user tier is?)

BTW, I would prever to stay away from RMI. If this is a real-time system for user interraction, then system logs would be much less of an inconvenience for your users (JMS is pretty nifty).

Well you won't like my answer, but I'm a VMS Bigot and I have to promote the OS. VMS supports Java on the Alpha platform, and it will on Itanium. OpenVMS and SecureVMS are the most secure operating systems in production, and are C2 and B2 compliant respectively. You can literally audit about anything you want to, you can audit particular devices, files, ports, anything - you can find out anything a user is doing with anything. NT/2000 is a *copy* of VMS, but not near as robust or secure at all, and UNIX security - (I'm laughing)..

I did answer your question because VMS will provide a solution to allow you to track everything, and according to DEFCON hacker conventions is not penetrable.

What else could you want?

Who says you can't have a Java environment running on OpenVMS - have you been brainwashed by all the Microsoft and Sun folks out there?

You asked for a Java that could run in a secure environment. If it has to be THAT secure, and if you need to have the level of accountability that you were asking for then OpenVMS is a good choice.

Maybe then, you should consider Tru64 Unix - this is also a fairly secure version of Unix - that I would also suggest. It is not B2 compliant.

Do you need B2 or C2 compliance anyway - I mean why aggravate everybody in the group with a security requirement - and your requirement for Java if you don't need the security requirement. Then fine, then use Unix or NT. But those systems aren't compliant. What are you really after?

Ok, then you can get a machine running with a pure-Java processor from Rockwell International which is a hardware java processor - or you can go with any of the Sun Microsystems Solaris products.

I'd go with Sun, since they invented Java - they are probably your best bet.

As you can see there are many options - it's up to you to chose what's best. I can always show you that I can make one work, or maybe another one work - but as far as what's going to be best for you, and your needs- a lot of that is up to you and isn't going to be decided in this forum.

I'm not the Java expert, but I know who is.
Why don't you talk to my friend David Chung - all he does is eats and breathes Java - He's written books, he does Java consulting, he teaches Java, he codes - he does everything.

www.dchung.com

He'll gladly help you (probably for a fee) - but he's good - really good.

hope this helps.

Why not set up a Linux server (Red Hat) - with apache - load java on there, and this will be a good environment for you.

Hey, at least I'm trying to help - I admit that I've been totally biased. Please forgive me.

By the way - I know of a great product that will help you - it's called Attunity Connect.

Rick

Hopefully, all my obnoxious replies go to show you that there are many more than one way to resolve a problem, and that some ways that actually do work may not necessarily be practical or politically correct.

I guess this is my reply to the arrogance of companies like Microsoft, who think a Microsoft solution is the only one.

don't you think it's time to close this question?

Because you want to, in essence log the results at so many points (10 I believe), it seems to me you will need to impliment some kind of Object Request Broker infrastructure. This will allow you to have one component that can process and log the state at each critical juncture of your process. Please see the following article:
http://members.tripod.com/gsraj/corba/chapter/

Penguines obviously do not rule

What does "so that the programmer do not need to do anything (!) for me, but I should become all the information I can get." mean exactly? You want third-party software or ideas for your own? Perhaps Informix would have something to your liking. http://www-3.ibm.com/software/data/informix/

After reading the question, viewing the diagram on the web site, reading all answers and comments, I find Maxwell's answer provides the best user tracking option for watching who does what when and how on a network be it accessing applications,a database, web services or whatnot.

The common problem, I think, can be solved using SNMP traps (assuming that the devices are SNMP workable)you implement a "middle man device" such as MRTG, Cricket or whatever that gathers SNMP in a workable form, you can them develop a function in java to read the states without actually knowing what it's happening thus avoiding the knowledge of your network by the programmer, did this help??

This question was closed by the author