sql - How to identify sessions in traffic logs by detecting periods of idleness or inactivity? -


i'm looking @ traffic logs (collected through haproxy) , trying identify user sessions (aka visits). i'm defining user unique ip + user agent checksum, or else available, user id logged-in users.

i'm not sql wiz, , i'm wondering if there's way identify new session defined logged event after 30 minutes since last logged event same user. use t-sql, , we're running on sql server 2012.

it may i'm overlooking obvious confounds session id methodology. i'd appreciate wisdom comes mind.

the db schema looks this, filtered user defined ua: abcdefghij + ip: 11.11.11.1:

id   || user agent ||     ip     || accountid ||   routename   ||   creationdate ----------------------------------------------------------------------------------- 9    || abcdefghij || 11.11.11.1 ||   null    ||     home      || 2015-05-29 00:00:25 ----------------------------------------------------------------------------------- 45   || abcdefghij || 11.11.11.1 ||   null    ||   home/photo  || 2015-05-29 00:00:26 ----------------------------------------------------------------------------------- 55   || abcdefghij || 11.11.11.1 ||   null    ||   home/photo  || 2015-05-29 00:00:27 ----------------------------------------------------------------------------------- 1125 || abcdefghij || 11.11.11.1 ||   null    ||     home      || 2015-05-29 01:02:03 

for simplicity's sake let's we'll restart sessions every time new day (new table) starts. we're looking @ 2 sessions above - sessions user during day.

in reality we're talking hundreds of thousands of ua + ip combinations. i'm hoping able return list of users, plus count of sessions given day.

you can caluclate difference between subsequent rows creating cte row numbers created row_number(), self joining offset. complete query this:

with events ( select "user agent",         ip user,        creationdate,         row_number() on (partition "user agent", ip order creationdate) rn        sourcetable ) select "user agent", ip, count(*)  events e1 join events e2 on e1.rn = e2.rn-1 datediff(minute, e2.creationdate, e1.creationdate) >=30 group "user agent", ip 

Comments

Popular posts from this blog

python - TypeError: start must be a integer -

c# - DevExpress RepositoryItemComboBox BackColor property ignored -

django - Creating multiple model instances in DRF3 -