sql - How to identify sessions in traffic logs by detecting periods of idleness or inactivity? -
i'm looking @ traffic logs (collected through haproxy) , trying identify user sessions (aka visits). i'm defining user unique ip + user agent checksum, or else available, user id logged-in users.
i'm not sql wiz, , i'm wondering if there's way identify new session defined logged event after 30 minutes since last logged event same user. use t-sql, , we're running on sql server 2012.
it may i'm overlooking obvious confounds session id methodology. i'd appreciate wisdom comes mind.
the db schema looks this, filtered user defined ua: abcdefghij
+ ip: 11.11.11.1
:
id || user agent || ip || accountid || routename || creationdate ----------------------------------------------------------------------------------- 9 || abcdefghij || 11.11.11.1 || null || home || 2015-05-29 00:00:25 ----------------------------------------------------------------------------------- 45 || abcdefghij || 11.11.11.1 || null || home/photo || 2015-05-29 00:00:26 ----------------------------------------------------------------------------------- 55 || abcdefghij || 11.11.11.1 || null || home/photo || 2015-05-29 00:00:27 ----------------------------------------------------------------------------------- 1125 || abcdefghij || 11.11.11.1 || null || home || 2015-05-29 01:02:03
for simplicity's sake let's we'll restart sessions every time new day (new table) starts. we're looking @ 2 sessions above - sessions user during day.
in reality we're talking hundreds of thousands of ua + ip combinations. i'm hoping able return list of users, plus count of sessions given day.
you can caluclate difference between subsequent rows creating cte row numbers created row_number(), self joining offset. complete query this:
with events ( select "user agent", ip user, creationdate, row_number() on (partition "user agent", ip order creationdate) rn sourcetable ) select "user agent", ip, count(*) events e1 join events e2 on e1.rn = e2.rn-1 datediff(minute, e2.creationdate, e1.creationdate) >=30 group "user agent", ip
Comments
Post a Comment