Why do all hits sent to the SDC server come from the same visitor?

Why do all hits sent to the SDC server come from the same visitor?

For products:
Webtrends Analytics 8.x
Webtrends Enterprise 7.x
Webtrends Professional 7.x
Webtrends Small Business 7.x

Last modified: 9/17/2009

Situation:
All hits sent to the SmartSource Data Collector (SDC) appear to be coming from one visitor, or in some configurations, several visitors, but not hundreds, or more, as would be expected. This results from a network topology configured to pass client data through a firewall, load balancer, caching, or proxy server, and sometimes more than one of each or a combination of them. This has the effect of stripping the client IP address passed by the external client and replacing it with the IP address of the machine(s) through which it is passes. This can be confirmed by examining the log files, which will display the IP address of the internal machine(s) in the client IP field.

Solution:
To pass the external client IP addresses through the internal machines, navigate to the following folder on the SDC server: \Program Files\WebTrends\SmartSource Data Collector\cfg Open the dcs.cfg file and find the line "headerparamslist" in the Log server section. This is a comma-delimited list of HTTP headers to be emitted as Webtrends query parameters. By default it is set to: headerparamslist=Host,Accept Change it to read: headerparamslist=Host,Accept,x-Forwarded-For:DCS_CLIENTIP This will now log the value of the HTTP header "x-Forwarded-For" to the c-ip field of the SDC log. Next, locate the the enableheaderparams entry, which by default will located on the line above the previous entry. The default value is set to: enableheaderparams=false Change it to read: enableheaderparams=true Save the changes to the dcs.cfg, then under Start > Control Panel > Administrative Tools > Internet Information Services (IIS) Manager, drill down to the SmartSource Data Collector server and restart it. After the server has come back up, it should now be receiving IP addresses forwarded from the external clients. If the issue persists, consult the documentation for the firewall, load balancer, or proxy to confirm it has been configured correctly.

    • Related Articles

    • How do I get my SDC server to rotate logs in local time instead of GMT?

      For products Webtrends Analytics 9.2a Webtrends Analytics 8.x Last modified:  10/1/2010 Introduction: By default, Smartsource Data Collector (SDC) rotate the logs at GMT midnight.  When this happens data for a single day local time is spread across ...

    • Custom Report shows visitors with 0 hits and multiple visits

      Products: Webtrends Analytics 8.x Webtrends OnDemand Symptoms: You have created a custom report with Visitors as a dimension and hits and visits as measures.  You also have at least one filter on the profile.  When viewing the report, it appears the ...

    • What is Visitor History?

      For products: Webtrends On Demand Webtrends Analytics 9.2x Webtrends Analytics 8.x Last modified: 1/1/2011 Introduction: Visitor History (VH) is a database that can be enabled on a per-profile basis that stores long term information about a ...

    • How do I setup SDC manually?

      Affected Environments: WebTrends Smart Source Data Collector Solution: If there is an error when installing SDC, it may not create the web site for you. Below is the information needed to do this, should the need arise. To install WebTrends ...

    • How large are SDC logs when compared to IIS weblogs?

      For products: Webtrends Analytics 9.2a Webtrends Analytics 8.x Last modified: 9/7/2010 Introduction: You are considering moving to Smartsource Data Collector (SDC) logs and currently use a web log format such as IIS or Apache. To prepare for this ...