Processing

The Discover processing software runs on one or more dedicated processing servers, sometimes called canister servers. These servers are typically behind the company firewall and are not visible to the Internet. They accept connections from capture servers and receive hits for processing.

Each hit includes information that maps it to a specific visitor. This information is used to group the hits into a session. The following terms apply to Discover processing:

• Session - As each hit is received, it is grouped with the other hits that apply to the same visitor's current interaction with your website. The processing server collects these hits until no more hits are received for the visitor or until a configured limit is reached. For example, if no more hits are received over an interval of 15 minutes, then the session may be considered complete. If a visitor performs an extended session, it may be necessary to end that session and to start a new one due time or memory constraints. While hits are arriving and being added to a session, the session is considered active. Discover allows you to search for an individual session while it is still active and to view pages and interactions that have just occurred.
• Short Term Canister - Sessions containing hits are stored in an area of volatile memory on the processing server. As each hit arrives, it is added to a new or existing session.
• Event - As each hit is added to a session in the short-term canister, a series of events can be applied. An event is defined as a combination of a condition and an action.
  • The condition can be noteworthy information in the request or response code. For example, a match can be a 404 status code in the response or a particular text string such as "Purchase Confirmed."
  • When a condition evaluates to true, the action associated with the condition is performed. This action may be to increment a counter or to record a value. Event-related data is written to the short-term canister and may be aggregated into the report server. Some events are specific to a hit, while others can only be processed with the session. When a session ends and is written to the long-term canister, events that are associated with an entire session are evaluated. An event can be triggered off multiple conditions.
• Long Term Canister - As each session ends, either due to visitor action, lack of further hits within a timeout period, or insufficient memory to hold a longer session, it is encrypted for security and written to non-volatile storage on a hard drive. This area is called the long term canister.
• Index - As each session is written to the long term canister, the data within it is indexed for later searching. In most deployments, a selection of the most important data is indexed. After indexing, Discover users can search on specific values, e.g. all sessions where the username field contained the value "smith."
• Alert - An alert is an action, such as sending an email, that should be taken when a predefined condition occurs. This may be the execution of an event or the crossing of a threshold, such as exceeding a total number of hits within a period of time.