Now that you have created a storage that is pointing at your log data, it is a good idea to automate the process of importing new logs each night. To do this:

1. In WebSpy Vantage, go to the Tasks tab and click New Task.
2. Call the Task Daily Task and proceed through the short wizard to create a task with a Daily schedule running at 1am in the morning.
3. Once the Task has been added, select the next task and click Add Action | Import new hits to existing storage
4. Select the Storage you created above. Select Resume Import from last position if your log files are appended to with new data and/or new log files are created in the folder your storage is pointing to (most common). If the same file log files (same names) are overwritten each day with new data, then select the Return to start of log file or table.

WebSpy Vantage will now automatically import new log files each night at 1am. As this storage will grow until you run out of disk space, it is a good idea to add a data retention policy using the Purge data from storage task action. To do this:

1. Still on the Tasks tab, select the Task you created above and click Add Action | Purge Data from Storage.
2. Select your Storage and click Next
3. Select your desired data retention, such as Purge data older than 3 months.

WebSpy Vantage will now automatically purge data from your storage once it has imported new logs files.

1. Select a Report Template and click the Generate Report option to launch the Generate Report Wizard.
2. On the Storages page, select the Storage you want to report on.
3. On the Format page, select the type of document you want to create the report as (HTML, Word, PDF, CVS, Text).
4. On the Publish page, you can customize the name of the report, prefix the name with today’s date, copy the report to a location and compress it using zip (useful when emailing the ‘HTML, Loose Files’ Report Format to someone as an attachment).
5. On the Documents page, you can choose to split your report into multiple documents based on anything in your log files, and/or aliases you have created such as Categories, Departments, Subnets, and so on. Leave this option unchecked to create a single report document.
6. On the Filters page, click Add | Date Filter and select the dates you want to report on. You can also include/exclude any values from your log files using Add | Field Value Filter.
7. The Email page enables you to email the report to someone as an attachment (Set your SMTP options in Tools | Options | Email).
8. Once the report has been generated, it will appear in the Report Manager at the bottom of the screen. Double-click the file to open and view the report.

1. Select a Report Template and click the Publish Report option to launch the Publish Report to Web Module wizard.
2. On the Storages page, select the Storage you want to report on.
3. On the Template page, select the Report Template that you want to generate (the template selected in step 1 will be automatically selected)
4. On the Publish page, select the Web Module you want to publish the report to. If you would like the option to drill down past the bounds of the report when viewing the report in the Web Module, check the Publish the selected storages to enable the ‘further analysis’ feature option.
5. On the Split and Permit page, select No Separation to create just a single report, and select Everyone as the permission. Splitting reports by groups or managers and giving permission to certain people requires first importing your Organization information from LDAP on the Organization tab. See below.
6. On the Filters page, click Add | Date Filter and select the dates you want to report on.
7. The Notification page can be used to send a notification email to everyone with permission to the report(s). For now, leave the option unchecked.
8. Click OK to publish the report to the Web Module.
9. Once the report has been published, log into the Web Module and go to the Reports tab. Click the report to open and view it.

You can automate the generation or publishing of Reports using the Tasks tab (see the section on automating the reporting process below)

On the Directory Server page, select your directory type and server, along with a username (in domain\username format) and password to authenticate with your directory server, and click Test. Click Next after you have successfully connected to your directory server.

1. Select a Root Distinguished Name to search for users within (for example, ‘dc=mydomain, dc=com’) from the dropdown list. If your users are contained within a specific OU, select the ‘…‘ button to select the OU in your directory.
2. The LDAP search query is defaulted to a query that returns ‘user accounts’. It’s important to note that WebSpy Vantage’s licensing is based on ‘number of users’, so if necessary, use the Quick Queries dropdown to change the LDAP search query and import a more specific set of user accounts, such as enabled users with an email address. WebSpy Vantage will import all users up to the license limit, which is unlimited during your trial. Click Next.

The User Details page defines how Vantage maps user objects in your Directory to authenticated usernames in your log files, as well as configuring user login names for the Web Module, the email address to send report notifications to, and the attribute to use to find a user’s manager.

If you are using Active Directory, you can choose Use Active Directory Defaults. This will import the most common username formats both with and without domain prefixes accounting for 99% of log analysis situations that we see.

If you are using a different directory server, or your log file log usernames in a custom way (such as a custom UID), then select Custom and there are two important concepts you may need to change:

• Login Name:
  Usually, you will configure the Web Module to use Windows Authentication. For your users to be able to login using this authentication method, specify a prefix in the login section for yourdomain\ (replace with your actual domain and include the slash). IIS will then authenticate your users against your domain correctly, and they will be able to login to the web module without an authentication prompt as long as they’re logged into Windows, assuming they’re permitted login to the Web Module (see the Configure Web Module Permissions section below).
• Know your log file’s username format:
  The configuration of the User Details page defines what is imported into the Usernames Alias (seen on the Aliases tab), which is what maps the authenticated usernames in your log files to user objects in your domain.You can utilize the Usernames Alias in the content of your reports (via nodes in Report Templates), and when specifying Filters when generating reports (via Add | Field Value Filter | Summary = User, Alias = Usernames).Log files record authenticated usernames in a variety of ways. Some simply log the login name (called sAMAccountName in Active Directory), some include the domain prefix (Domain\sAMAccountName), some include an authentication realm suffix (Domain\sAMAccountName@Realm) and so on.It is important to know how your device is logging usernames, so that you can prefix and/or suffix the appropriate values around the sAMAccountName, or import a different attribute from your directory such as userPrinicpalName, a UserID or the user’s full DN.To find out how your device logs usernames, go to the Analysis tab and run an ad-hoc analysis and your storage (add a Date Filter on the Filters page to keep the analysis small), and then go to the Usernames summary in the analysis. Note the username format, and use the appropriate options in the User Details page of the Import Organization wizard.If your device logs in the Domain\Username format, use the ‘prefix’ option in the Login name section to prefix yourdomain\.If your device logs usernames differently, click the Add button in the Additional Attributes section, and enter the attribute you would like to import from your domain (such as sAMAccountName or UID), and use the prefix/suffix options to surround the imported value with the appropriate text.

Once you have configured the User Details page to create an appropriate login name, as well as map user objects to your log data, click Next.

The Grouping page enables you to configure how you would like users grouped, such as by Departments, Offices, OUs etc. User Objects in Active Directory have a number of attributes, including department, office, description, company, and you can also place user objects in OU containers, and configure attributes on those containers. WebSpy Vantage can hook into any of these attributes to group your users for the purpose of reporting.

By default, there are two groups specified: Offices (using the ‘physicalDeliveryOfficeName’ attribute in Active Directory) and Departments (using the ‘department’ attribute in Active Directory). It is important to note, that if a user does not have one of these values populated in Active Directory, then they will not be imported. You can edit or delete these groups as necessary.

When adding or editing a group:

1. First, enter the name of the Group into the Name field. This is up to you and should represent what the group is, such as ‘Departments’, ‘Locations’, ‘Business Centers’ etc. (Note, there are a few default Report Templates that use ‘Departments’ so use the word ‘Departments’ in one of your grouping levels utilize these reports).
2. Enter the exact name of the attribute into the Attribute field. For example, enter ‘physicalDeliveryOfficeName’ to import the Office attribute from Active Directory. To import the name of an OU, use the attribute ‘OU’. (Note that by default, Active Directory Users and Computers hides the real attribute names. You can change this by selecting View | Advanced Features to show the Attribute Editor with real attribute names when editing a User or OU).

There are two ways to specify the object in your directory that contains the attribute to use for grouping:

1. Relative to user:
   Use this option if the attribute is located on the user object itself or on one of its parent OU containers. For example, if you are using the ‘Department’ attribute on the user objects, then select Relative to user and select User node. Or if your users are in a consistent OU structure, specify either Parent of the user node, or Node ‘n’ levels above to access the attribute on the appropriate parent OU container.
2. Relative to root:
   Use this option to select OUs relative to the Root Distinguished Name that you specified on the Directory Server page. For example, if you have defined OUs for all your Offices directly underneath your Root DN, with user objects located anywhere underneath those OUs, then use the Immediate children of Root option, or the Children ‘n’ levels below Root option. For inconsistent OU structures, you can use the Single group from Root node option, and use the Import Organization wizard multiple times (usually specified as part of a Task – see below) with the Merge options set, to create groups from multiple Root DNs in your directory.

   Tip: Later, you’ll need to configure Web Module access permissions for people and/or groups. To create a default set of permissions that apply to your entire organization, create a top-level group using an attribute that everyone is a member of. For example, call the group ‘Domain’ and use the attribute ‘dc’.

Once you have specified all the Groups you would like to use in your Reporting process, click Next.

The Merging page enables you to use the Import Organization wizard multiple times, and merge the results into your existing Organization structure. For example, first import your Organization from one domain (or one Root DN on your domain), with the Overwrite existing organization tree option set to create an initial Organization tree, then run the Import Organization wizard again to import your Organization from another domain (or a different Root DN on your domain) and merge the results into your existing Organization tree.

The Merge options enable to you to keep or remove users that can no longer be found in the directory, as well as keep or update existing user’s details. Use the ‘keep users / keep details’ options if importing from a different domain or root DN.

Note: When merging, only users that have previously been added from your LDAP/LDIF directory will be affected. Users that have been manually added will not be affected.

1. Go to the Tasks tab and click New Task
2. Name the task Daily Task and click Next
3. On the Schedule page, set the task to run tomorrow at 1am in the morning with a Daily recurrence, every 1 day. Click Next.
4. On the Authentication page, enter the password of the user account you currently using. When you are logged off the machine, the Windows Schedule Task will launch Vantage under these credentials.

1. Select your Daily Task, and click the Add button. This presents a list of all the actions that can be automated.
2. Import new logs
   For the first action, select Import new hits to existing storage, and then select your storage. Select Resume import from last position, to import new log files added to the folder your storage is monitoring, along with any new data added to existing log files. Select Return to start of log file or table if the log files you’re importing get overwritten with new data (For example, a single log file that gets re-created each day with new data). Click OK to add the Action.
3. Set a data retention policy
   For the second action, select Purge data from storage. Select your Storage and click Next. Select Data older than 3 months (or your desired data retention policy) and click OK.
4. Retrieve new Organization information your Directory
   For the third action, select Import Organization from LDAP. Proceed through the Import Organization wizard (see steps above) to configure the way users and groups should be imported from your directory server. As this action alters your Organization and Alias information, you need to push the new configuration to the Web Module using the Synchronize Web Module task action. Click Add | Synchronize Web Module and select your Web Module.
5. Publish Reports
   For the fourth action, select Publish Report to Web Module and proceed through the wizard to publish reports for specific groups, managers or people. As this report will be published on a daily schedule, ensure it is only reporting on yesterday’s data using a Relative Date Filter. On the Filters page, click Add | Relative Date Filter and select Past 1 day.