Technical Note: Calculating the browse time for a specific user on FortiAnalyzer
Description
This article describes the way in which the browsing time is being calculated on FortiAnalyzer for a user.
Solution
In Fortiview, a specific time can be seen as given for a user as browsing time based on different categories (assuming filtered for 7 days). This may not appear accurate when based on how much the user has actually browsed in that category.
This browsing time value for any IP is calculated based on the ebtime (estimated browsing time) value which is one of the parameters in the logs. If the raw logs are downloaded for that specific user based on that category (time filter of 7 days), the ebtime column can be seen.
If the sum of the ebtime is calculated it will be seen to be equal to what is shown in FortiView as browsing time in that category for that user.
This browsing time value for any IP is calculated based on the ebtime (estimated browsing time) value which is one of the parameters in the logs. If the raw logs are downloaded for that specific user based on that category (time filter of 7 days), the ebtime column can be seen.
If the sum of the ebtime is calculated it will be seen to be equal to what is shown in FortiView as browsing time in that category for that user.