Products
Webtrends Analytics 9.x
Webtrends Analytics 8.x
Issue
All hits sent to the SmartSource Data Collector (SDC) appear to be coming from one visitor, or in some configurations, several visitors, but not hundreds, or more, as would be expected.
This results from a network topology configured to pass client data through a firewall, load balancer, caching, or proxy server, and sometimes more than one of each or a combination of them. This has the effect of stripping the client IP address passed by the external client and replacing it with the IP address of the machine(s) through which it is passes. This can be confirmed by examining the log files, which will display the IP address of the internal machine(s) in the client IP field.
Resolution
The best resolution for this issue is to verify your network device is set to allow client-ip passthrough.
If that is unavailable, you can use x-Forwarded-For. x-Forwarded-For should only be used as a last resort and in full understanding of the following information.
X-Forwarded-For has the liability of passing multiple strings for the IP address (all IPs in the route). This string is space delimited. Space delimited entries in a log file that is space delimited can cause a multitude of issues, such as reports containing incorrect information, analysis failure, and worst of all lost data.
To pass the external client IP addresses through the internal machines, navigate to the following folder on the SDC server:
\Program Files\WebTrends\SmartSource Data Collector\cfg
Open the dcs.cfg file and find the line “headerparamslist” in the Log server section. This is a comma-delimited list of HTTP headers to be emitted as Webtrends query parameters.
By default it is set to:
headerparamslist=Host,Accept
Change it to read:
headerparamslist=Host,Accept,x-Forwarded-For:DCS_CLIENTIP
This will now log the value of the HTTP header “x-Forwarded-For” to the c-ip field of the SDC log.
Next, locate the the enableheaderparams entry, which by default will located on the line above the previous entry. The default value is set to:
enableheaderparams=false
Change it to read:
enableheaderparams=true
Save the changes to the dcs.cfg, then under Start > Control Panel > Administrative Tools > Internet Information Services (IIS) Manager, drill down to the SmartSource Data Collector server and restart it. After the server has come back up, it should now be receiving IP addresses forwarded from the external clients. If the issue persists, consult the documentation for the firewall, load balancer, or proxy to confirm it has been configured correctly.