This article is for School Leadership and Wellbeing Staff.
The User Timeline allows you to generate reports detailing all traffic to and from a student’s devices. It shows a student’s last 10,000 connections over 24 hours and whether each connection was allowed or blocked. You can access a user’s Timeline from the User’s Dashboard and export the Timeline report as a comma-separated text file as needed.
Accessing the Timeline from the User's Dashboard
The most common way to access the User’s Dashboard is from the Active Users report. Other reports, like Red Flags, can link you to a User’s Dashboard.
From the Statistics > Active Users menu:
- Verify the Date Range you want to use.
- On the Active Users page, type any part of the Username or Name in the Search and press the enter/return key.
- Select Username to open the User’s Dashboard.
- Select User Timeline.
Image 1: Using the Active Users page to search for a user and access the User Dashboard
Custom ranges are limited to a continuous period of no more than 24 hours. If you require more than 10,000 rows of data, you must set a shorter date range and repeat the search for the next segment of dates.
Investigating Timeline Data and Report
A User’s Timeline will display the most recent website events for the past hour. We recommend reviewing six hours at a time for faster web page loading. You can use the User Timeline to investigate a user’s traffic and data usage and export a report.
Important
You can only select up to 48 hours of timeline activity at a time.
Tip
When data is sent (Upload) or saved/viewed (Download), Gigabyte (GB) is the largest, followed by a megabyte (MB), then a kilobyte (KB), and byte (B) is the smallest. You can use a search engine to investigate web addresses you do not recognize.
Image 2: Breakdown of the User Timeline Dashboard
|
Column |
Type of Data |
|---|---|
|
A. Date/Time |
Select up to 24 hours. Choose from presets of the Last 1 Hour to 24 Hours or Custom Range from a calendar. |
|
B. Filter By: |
Select to filter the results by • Verdict: All - Both Blocked and Allowed activity • Verdict: Blocked - Websites the user was prevented from accessing • Verdict: Allowed - Websites the user was able to access |
|
C. Search |
Type in the search bar to find any part of the Time (24-hour format), Machine Name (if macOS and Windows names are available), Website, or Type (theme or category). |
|
D. Export Report |
Download the current activity in a CSV text file. You can open the file in a spreadsheet program. |
|
E. Date/Time |
The year, month, day and hour, minute, second the connection was started. |
|
F. Machine Name |
The device names your IT support set for Windows and macOS computers. Only available when your IT support has opted to sync the additional identity information with Linewize Filter. |
|
G. Verdict |
The label Allowed or Blocked for each website the user’s device attempted to connect to. |
|
H. Website |
Web address or network address of the connection. Connections to IT infrastructure, like printers or your school’s servers, may be identified by numbers or codes. |
|
I. Type |
Website themes or categories to help you identify. The type is blank for connections to IT infrastructure, like printers. Use the Type to identify patterns of activity. |
|
J. Upload |
The amount of data sent from the user’s computer to the website or device (for example, an assignment uploaded to a website). |
|
K. Download |
The amount of data transferred from the web to a user's computer (for example, all the text and images on a web page). |
|
L. Connection Details (arrow) |
Your IT support may use these details to identify the device and what was running when the activity was recorded. |
Investigating Timeline Data
A. Time period
Select up to 24 hours. Choose from presets of the Last 1 Hour to 24 Hours or Custom Range from a calendar.
Image 3: Time Period selector on the User Timeline Dashboard
B. Filter by
Select to filter the results by
- Verdict: All - Both Blocked and Allowed activity
- Verdict: Blocked - Websites the user was prevented from accessing
- Verdict: Allowed - Websites the user was able to access
Image 4: Verdict search filter on the User Timeline Dashboard
C. Search
Type any part of the Time (24-hour format), Machine Name (if macOS and Windows names are available), Website or Type (category name).
Image 5: Search function on the User Timeline Dashboard
D. Export Report
Download the current activity in a CSV text file. Open the file in a spreadsheet program.
Image 6: Export Report function on the User Timeline Dashboard
Connection Details
The Connection Details are close to the raw information to help your IT support identify what was accessed when the activity was recorded.
You can look for Detail labels by typing into the Search box or scrolling down the Connection details list. You can use the following table to help you understand what each Detail and Value means in the context of the Connection Details.
Image 7: Connection Details for a connection from the User Timeline
|
Label |
Usage |
|---|---|
|
agent |
Indication of the type of Connect, as a “chrome-extension,” running on “Windows” or macOS “Darwin.” |
|
hostname |
The optional Machine Name your IT support sets on Windows or macOS computers. |
|
httpHost |
The website address. |
|
http_request_uris |
Additional “web path” after the web address. Popular websites often include keywords in the web address (like “watch,” “download,” or “live”) that may give you a hint to the purpose of the website. |
|
tag |
Theme or topic associated with this website, if available. |