Monitoring

The Monitoring Agent is an application installed on a user's workstation that collects statistics about their activity. This collected activity consists of events — user actions performed within open windows.

Simple Monitoring

Simple monitoring provides the following information:

• Keyboard and mouse keypresses recorded as HID activity
• Switching between windows of various programs
• The name and window title of the active program
• The title of the active tab and the URL of the page in a browser
• The title of the active sheet in MS Excel
• User account name and login, its domain or work group
• Computer name, its domain or work group
• Timezone of the user session
• Monitoring agent operation logs

The Operavix Agent does not collect or store user passwords. The monitoring agent ignores the fields in which the user needs to enter a password.

Additionally, the monitoring agent collects user HID activity (mouse and keyboard activity) and program activity (injected activity).

When storing activity locally for a month (without sending it to the server), the occupied disc space for one user estimates at 25 Mb.

Extended Monitoring

Extended monitoring collects form data (parameters), if they exist, and events. Parameters are the values of editable fields (the Edit and ComboBox types). They are searched when focusing and when the editable field loses focus. When the Parameters elements are found, they are added to all events.

An Event is either a user action (button click, tab switching, field filling, etc.), or a program action (for example, display of a dialog box, window title change, active window change, etc.). All events relate to the program that has an open window at the current moment. Events that do not lead to any effect (for example, clicking an inactive element) are not recorded.

Java Application Monitoring

Extended monitoring supports Java applications that implement the Java Access Bridge technology. This enables the monitoring agent to track activity within a broader range of applications. Examples include Oracle, SweetHome 3D, etc.

To capture detailed user interaction data in Java applications, the Java Monitoring module must be enabled. Java Monitoring provides granular insights into Java application usage, aiding in analysis, optimization, and more effective management. With this module active, full extended monitoring data is captured for applications using Java Access Bridge; without it, only window title information is recorded.

Types of Events

• WindowOpen — whenever something new is opened (window, tab, file, URL, even if the window id has not changed)
• DocumentOpen — when a new document is opened
• DocumentSave — when a document is saved
• SheetOpen — when a sheet in Excel is opened or switched
• WindowSwitch — whenever switching between old tabs or windows
• WindowUpdate — whenever the title of the tab or window changes

Events that Are not Recorded

• Actions that do not change anything. For example, clicking a window, scrolling, moving the mouse over drop-down list elements
• Change of focus via arrow keys
• Clicking an editable field
• Switching to the desktop, the task bar, the Start menu, or the search bar and any actions therein

Peculiarities of Activity Recording

The UI Automation objects that are connected with an inactive browser tab stay permanently in the agent's memory.

HID Activity

The monitoring agent additionally records activity from Human Interface Devices (HID), such as the mouse and keyboard. HID activity helps identify periods of user activity and inactivity at the workstation.

User-initiated HID activity is classified as hardware events. Software-generated or simulated input is classified as injected events.

HID activity is recorded for the following actions:

• Mouse clicks: program (InjectedMouseClick) and hardware (HardwareMouseClick)
• Mouse scrolling: program (InjectedMouseScroll) and hardware (HardwareMouseScroll)
• Pressing keyboard buttons: program (InjectedKeyboardEvent) and hardware (HardwareKeyboardEvent)

Each event has a unique type represented by a numeric code. For detailed information about event types, see Logging Information.

HID event data is derived from the previous recorded event but updated with the corresponding HID activity type (HardwareMouseClick, HardwareKeyboardEvent, etc.). HID activity is only recorded for fields where prolonged interaction is expected, such as text input fields.

A HID event is logged relative to the most recently recorded event when the time interval between them is one minute or longer. However, the time between a HID event and the next user action event can be less than one minute.

If a user’s actions generate an event (such as window switching) every few seconds, HID events may not be recorded at all, since they occur too frequently to meet the one-minute threshold.

Work Algorithm

The system maintains two timestamps: the time of the last HID event and the time of the last HID event written to the activity log. When a new event occurs:

• If the current event time is greater than or equal to the last event time plus one minute, the previous HID event is added to the activity log, followed by the new event.
• If the current event time is greater than or equal to the time of the last recorded HID event plus one minute, the new event is added to the activity log.

In all other cases, only the timestamp is recorded.

Example 1:

A user types in a document. The last HID event was recorded at 10:00:00. They continue typing until 10:00:35, then step away from their desk for 5 minutes. At 10:05:20, they click the mouse in the document and resume typing. In this case, the agent records HID events at 10:00:00, 10:00:35, and 10:05:20.

By analyzing these timestamps, we can conclude the user was inactive from 10:00:35 to 10:05:20, as the interval between 10:00:00 and 10:00:35 is less than one minute.

Example 2:

A user is working in a browser. The last HID event was recorded at 15:00:30. They click in the browser at 15:00:55, pause briefly, and then click on another application at 15:01:20. The agent records only one HID event at 15:01:20, because the interval between 15:00:30 and 15:01:20 is less than one minute, making it unnecessary to record 15:00:55 as a separate HID event.