Indices in EZproxy Analytics

Learn about the data available in EZproxy Analytics.

EZproxy Analytics consists of two primary log datasets, each serving distinct analytic purposes:

Audit logs (index named audit-*)
EZproxy‑plus‑ezPAARSE logs (index named ezpaarse-*)
Starting point URLs (index named spu-*)

Data type overview

Data type	Description	Example Use-Case	Frequency
Audit logs (audit-*)	User authentication events (login success/failure, sessions)	Detect unusual login failures by region or user group	Nightly
Access events (ezpaarse-*)	Resource usage (platform, provider, database, type, MIME)	Identify which journals or platforms are most accessed to guide renewals	Nightly
Starting point URLs (spu-*)	Real‑time referrer/source of session initiation	Determine how users discover resources (catalog, portal, search engine)	Real-time

Audit logs (audit-*)

Definition: Records of authentication and security events, including login attempts, successes, failures, password retries, and session expirations. This data is loaded nightly.

Use cases:

Security monitoring: Spot repeated login failures by user ID or IP to detect compromised accounts or attackers.
Support tracking: Identify patterns of login failures by user group (e.g., students or faculty) to drive training or support interventions.
Policy compliance: Demonstrate adherence to authentication policies or detect anomalies by geography or time.

Example scenario:

A spike in failed login attempts from a certain region triggers an alert—help desk staff then investigate to see if an account is being targeted or if certain authentication workflows need review.

Access event logs (ezpaarse-*)

Definition: Enriched access-event data that tracks which e‑resources users actually access (platform, database, resource type, MIME type), along with timestamps and metadata. Data is enriched using the open-source ezPAARSE tool and also loaded nightly.

Data fields can include:

Platform (e.g. JSTOR, Science Direct)
Resource type (e.g. Table of Contents, full‑text, abstract)
MIME type (e.g. HTML, PDF)
Database or publication title

Use cases:

Collection development: Understand which platforms or journals are most heavily used to inform renewals or cancellations.
Usage reporting: Use these reports to track usage independently of vendor data, offering a valuable supplement to COUNTER metrics.
Instruction planning: Identify resource formats most accessed (PDF vs. HTML) to guide user training or tutorials. This knowledge can be valuable for resource allocation decisions, collection development strategies, or tailoring services to meet the needs of specific user segments.

Example scenario:

Library staff notice a platform’s heavy usage in a semester and uses this data to negotiate renewals or explore similar resource coverage to support curricular alignment.

Starting point URL logs (spu-*)

Definition: Real‑time index showing the URLs where user sessions originate—effectively, where patrons discover or click into e‑resources. This data is available in real time (not just nightly).

Use cases:

Discovery analysis: Understand where users are entering the system—e.g. from library catalog, electronic resource portal, or external search engines.
UX optimization: If many sessions start from one internal or external referrer, the library may optimize signage or links.
Marketing or outreach: Identify referring sites that generate high click-through rates to resources.

Example scenario:

A large number of sessions originate from the library’s course‑resource page, prompting improved integration with that portal or creation of tailored resource guides.