Passive Capture

The Tealeaf Passive Capture software runs on one or more dedicated capture servers.

The following terms apply to the capture process:

• Switch - The switch is a hardware device that routes all incoming and outgoing data packets between your visitors' computers and your web servers. Typically, switches are configured using a hardware option called a switch, which delivers a copy of every HTTP packet to the capture server.
• Packet - The TCP/IP protocol organizes interaction between computers into packets. An individual Web page may be broken down into many packets, each transmitted individually between computers. The capture server typically monitors millions of packets traveling nearly simultaneously between your Web servers and visitors' computers. These packets may arrive in any order and sometimes must be retransmitted. The capture server can be configured to ignore packets that are not of interest, such as email messages or packets sent to IP addresses of servers not hosting the website.
• Request - The HTTP protocol defines a request as a message requesting a response from one computer to another. The capture server collects all HTTP data to recreate the request and response traffic.
• Response - A response is the return message to a computer, which has made a request. After capturing a request, the capture server then processes and assembles packets in search of the response to it.
• Hit - A hit is defined as a request and the corresponding response to it. After the hit has been collected, the Passive Capture software can scan the data to see if the hit is of interest. For example, images that appear on every web page are not very interesting and may be discarded. Also, sensitive information such as user names, passwords, and credit card numbers can be deleted. After removing unwanted data, the Capture software securely transmits the hit data to the Processing Server.
• SSL - Many website interactions are encrypted to protect the data from being read or manipulated by third parties. The Capture software has to decrypt the data in order to match requests and responses. Typically, the Capture software is configured to re-encrypt the software using SSL for transmission to the processing servers.

Processing

Tealeaf processing software runs on one or more dedicated processing servers, sometimes called canister servers. These servers are typically behind the company firewall and are not visible to the Internet. They accept connections from capture servers and receive hits for processing.

Each hit includes information that maps it to a specific visitor. This information is used to group the hits into a session. The following terms apply to Tealeaf processing:

• Session - As each hit is received, it is grouped with the other hits that apply to the same visitor's current interaction with your website. The processing server collects these hits until no more hits are received for the visitor or until a configured limit is reached. For example, if no more hits are received over an interval of 15 minutes, then the session may be considered complete. If a visitor performs an extended session, it may be necessary to end that session and to start a new one due time or memory constraints. While hits are arriving and being added to a session, the session is considered active. Tealeaf allows you to search for an individual session while it is still active and to view pages and interactions that have just occurred.
• Short Term Canister - Sessions containing hits are stored in an area of volatile memory on the processing server. As each hit arrives, it is added to a new or existing session.
• Event - As each hit is added to a session in the short-term canister, a series of events can be applied. An event is defined as a combination of a condition and an action.
  • The condition can be noteworthy information in the request or response code. For example, a match can be a 404 status code in the response or a particular text string such as "Purchase Confirmed."
  • When a condition evaluates to true, the action associated with the condition is performed. This action may be to increment a counter or to record a value. Event-related data is written to the short-term canister and may be aggregated into the report server. Some events are specific to a hit, while others can only be processed with the session. When a session ends and is written to the long-term canister, events that are associated with an entire session are evaluated. An event can be triggered off multiple conditions.
• Long Term Canister - As each session ends, either due to visitor action, lack of further hits within a timeout period, or insufficient memory to hold a longer session, it is encrypted for security and written to non-volatile storage on a hard drive. This area is called the long term canister.
• Index - As each session is written to the long term canister, the data within it is indexed for later searching. In most deployments, a selection of the most important data is indexed. After indexing, Tealeaf users can search on specific values, for example all sessions where the username field contained the value "smith."

Search, replay, and reporting

After the session data has been processed, it is available to Tealeaf users to monitor the health of their business and solve problems. Tealeaf includes several tools for these purposes.

• CX Portal - This web-based portal is the primary user interface to the Tealeaf system. It provides a wide variety of options for creating and viewing reports, including dashboards, scorecards, and other ad-hoc reports. It also provides a user interface to search for both active and completed sessions, a means to review and analyze data across search results, a means to replay a user session within a browser, and for administrative users, controls to manage the Tealeaf system.
• Search - The indexes created by the processing server can be searched through the Portal. It is also possible to search for text strings in currently active sessions in the short term canister. But the search for completed sessions in the archive is much more powerful; Tealeaf users can search for specific types of information, such as form field values, that are not yet indexed in active sessions.
• Replay - The ability to replay a session as a web visitor experienced it is unique to Tealeaf.

  Replay is a powerful tool for understanding the customer experience. When you search for sessions through the Portal, you see a list of sessions matching your search criteria. You can select one of these sessions and launch a replay of the session. During replay, you see the actual Web pages server to the visitor, the links the visitor clicked on, and the form fields the visitor edited. Also available is the HTTP request data that was sent from the visitor's browser and the actual HTML returned by the Web server.

  Additionally, users with Admin authorization can view page load details in real-time to assist with diagnostics and to help identify specific files that might be the cause of discrepancies in fidelity.

• CX RealiTea Viewer - In addition to the browser user interface for search and replay, Tealeaf also supplies a Windows™ desktop application called the Tealeaf CX RealiTea Viewer that Tealeaf users install on their own computers. This application includes additional options for configuring playback on the system.

Alerts

Email alerts can be generated based on event or non-event data in the Tealeaf system. This independent service uses its own database, and alert data is not used outside the alert system.

Alerts can be generated by hit and session events, as well as canister events, which are a set of predefined monitors for data in the Tealeaf Canister. Alerts can be delivered through Portal, SMS, Email, or SNMP. Only the preceding six hours of data is available to the alert service. The interval for checking for alerts can be set to as low as one minute.

You can configure the following components for an alert:

• Thresholds
• Measurement Intervals
• Ratios
• Blackouts