application and user logging

[Russ Allbery]

Peter Scott <Peter.J.Scott@jpl.nasa.gov> writes:

> We are considering monitoring based upon the count of number of volume
> accesses within the last day.  Not totally accurate perhaps, but seems
> as though the noise should not swamp the signal.  And since we're using
> depot, every tool for every platform has it own volume.

> Has anyone successfully used this approach?  Or proved it fruitless?

I've used that before as a fallback (we use a locally-written package
management system that's something like a simplified depot, and similarly
have every package in its own volume).  In my experience, it works
reasonably well for telling whether a package is used at all (there are a
few spurious hits from people exploring, but not many).  If you want to
tell whether a package is lightly used vs. moderately used vs. frequently
used, though, it's not nearly as good.  Different packages can produce
widely differing patterns of access numbers depending on how they work,
whether they use supporting files, etc.

That's the main reason why we started using the wrapper method for
tracking software where we really cared about absolute numbers.  We use it
for site-licensed software so that we know whether continuing to pay for
the license is worthwhile (and therefore light usage vs. moderate usage
can be important to know).

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>