End User Monitoring

In IT operations, end user monitoring (often called end user experience monitoring, EUM or EUEM) measures what a person actually gets from an application: how fast a page loads, whether a transaction fails, how long a laptop takes to respond. The unit of interest is the experience, and the goal is to find slowness before the help desk phone rings.

In security and management, the same words describe watching what the person does: which programs and websites are used, when work starts and stops, which files and messages move. This is user activity monitoring, and it answers a different question: not whether the tool works for the person, but what the person does with it.

Both meanings rest on one idea: only the endpoint shows the full picture, because that is where applications, networks, and people meet. They differ in what they keep. A performance tool can discard identity once a metric is computed, while an activity tool exists to keep it. Application and website monitoring sits on the border, because the same time-in-application record serves both uses.

Whatever the purpose, collection follows a similar path. What changes is the choice of collection point and how long identity is kept.

1. 1

   Define the question

   Decide whether you are measuring experience, activity or both. The answer sets what is collected and who may see it.

2. 2

   Place collection points

   Instrument the application, install an agent on the device, or run scripted test transactions from outside.

3. 3

   Capture events

   Record page loads, errors, program launches, window titles, file and network operations, depending on the purpose.

4. 4

   Link events to context

   Attach each event to a device, a session and, where justified, a person, together with time and application.

5. 5

   Report and review

   Aggregate into dashboards, trends, and alerts, and keep raw events only as long as the policy allows.

The two uses are easy to blur, so it helps to compare them by the question each one answers. Many products mix both, and workforce analytics software is the clearest case of activity data turned into management metrics.

In Anexet Activity, the activity side of end user monitoring appears as per-user views. The application chart shows which programs took the most active time, and the daily timeline lays out events hour by hour, so a reviewer can see when something unusual happened.

1 / 2

• 
• 

Experience monitoring itself uses several methods, and they complement each other. Real user monitoring (RUM) measures actual sessions in the browser or the app. Synthetic monitoring runs scripted checks on a schedule. An activity agent on the device watches what the person does. None of them covers everything:

Most failures come from the same few habits, whichever meaning the team has in mind:

• Collecting everything because the agent can, for example, turning on keystroke monitoring when work-time totals would answer the question
• Treating averages as the experience: a fast median hides the minority of users on a poor connection or an old laptop
• Judging people by activity counts such as hours in one application, which rewards looking busy
• Keeping identity and raw events longer than the purpose needs
• Rolling out in silence, so employees learn about it from a rumor

Monitoring data is read by different people for different reasons, and access should follow the reason, not the job title alone.

Monitoring people is regulated. Data protection law, such as the GDPR in the EU, expects a clear purpose, a lawful basis, transparency toward employees, and proportionality: collect what the purpose needs and no more. Labor law can add duties of its own, such as informing or consulting employee representatives, and the rules differ between countries and, in the United States, between states.

A workable start is small. Write down the question, pick the least intrusive method that answers it, tell people what is collected, and look at individuals on an alert rather than by default. Where individual records are needed, tie them to insider risk management cases, and treat any automated scoring of a person as profiling, which carries its own legal weight.