API: Log some general use metrics for APIs.

[kcondon]

Seeing as the usage profile for APIs may be significantly different than for UI, it may be useful to record some general metrics for API use: timeofday, function/ request/ user/ ip addr.

We could/should? also consider adding Google Analytics calls when API is accessed as we do in the UI.

[pdurbin]

API metrics have been discussed here as well:

• https://trello.com/c/rvkuEPhw/9-metrics-for-api-usage
• https://lists.iq.harvard.edu/pipermail/pkp-dataverse-integration/2014-April/000059.html
• http://irclog.iq.harvard.edu/dvn/2014-04-14
• http://irclog.iq.harvard.edu/dvn/2014-04-15

[eaquigley]

@pdurbin I reviewed the four links you have listed in the above comment. To clarify, the comments in the Trello card are the suggested implementation, yes? Is that only for the Data Deposit SWORD API or for all APIs?

[pdurbin]

@eaquigley the Trello comments suggest tracking who deposited something based on who authenticated, which makes sense.

I would imagine we would want tracking not just for SWORD but any API.

It seems like @posixeleni has definite an initial use case/user story at https://lists.iq.harvard.edu/pipermail/pkp-dataverse-integration/2014-April/000059.html

[eaquigley]

Planning doc: https://docs.google.com/document/d/1f6oGi9DjiCFGJyWxhzymdOSxROcgxpExlvu1kGA0hH0/edit

[kcondon]

@pdurbin @eaquigley
My use case was to understand how much load is coming from API use. I don't believe API calls are covered by Google Analytics but we can just look at the access logs. Not sure if there is some better way or other use cases such as Eleni mentioned.

[posixeleni]

@kcondon @eaquigley @pdurbin on top of my use case I think like Kevin said its important to know how many people are uploading, updating (generally managing) datasets via an API vs the GUI. This would help us prioritize new API features in the future.

[michbarsinai]

I'd steer clear of IP addresses and users - these have privacy implications, and I'm not sure we want to go there unless we have some good reason to.
Other than that - great idea. We can also expand a bit, and have the engine store statistics about the commands it executes.

[pdurbin]

I'd steer clear of IP addresses and users - these have privacy implications, and I'm not sure we want to go there unless we have some good reason to.

@michbarsinai #2729 (comment) has IP, username, country, city, etc.

[pdurbin]

I don't believe API calls are covered by Google Analytics but we can just look at the access logs.

Right. Google Analytics depends on cookies so downloads done by scripts hitting Dataverse APIs won't be included. Over in #4481 I'm starting to look into server-side solutions that could give us metrics for all HTTP traffic, regardless of if it's made through the GUI or via a script or whatever. As @kcondon indicates, every request is logged to a Glassfish access log (if it's enabled) or an Apache access log (if Apache is being used).

[djbrooke]

I'm going to close this, as we have Splunk Cloud at Harvard to generate reports/notifications about API usage and other groups could set up the log monitoring software of their choice.

[kcondon]

@djbrooke I'm fine with whatever we decide but the intent was for IQSS Dataverse and by extension other installations, to have a quick and easy dashboard to understand site/load usage and APIs were and are an area where batch access and therefore high load is likely.