Session tracking strangeness

[rouilj]

I have the following trace (sql generating it is below) tat is confusing:

2FDA25EAF04B48C7A7EE9CDB3B0FFA39
   2023-06-24 22:05:58 /www.roundup-tracker.org/index.html de.wikipedia.org h
   2023-06-24 22:06:06 /www.roundup-tracker.org/docs/design.html www.roundup-tracker.org h
   2023-06-24 22:06:26 /www.roundup-tracker.org/index.html www.roundup-tracker.org/docs/design.html h
   2023-06-24 22:07:22 /www.roundup-tracker.org/index.html pypi.org h
   2023-06-24 22:07:26 /www.roundup-tracker.org/docs.html www.roundup-tracker.org h
   2023-06-24 22:07:35 /www.roundup-tracker.org/index.html www.roundup-tracker.org/docs.html h
   2023-06-24 22:07:39 /wiki.roundup-tracker.org www.roundup-tracker.org h
   2023-06-24 22:07:44 /wiki.roundup-tracker.org/AdministrationExample wiki.roundup-tracker.org h

5E0D86E93A684182A1DB855756CF56AD
   2023-06-24 22:07:47 /wiki.roundup-tracker.org/RecentChanges wiki.roundup-tracker.org/AdministrationExample h
1 2023-06-24 22:07:48 /wiki.roundup-tracker.org/FindPage wiki.roundup-tracker.org/RecentChanges h
   2023-06-24 22:07:50 /wiki.roundup-tracker.org/HelpContents wiki.roundup-tracker.org/FindPage h
   2023-06-24 22:07:58 /www.roundup-tracker.org/code.html wiki.roundup-tracker.org h
   2023-06-24 22:08:39 /www.roundup-tracker.org/index.html www.roundup-tracker.org/code.html h
* 2023-06-24 22:09:12 /wiki.roundup-tracker.org/FindPage wiki.roundup-tracker.org/RecentChanges h
   2023-06-24 22:09:12 /wiki.roundup-tracker.org/RecentChanges wiki.roundup-tracker.org/AdministrationExample h
   2023-06-24 22:09:12 /wiki.roundup-tracker.org/AdministrationExample wiki.roundup-tracker.org h
   2023-06-24 22:09:12 /wiki.roundup-tracker.org www.roundup-tracker.org h
   2023-06-24 22:09:13 /www.roundup-tracker.org/index.html www.roundup-tracker.org/docs.html h
   2023-06-24 22:09:14 /www.roundup-tracker.org/index.html pypi.org h
   2023-06-24 22:09:36 /www.roundup-tracker.org/index.html www.roundup-tracker.org/docs/design.html h
   2023-06-24 22:09:37 /www.roundup-tracker.org/docs/design.html www.roundup-tracker.org h
   2023-06-24 22:09:37 /www.roundup-tracker.org/index.html de.wikipedia.org h

Note there are two sessions identified. The last page shown in the first session is the source page of the first page in the second session. Also in the second session starting with "*" it looks like the user is using the back button in the browser to unwind the stack starting at "1".

Does my analysis look right? If so any idea why the session changed?

Can I link the session id to a browser version or OS to tell if the user was using a desktop browser (which is unlikely to change IP) or a mobile device. I think I can't by design but...

I also assume the only reason I have a log of the unwinding stack is because it occurred in a different session. I wouldn't see that if the session was the same right?

The script used to generate this report is:

./goatcounter-v2.4.1-linux-amd64 db query "
       WITH
        sess (session) as
        (
          select distinct(hex(session))
             from hits
             where hits.created_at >= datetime('$1', 'utc')
                   and hits.created_at < datetime('$1', '$2', 'utc')
             order by hits.created_at DESC
        )
      select sess.session, hits.created_at, paths.path, hits.ref, hits.ref_scheme
      from paths, sess
        inner join hits on hits.path_id = paths.path_id
       where hex(hits.session) == sess.session
       order by hits.created_at;
" |  awk 'NR > 1 { if ($1 != lastsess) {
              lastsess = $1; print "\n" $1}; $1="  "; print $0 }'

where $1 and $2 in the SQL command are the date/time to start the report and the number of hours to
report. For example: ./session_trail_cte.sql 2023-06-24T18:00:00 '+4 hours'. The awk just indents the hits under the session label.

Thanks for any light you can shed on this. It isn't the first time I have seen what looks like a single user session split across multiple goatcounter sessions.