1407608 - Why are clients sending so many main pings?

Status: NEW

(Toolkit :: Telemetry, defect, P4)

Description

[Chris H-C :chutten]

A recent look at "main" ping frequency per client[1] has shown that quite a lot of them are sending more than four "main" pings per day.

Why? This seems high. My about:telemetry doesn't show a day where I send more than three, and that's including "saved-session" as a "main" ping (_are_ "saved-session" pings in main_summary?)

Questions:
1) These heavy clients, are they the same day-over-day, sending 4+ pings every day for a week? A month? Or is it a rotating population?

2) These heavy clients, are they from particular versions? Particular regions?

3) Pick one or two heavy clients from, say, the 10 pings per client per day bucket and see if their pings make sense. What are they describing? Do the subsessions make sense?

4) Are "saved-session" pings included in main_summary? Not sure we want them to be included in Telemetry Health analyses, if so.

[1]: https://sql.telemetry.mozilla.org/queries/43301/source#117251

Comment 1

[Mark Reid [:mreid]]

(In reply to Chris H-C :chutten from comment #0)
> 4) Are "saved-session" pings included in main_summary? Not sure we want them
> to be included in Telemetry Health analyses, if so.

No, the main_summary table is a one-to-one representation of main pings.

One suggestion I have is to have a look at the "reason" field[1] as a facet, perhaps there is a common pattern of environment changes (enabling/disabling an addon frequently?) or many shutdown pings indicating short sessions.

[1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/data/main-ping.html

Comment 2

[Chris H-C :chutten]

An ad-hoc reason analysis looking at 1% client sample of pings received on Oct 1 shows it is by far the number of "shutdown" pings per client that day that exhibit the behaviour.

Very few clients send more than one "daily" or "environment-change" ping per day. Extremely few send more than one "aborted session". Essentially no one sends more than one "idle-daily" ping on a given day.

Now, "shutdown" pings make up over 80% of all pings sent, so this _could_ be related to that... except that "shutdown" pings make up a disproportionately-large proportion of pings sent more than once that day.

This analysis is looking at a window of size 1 day, examining all pings received on that day. Maybe with a wider window, or by looking at subsession start date we can get a different picture of how much of this is pings being batch-sent and how much of this is clients trying some shenanigans.