# Reports

> Email reports on a period that has ended, compared with the period before, and how each person chooses which reports to receive.

## What a report is

A report is an email that sums up a period that has ended, such as yesterday or last week. Each report shows the same figures as a page in SaneLog, compared with the period before, so you can see what changed. Every sent report is also kept in an archive that you can open as a page.

Open **Reports** in the sidebar to choose which reports you receive and to read the ones already sent. A Billing Only user finds **Reports** below the **Billing** group.

## How reports work

### Choosing your reports

Each report on the **Reports** page has a **Send me this report** setting. Choose **Daily**, **Weekly** or **Monthly** (whichever the report offers), or **Never** to stop receiving it. The choice is saved as soon as you make it, and applies to you only.

Who starts subscribed:

- A user created as an Account Admin starts with the log analysis report set to **Weekly**, and can change or stop it.
- Everyone else starts with every report set to **Never**.
- Giving someone a new access option later does not subscribe them to anything.

Who can see which report:

- The log analysis and log volume reports are offered to every user except a Billing Only user.
- The account usage report is offered to people who can see billing: Account Admins and Billing Only users.
- A Read Only user can subscribe to any report offered to them.
- A deactivated user receives no reports, whatever they chose.

### When reports are sent

Reports are sent at 7:00 am in the account's timezone (the **Default timezone** in **Account** > **Settings**), on the morning after the period ends:

| Frequency | Sent | Covers |
|---|---|---|
| **Daily** | Every morning | The previous day |
| **Weekly** | Every Monday | The previous week, Monday to Sunday |
| **Monthly** | On the 1st of each month | The previous calendar month |

Each report is built once per account for each period, and the same copy goes to everyone subscribed at that frequency.

Some edge cases:

- A report is never sent twice for the same period.
- A report is only built when at least one person is subscribed to it at that frequency.
- A period that ended before the account was created is not sent.
- If a report cannot be built at 7:00 am, SaneLog tries again every hour. A report that still cannot be built when the next period's report is due is not sent.

### Sent reports

Every sent report is listed under **Sent reports** on the **Reports** page, with its period, its frequency, when it was sent and how many people received it. Choose a report's name to open it as a page with the same figures as the email. The email's **Open this report** button opens the same page.

**Sent reports** lists only the reports offered to you, so a Billing Only user sees only account usage reports there.

Sent reports stay in the archive for twelve months.

## Log analysis

The log analysis report is the [Log Analysis](https://app.sanelog.com/docs/log-analysis.md#reading-the-page) page for the period. It shows:

- The number of lines, and the number at warning and above, each compared with the period before.
- The patterns that are new this period and the biggest risers and fallers (up to five of each).
- Every program with its biggest patterns (up to five per program), and how many more patterns that program had.

On the report's page, **Open in Log Explorer** beside each pattern opens the Log Explorer with an expression that matches that pattern's lines. The Log Explorer opens at the end of the report's period, showing the lines that led up to it.

The log analysis report is offered daily and weekly only, because a month of events can be longer than the account's retention.

## Log volume

The log volume report shows how much each source sent over the period, in lines and bytes, compared with the period before. It lists:

- The sources that started sending and the ones that stopped.
- The fifteen biggest sources by bytes, followed by one row that adds up all the other sources.

On the report's page, each source's name opens the Log Explorer on that source.

The log volume report is offered daily, weekly and monthly. Its figures come from SaneLog's hourly totals of received logs, which are kept for two years, so a monthly report is complete even when the account's retention is shorter than a month.

For a monthly report, the period before is the whole previous calendar month.

## Account usage

The account usage report is the [Plan](https://app.sanelog.com/docs/billing.md#plans-and-retention) page for the period. It shows:

- The plan, whether it is paid, free or lapsed (with its end date, where there is one), and the retention it gives.
- How many sources are in use out of the number the plan includes, and how many sent lines during the period.
- The logs received in the period, in lines and bytes, compared with the period before.
- How much of the month's log allowance had been used by the end of the period.

The account usage report is offered weekly and monthly. It is the only report a Billing Only user can receive.

For a monthly report, the period before is the whole previous calendar month.