Download the product examples: API scripts, Power Query, OData flows, test CI files and Power BI connector source. The gateway archive includes its full deployment README.
It answers the questions a modernization program usually pays for in interviews: which transactions matter, who uses them, which ones nobody uses any more, and how many hours a year people spend waiting for the host.
Your license needs to include Usage intelligence. Sample data works without it.
What you see
In the app. Ctrl+K, Operations. The Response times tab is the view you know. Next to it:
- Applications. Each connection (PROD, IBMI): transactions, people, departments, median and 90th percentile wait, timeouts, errors, sessions, and hours waited, the time people spent waiting for the host. Each number has its change since the period before. Below it, response times that changed in the period, in plain English.
- Transactions. Each transaction: your ResponseTimeLabels label, or the screen's title line when you collect titles, or the screen signature. The same numbers, the most frequent error codes, and the hours of the day it is used. Then Suggested labels (screens with a title and no label, as lines to paste into the policy) and Not used this period (screens used the period before and not in this one, which may be ready to retire).
- Departments. People, transactions, the five transactions each uses most, the 90th percentile and hours waited.
- Errors. Each code (S0C7, ASRA, CPF2817, or "operator" for a locked keyboard), what it is, how often, on which transactions and in which departments, and the change.
Pick 7, 30 or 90 days. Each period is compared with the same number of days before it. Save CSV and Save PDF put the report in Documents. The CSV has a table per tab. The PDF, "Mainframe usage report", has a cover with the period and the privacy settings that were in force, then a page per tab.
The app reads the response time folder (ResponseTimeFolder) or this computer's own history, as the Response times tab does (Data source). When InsightUrl is set, the tabs show your gateway's report address too.
On the gateway. https://<gateway>/insights shows the same report to the people in [insight] viewers_group, for everyone the gateway collects from. CSV and PDF are downloads.
From a script. wnd-automate insight report --from <folder|url|sample> --days 30 --out report.pdf (or .csv, .json) for shops without a gateway, or for a scheduled job. Without --out it prints a summary:
Mainframe usage report, September 17, 2026 to October 17, 2026 (30 days)
61,010 transactions by 38 people in 2 applications (57,102 the period before). 9.0 hours waited.
Most frequent error: ASRA (2,308 times, most on CICS Payments).
3 suggested transaction labels in the report.
wnd-automate insight sample FOLDER writes a fictional bank's records (six departments, 180 days) to try it all with.
Turning it on
- Measure. In the policy, RecordResponseTimes = true. Every copy of WND Terminal times each Enter, PF, PA and Clear key and sums it up per minute (see policy/README.md, Response times). With a ResponseTimeFolder, the app's tabs already work for everyone, with no gateway.
- Collect at the gateway (for
/insights, and for desktops that can't reach a shared folder). On the gateway runwnd-gateway new-collector-token. It prints a token and the lines for the gateway's configuration:
toml
[insight]
collector_token_sha256 = "..."
viewers_group = "WND Usage Report"
In the policy, set ResponseTimeCollectorUrl to https://<gateway>/collect and ResponseTimeCollectorToken to the token. Optionally InsightUrl to https://<gateway>/insights.
3. Name your transactions. With ResponseTimeIncludeTitle on for a week, the Transactions tab suggests a ResponseTimeLabels line for every screen without one. Copy them into the policy, then turn titles off again if you like.
Desktops send their records in batches, on a thread of their own, from a queue on disk (at most 5,000 records, the oldest dropped first), and try again after 5 seconds, then 10, 20, and so on up to every 5 minutes, while the gateway can't be reached. With RecordResponseTimes on in the gateway's policy, the gateway's own sessions (WND Terminal in a browser) go into the same files, each person counted by a pseudonym.
The settings
On a small screen, swipe the table to read all columns.
| Setting | Default | What it does |
|---|---|---|
| ResponseTimeCollectorUrl | none | The gateway's /collect. |
| ResponseTimeCollectorToken | none | Its token. Both are needed. |
| ResponseTimeIncludeDepartment | on | The department (Department, or the people file's) goes with the records. |
| ResponseTimeIncludeErrors | on | Error codes are counted. |
| ResponseTimeIncludeTitle | off | The screen's title line goes with the records, masked. |
| ResponseTimeIncludeUser | off | The computer login goes with the records. Off, people are counted by computer. |
| InsightMinGroup | 5 | A department with fewer people than this in the period is shown as "Other". |
| InsightUrl | none | The gateway's report, for the app to point to. |
On the gateway, [insight]: collector_token_sha256, keep_days (400), max_mb_per_day (1024), viewers_group, service_accounts (for Power BI) and folders (more folders of day files to include). See gateway/README.md.
What the report can and can't show about people
The privacy rules are part of the product, applied where the report is built, so they hold in the app, on the gateway's page and in every CSV, PDF and JSON file:
- No screen contents. Transactions are known by the labels your IT team writes, and by screen signatures: a short code for where a screen's fields are and how long they are, never what is in them. The one exception is the title line, only when IT turns it on, masked on the computer before it leaves.
- People are counted, not named. Without ResponseTimeIncludeUser the login is never sent, and "people" means computers. With it, the report still shows only numbers.
- Small groups disappear. A department with fewer than InsightMinGroup people in the period (5 unless your IT team sets it) is shown as "Other", everywhere. When "Other" would still have fewer people than that, the next smallest department is shown as "Other" too, so no small group can be worked out from the rest of the report. The period before is folded the same way, on its own numbers.
- Nothing goes to WND Software. The records stay on your computers, your shared folder and your own gateway.
Show this page. In WND Terminal, Ctrl+K, What your organization collects lists, from the policy in force on that computer, which of these are on, in plain words. It is the page to show a works council, and it's the same in the browser.
Every field that leaves a computer:
On a small screen, swipe the table to read all columns.
| Field | What it is | Why | Kept | Who can see it | Turned off by |
|---|---|---|---|---|---|
time, epoch |
The minute | Trends, hours of the day | 8 days on the computer, until IT deletes them in the shared folder, keep_days (400) on the gateway |
IT with access to the share, and on the gateway viewers_group, the service accounts in [insight] and the gateway's administrators |
RecordResponseTimes off |
computer |
The computer's name (on the gateway, the gateway's name and a short hash of the person's login) | Counting people | as above | as above | RecordResponseTimes off |
user |
The computer login | Counting people who share a computer | as above | as above | Off unless ResponseTimeIncludeUser is on |
department |
The department from Department or the people file | The Departments tab | as above | as above (departments under InsightMinGroup are shown as Other) | ResponseTimeIncludeDepartment off |
connection, host, host_type |
The connection's name, host and port, 3270 or 5250 | The Applications tab | as above | as above | RecordResponseTimes off |
lu |
The terminal (LU) or IBM i device name | The Response times tab | In the shared folder and Splunk only, never sent to the gateway | IT | RecordResponseTimes off |
label |
Your IT team's name for the transaction | The Transactions tab | as above | as above | Leave ResponseTimeLabels empty |
signature |
A code for the screen's layout | Telling screens apart | as above | as above | RecordResponseTimes off |
count, p50_ms ... max_ms, ttfb_*, timeouts, sum_ms |
How many transactions, how long they took | Wait times, hours waited | as above | as above | RecordResponseTimes off |
errors, codes |
How many answers showed an error, and their codes (the code only, never the message) | The Errors tab | as above | as above | ResponseTimeIncludeErrors off |
title (a "screen" record) |
The screen's title line, once a day per screen: only the screen's own text on that line, never typed text, masked (card numbers, passwords in commands, MaskPatterns), at most 40 characters | Naming screens, suggesting labels | as above | as above | Off unless ResponseTimeIncludeTitle |
start, end, active, keys (a "usage" record) |
Each session's start, end, active seconds and keys sent | Sessions and active hours | keep_days on the gateway |
as above | RecordUsage off, or no collector |
Some hosts show a user ID or a name on a screen's title line ("ENTER PASSWORD FOR JSMITH"). If yours do, add a pattern for it to MaskPatterns, or leave ResponseTimeIncludeTitle off. The gateway masks title lines again with its own policy's MaskPatterns when it receives them.
Anyone with the collector token can send records to your gateway, so treat the token like a password. If it leaks, make a new one with wnd-gateway new-collector-token, put the new hash in the gateway's configuration and the new token in the policy. The gateway takes at most [insight] max_mb_per_day a day from every desktop together, which protects its disk.
Power BI and Excel
The day files are plain JSON lines, one record a line, a file a day: response-YYYY-MM-DD.jsonl on computers and in the shared folder, YYYY-MM-DD.jsonl in the gateway's <data_dir>/insight. Lines without a kind are per-minute summaries. "kind":"screen" and "kind":"usage" are the other two.
examples/insight/powerbi.pq is a Power Query that reads either a folder of day files or the gateway's /insights/data.json with a bearer token (a service account named in [insight] service_accounts, which wnd-gateway new-agent-token makes). In Power BI Desktop: Get Data, Blank query, Advanced Editor, paste it, set Source and Token at the top. To give others the report, make Source and Token parameters (Manage Parameters) and save it as a template (File, Export, Power BI template). A .pbit asks only for values that are parameters, so it then asks for those two. See examples/insight/README.md. Excel's Power Query takes the same query.
/insights/data.json?days=30 answers the whole report as JSON (the shape wnd-automate insight report --out report.json writes): totals, applications, transactions, departments, errors, unused, suggested_labels, changes and privacy, each row with a previous for the period before.
The collector
POST /collect takes Authorization: Bearer <token> and a body of JSON lines. A body can be at most 1 MB, and a computer (named by the X-WND-Computer header) can send at most 60 requests a minute. The answer is {"accepted": n, "rejected": m}. Lines that aren't one of the three records are left out.
On a small screen, swipe the table to read all columns.
| Status | When |
|---|---|
| 200 | The records were taken. |
| 400 | No line in the body is a record WND Terminal sends. |
| 401 | The collector token is missing or wrong. |
| 403 | The gateway's license doesn't include Usage intelligence. |
| 404 | The gateway has no [insight] section, or no collector_token_sha256 in it. |
| 413 | The body is over 1 MB. |
| 429 | Too many requests from this computer. The answer has Retry-After: 60. |
| 429 | The gateway reached its limit for the day, [insight] max_mb_per_day (1024 unless you set it), for every desktop together. The answer has Retry-After: 3600. Desktops keep their records and send them later. |
| 503 | The gateway couldn't keep the records. Desktops send them again later. |
Audit
insight.view the first time a sign-in reads the report on the gateway (or each time a program does), with the viewer and the period. insight.export for each CSV or PDF, on the gateway and in the app.
How it's built
crates/wnd-core/src/response.rs measures and sums up. It takes the error code from the code hints' reference (hints::error_code) once per answered transaction, and the masked title line when the key is pressed. crates/wnd-core/src/insight.rs reads the day files and builds the report, with the department fold and the period before, and writes CSV, JSON and PDF. crates/wnd-app/src/response_times.rs sends to the collector. crates/wnd-gateway/src/insight.rs is /collect and /insights. src/InsightPanel.tsx is the tabs, in the app and on the gateway's page.