A utility operates on a networked PC and periodically executes a callback process to capture data to create discrete events. The callback process is periodically started, and it writes an event f either a frame period of 15 mins. has expired or the used application has changed, whichever is earlier. A protection program executes in parallel with a main program, both checking for a mutex of the other and re-starting the other if the mutex ceases to exist. Event data is automatically classified according to productivity classifications associated with applications.