Need a simple web browsing logger

[kjuenke]

The boss wants to log web browsing. I need a simple, cheap hardware or software solution that will just log the web sites visited.

We have a T1 connection with a Siemens se5940 router, three W2K servers, one domain, 54 clients, use DHCP with private IP addresses and an HP ProCurve 4000 switch.

We don't want any fancy filtering. Ideally, I would like to put a piece of hardware between the router and our switch that will just send the URL's to a log somewhere.

Anyone know of a nice way to do this?

 

[Salem]

Are any of those acting as a firewall between you and the outside world?

I use IPCop as my firewall. One of the additional features is a nice log of all the websites visited, with a timestamp and the local IP which made the request.
Here's a little snip

00:00:26  192.168.1.53  [URL unfurl="true"]http://pagead2.googlesyndication.com/pagead/ads?[/URL]
00:00:26  192.168.1.53  [URL unfurl="true"]http://www.tek-tips.com/threadminder.cfm?[/URL]
00:00:31  192.168.1.53  [URL unfurl="true"]http://pagead2.googlesyndication.com/pagead/ads?[/URL]
00:00:32  192.168.1.53  [URL unfurl="true"]http://www.tek-tips.com/threadminder.cfm?[/URL]
00:00:39  192.168.1.53  [URL unfurl="true"]http://www.tek-tips.com/viewthread.cfm?[/URL]
00:00:39  192.168.1.53  [URL unfurl="true"]http://pagead2.googlesyndication.com/pagead/ads?[/URL]

Another idea would be to run ethereal network analyser on a machine connected to the local network, and set up rules to record browser requests.

http://www.ipcop.org/cgi-bin/twiki/view/IPCop/WebHome

http://www.ethereal.com/

--

 

[pansophic]

You can install Squid on a computer (even a really old one) running Linux and either force all of your users through it, or put it in series as a transparent proxy. This is what IPCop and all of the Linux firewalls that I have tested use for a proxy.

You also gain some caching, so that users' browsing experience will be accellerated, especially on sites that reuse the same graphics on many pages.

But ethereal or TCPdump are really nice to have because you can log the SSL sessions as well. You can't read the content, but you get to see the initial request and all of the subsequent hits.

Or you can run ISA if you are a Windows only shop.


pansophic

 

[Xemus]

Check into the documentation on your router. Most cheap routers (Netgears, et al) now have built in logging features. Your Siemens router might have the capability.

http://www.closedsocket.com

 

[Grenage]

Proxy Server 2 can be picked up on ebay for very little,and would give you decent logging and internet access via username etc.

For something more current ISA is apparently good although I have not had the opportunity to use it myself.