Internet Logging Software Recommendations

[crc-ict]

Hello,

 

I am looking for recommendations for an internet activity logging solution.

 

We currently have our internet filtering provided by our ISP, but they do not provide access to logs of all internet activity.

 

So, I am looking for a system we can implement locally which will provide me with full logging of all website visits made by network users. I don't need a filtering system because our connection does the filtering.

 

The ISP has suggested Securus, but I would prefer a system which doesn't rely on client components, especially as we are considering a future move away from traditional Windows-based devices for pupils, and the possibility of BYOD.

 

Just wondering what people are using?

 

Thanks.

[glennda]

Are you just purely after logging software?

 

Perhaps Squid and Dansguardian.

[Edu-IT]

Hello,

 

I am looking for recommendations for an internet activity logging solution.

 

We currently have our internet filtering provided by our ISP, but they do not provide access to logs of all internet activity.

 

So, I am looking for a system we can implement locally which will provide me with full logging of all website visits made by network users. I don't need a filtering system because our connection does the filtering.

 

The ISP has suggested Securus, but I would prefer a system which doesn't rely on client components, especially as we are considering a future move away from traditional Windows-based devices for pupils, and the possibility of BYOD.

 

Just wondering what people are using?

 

Thanks.

Plus in my experience Securus isn't the best for this sort of feature.

[crc-ict]

Are you just purely after logging software?

 

Perhaps Squid and Dansguardian.

 

Yes, it's just the logging we really need.

 

Are there any good how-tos out there for those two? I'm not really familiar with Linux based tools.

[tom_newton]

if it is just logging you don't need dansguardian - squid can do authentication and logging - all dg will add in that case is blocking (and a bunch of complication you won't want), which you seem to have covered. Who is your ISP?

[glennda]

if it is just logging you don't need dansguardian - squid can do authentication and logging - all dg will add in that case is blocking (and a bunch of complication you won't want), which you seem to have covered. Who is your ISP?

 

I didn't mean Dansguardian - I meant Sarg. I hadn't had my coffee!!

[crc-ict]

if it is just logging you don't need dansguardian - squid can do authentication and logging - all dg will add in that case is blocking (and a bunch of complication you won't want), which you seem to have covered. Who is your ISP?

 

That sounds promising. Our ISP is Exa Networks.

 

We have a NetAsq firewall provided by the ISP with two 'internet' ports - one is connected directly to the network for the 'general' filter and the other (providing a more restricted filter) is connected via an ISA server acting as proxy which is enforced via group policy for pupil devices.

 

Somehow, I need to set up logging for the internet traffic - at minimum on the proxied 'student' connection and preferably on all traffic.

[buzzard]

If all your traffics going via ISA is that not logging already? I'm sure there was a built in report for Web Usage??

 

Quick google - http://www.isaserver.org/articles-tutorials/configuration-general/Logging-Reporting-ISA-Server-2006.html

Edited November 4, 2013 by buzzard

[IrritableTech]

That sounds promising. Our ISP is Exa Networks.

 

We have a NetAsq firewall provided by the ISP with two 'internet' ports - one is connected directly to the network for the 'general' filter and the other (providing a more restricted filter) is connected via an ISA server acting as proxy which is enforced via group policy for pupil devices.

 

Somehow, I need to set up logging for the internet traffic - at minimum on the proxied 'student' connection and preferably on all traffic.

 

This was my biggest worry with Exa when we looked at their offering - the lack of monitoring options with their bundled filter.

 

However I do believe they can supply a NetAsq box, which will do some reporting on usage. How good or bad it is however - I do not know.

 

In my opinion, the monitoring of the usage is the single most important part of a filtering solution.

Edited November 4, 2013 by IrritableTech

[crc-ict]

If all your traffics going via ISA is that not logging already? I'm sure there was a built in report for Web Usage??

 

Quick google - Logging and Reporting in ISA Server 2006

 

Thanks for this - I've had a look at the ISA reporting and I can't see any per user log data I can access. But I will have a look at the link and dig a little further.

 

Cheers!

[tom_newton]

That may be because you aren't authenticating in ISA - this is almost certainly doable. If you already have an ISA proxy, plus whatever EXA are up to I would seriously caution against adding another (eg. squid) box into the mix, it will make troubleshooting an order of magnitude harder.

[buzzard]

Agree with Tom here, don't add another one in here, either replace ISA/TMG with a solution or work with ISA, it isn't the best but it is what you've got, and I assume there isn't a budget to look for something new? There are/where 3rd party plugins for ISA that did the reporting bit better, but it is a while since I used it! You can pull per user out of ISA if as Tom mentions if you have auth on (which I'd have anyway to ensure it's that user) by (from that article I linked to)

 

Extracting Per-User Details from ISA Logs

 

Log data can be written to a text file, however, even in small and medium-sized business environments the text file can quickly grow to a cumbersome size. The better logging options are to use a SQL Server database, or SQL Server’s scaled down cousin- MSDE. There are some security and performance advantages to using an external SQL Server for maintaining log data, but SQL Server requires separate licensing. MSDE provides many of the same features as SQL Server, but in a less robust database that runs locally on the ISA Server.

 

Regardless of whether you store log data in MSDE or SQL Server, you can use SQL queries to extract information. SQL queries enable you to filter log data on a very granular level and export data to Excel spreadsheets where it can be easier to work with and manipulate it.

 

For example, assume that while reviewing a standard daily ISA Server 2006 Security report you notice an inordinate number of failed authorization attempts by one specific user account, MaryN. The user in question is out on maternity leave and the Failed Access events appear to indicate an attempt to compromise the user account and breach the network. What you would want to do is to review data which is specific to this user account over the past week and try to determine the scope of the problem and at what point the issue began.

 

When filtering the log data, you need to specify the criteria that you want to filter, the conditional argument to apply, and the value. In our example you might filter on the following:

 

Filter by: ‘Client Username’

Condition: ‘equal to’

Value: ‘MaryN’

[JohnWilliamsGomez]

I would suggest BrowseReporter.

 

But it requires you to install a client on each computer.