Web Logging

[gh256]

Hi,

 

We have a CC3 network and have RM Auditor. There is an add on to that what allows you to log all users Internet activity eg what sites they have been on. This costs a fortune for the add on. I was wondering if you know of any other way which does a similar thing for a lower price, preferable free as we hardly have any money at all lol.

 

Thanks, Glenn

[maniac]

The best way of doing this I think would be to set up a proxy server, and push all your internet traffic through it. There's lots of free linux based solutions that will do this, like IPcop which are relatively easy to install and configure to log traffic. You can also get handy useage statistics out of it and a whole lot more, including content filtering etc.

 

I'm sure someone can name a few more better ones than IPcop, but it's the only one I can remember.

 

Mike.

[gh256]

I think our internet allready goes through a proxy, in internet options you have to have the proxy ticked and an ip address under the connections menu.

 

I dont know exactly what it is though.

[SpuffMonkey]

Someone posted a script to do this on here some time ago - it worked great - and we were using it up til we installed Smoothwall a little while ago.

[gh256]

Any idea where it is, or what it was called?

[Ric_]

@gh256: It's simple enough to use an upstream proxy with any of the free and paid-for solutions. Take a look at SmoothWall, IPCop, Endian Firewall and MS ISA Server as some common examples.

[Enzomatrx]

I use a vbs script someone posted it, runs at logoff via GPO for whoever we apply the GPO to.

 

It parses Internet Explorer's History and compiles a HTML file based on the username of the person. We currently run it on our Junior High students, since they're the ones we trust the least

 

You can see in the script where the output files are created, modify it as needed and make sure there permissions for everyone to at least be able to write/modify in that dir.

 

Be sure to change \\SERVERNAME\SOMEFOLDER\ in the file to your share (I think there 3 instances of that), and WinNT://CHANGETOYOURDOMAIN/ to your domain in AD, to get the username

sites.vbs

[gh256]

Thanks all

[gwendes]

That works really well after a bit of messing around with permissions. At least we have a basic log now!

[gh256]

What did you do to get it to work? It says our users dont have the right to run it when they are logging off. Can you RUNAS ?

[gwendes]

Just created a new folder with the correct permissions. Do you actually get an error message - I didn't. It started off only working for me and after some tinkering it's all good. The only problem is the size of the folder. After one lesson it's 4.5MB... 6 lessons a day... etc

 

Think it'll need regular archiving

[gwendes]

What about tacking a front end on this? How easy would that be?

[gh256]

When a user logs off here is says that user does not have permission to run the script

[tom_newton]

TBH, I am a bit biased, but you'd be better off doing your logging at proxy level, rather than a shenzi script based solution

[gwendes]

We currently only have the LEA filter - our deputy asked me to look into something that would cover us if we needed to prove that someone had (or had not) been accessing a particular site.

 

I've been pushing to implement a proxy but only have a spur of the hardware in this building and don't have my own server - let alone a server I could connect to the optical switch that the LEA maintain...

 

Poor me...

 

This should work neatly to prevent kids thinking about doing things they shouldn't. In one afternoon it's clear than Top Shop and Dorothy Perkins are more interesting than working!

[Enzomatrx]

We had some permission things, so be sure to test it before applying the GPO.

I set up a share called "inet" on \\server for a folder named "inet" (e:\inet... contains common things like the log dirs, italc's key dir).

I created a subfolder for the logs, so now i was at E:\inet\logs (\\server\inet\logs)

I made sure the inet share had permission to browse folder, read, list contents. the "logs" folder had custom permissions for basically full permission, sans-deleting.

 

Yes, I know this means our little shits could potentially browse around, find the share, and view the browsing logs of every other kid.

But since they can't exactly browse the network without meaningfully wanting to.. and the fact even if they modify their own files (or someone else's), the person's file will become part of their browsing history and therefore be added to their list at logoff... we're not that worried.

We don't tell them how we monitor or what we do, they have no idea it's a bunch of html files somewhere; they simply know we can tell where they've been.

Plus, they've watched me use iTALC, so they assume it's simply all through that, and they can' run it if they wanted to.

[jsnetman]

The script has a basic flaw, what if the pupil just powers the machine off instead of logging off. In a school I would suggest it is a requirement to provide some sort of logging via a proxy. We use ISA but there are many available using a linux distro.

[boomam]

Do the freeware linux solutions support user logging? Or just general logging?

We used an ISA for a bit, but after problems with it, we changed to using our VLE as the proxy. Which works reasonably well.

Wouldnt mind going back to a solution that i can completely admin myself though.

[Geoff]

Well I have Squid + Dansguardian here. They both produce usable access logs. There are also log parsers that will take these logs and produce pretty html pages to summarise them.

[tom_newton]

SmoothWall express will provide the logging you need for free.

 

edit:

url: http://www.smoothwall.org

[gh256]

Any idea on permissions I can give so the user can run the script on log off. At the moment it says they are not allowed while they are logging off.

[Enzomatrx]

The script has a basic flaw, what if the pupil just powers the machine off instead of logging off. In a school I would suggest it is a requirement to provide some sort of logging via a proxy. We use ISA but there are many available using a linux distro.

 

True dat. We have smartfilter set up as well, but without requiring students/faculty to log in to use the internet, all we get from that is a bunch of IP's internet usage.

 

Thankfully, we really don't have any kids powering off the computers. They're actually instructed to never shut down the PCs, only log off.

 

Amazingly, they obey.

[K.C.Leblanc]

I use a vbs script someone posted it, runs at logoff via GPO for whoever we apply the GPO to.

 

We use this, works very well.

[gh256]

Still cant get it to work due to restrictions on users.

 

*tom_newton - we have a proxy which the computers go through, it is one we have no control over and they must go through it, I believe it is at the councils end. I was wondering would the smoothwall version you suggested above still work with the proxy from the council. If it is not used, Internet does not work.

 

Thanks, Glenn

[gwendes]

How easy would it be to give this data folder a gui so that teachers can use it easily?