Keeping a record of users internet activity

[Diatom]

I have been asked to ensure that I can maintain a record of my users internet activity going back for at least 2 weeks.

 

I run Smoothwall Express 3.0 as a transparent proxy. Now I thought that Smoothwall was based on SQUID and recall having seen these logs on our old SQUID proxy so I guess they exist on the server. My question is how do I extract these logs in an intelligible form so that I can answer questions like what sites were viewed from a particular workstation at a particular time.

 

Bob

[computer_expert]

You can SSH into the smoothie and grab the squid.log from /var/log/squid/access.log or you could install something like the sarg mod and generate the reports that way.

[PEO]

I use sawmill for this, well worth it. I think the latest version (8) is about £200 but I've decided to stay with version 7 as it does a really good job

[Diatom]

You can SSH into the smoothie and grab the squid.log from /var/log/squid/access.log or you could install something like the sarg mod and generate the reports that way.

 

I have had a go at installing SARG on the smoothwall box following the instructions you quoted and it seems to have gone someway to a solution. I have the SARG tab in the LOGS area and can view how to configure the reports, however the daily, weekly and monthly hyperlinks are not available. I have seen reference to saving these settings on the first use of the logs and the need to wait for the log files too build. Does this mean that 24 hours must elapse from any save of the log configuration before the logs will appear? Also is it possible to view these logs in real time?

 

Bob

[computer_expert]

You can run the (report) scripts manually by just issuing "/usr/bin/sarg-reports daily", "/usr/bin/sarg-reports weekly" or "/usr/bin/sarg-reports monthly" at the command prompt and without the quotes.

 

As far as i know SWE doesn't have any mods for realtime log viewers (apart from the IM logger). I can't remember (for sure) if the commercial smoothie has a realtime log viewer or not (but i do vaguely remember me using a realtime log viewer in the commercial smoothie)

Edited June 28, 2010 by computer_expert