Logging Internet Usage

[binky]

What it the cheapest and easiest way of logging all internet traffic?

[tom_newton]

Web traffic? linux box + squid in "interception proxy" mode

Internet traffic: as above + iptables rules etc. - but would produce a LOT of logfiles, which would be tricky to manage/read

 

Sort of thing we do - but we wouldn't qualify for "cheapest" necessarily, though it depends how you value your time. We'd certainly come close to "easiest" though.

[uk101man]

I did post a script that run at log off would record all websites visited with time, date and which pc

[mrforgetful]

http://www.papercut.biz that I mentioned in your Printing Logging topic does internet too.

[SpuffMonkey]

I did post a script that run at log off would record all websites visited with time, date and which pc

 

We still use your script - and its top notch - thanks again - I recommend you to it!

[uk101man]

Glad someone is getting some use out of it. Did the script turn up any 'interesting' sites?

[ctbjs]

So where do we find the script !!

[uk101man]

Here

[mrforgetful]

Here

 

Simple! ¬_¬

[acrobson]

Any chance of some back ground on the script, such as what it can do and where it is installed, such as per client or centrally managed from a server etc.

[Vegas]

Using the script here with much success. Thanks again.

[ricki]

Please could I have some instruction how to get this to work.

 

Thanks for all your help.

 

Richard

[Vegas]

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=627&postdays=0&postorder=asc&start=30

[MkII]

Using it here too. Proved invaluable. Odd problem when logging off with permisson errors.

 

Interesting pointer recently to another option :- index.dat suite

[acrobson]

Using it here too. Proved invaluable. Odd problem when logging off with permisson errors.

 

Interesting pointer recently to another option - index.dat suite

Index.dat suite is superb, i have been using for 3 years nearly, and it has been accept in a number of cases where the police have been involved etc.

[Anglo_Jaxon]

Work in Dorset, use SWGFL and then you get a free RM SMARTCACHE!

 

A fantastic bit of kit!

 

J

[ricki]

HI I know this will sound strange but I cannot get the internet spy to work.

 

I have downloaded the vbs script and copied it into the netlogon.

 

I have creates a logs$ share on a server with space and created a folder in there called inet. I have set share and ntfs permissions to full control for everyone.

 

I have changed the vbs script to look at the share in 3 places and it looks like this

 

Code:

' C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat - Starting offset: 0000:5000

' +----------------------------------------------------------------------------+

' | Ensure that all variable names are defined! |

' +----------------------------------------------------------------------------+

Option Explicit

 

 

' +----------------------------------------------------------------------------+

' | Setup constants |

' +----------------------------------------------------------------------------+

Const conBarSpeed=80

Const conForcedTimeOut=3600000 ' 1 hour

 

 

' +----------------------------------------------------------------------------+

' | Setup Objects and misc variables |

' +----------------------------------------------------------------------------+

Dim spyPath

Dim oFSO : Set oFSO = CreateObject("Scripting.FileSystemObject")

Dim oWShell : Set oWShell = CreateObject("WScript.Shell")

Dim objNet : Set objNet = CreateObject("WScript.Network")

Dim Env : Set Env = oWShell.Environment("SYSTEM")

Dim arrFiles : arrFiles = Array()

'Dim arrUsers : arrUsers = Array()

Dim HistoryPath : HistoryPath = Array()

Dim objIE

Dim objProgressBar

Dim objTextLine1

Dim objTextLine2

Dim objQuitFlag

Dim oTextStream

Dim index

Dim nBias

Dim strUserName

 

' +----------------------------------------------------------------------------+

' | Whose been a naughty surfer? Let's find out! |

' +----------------------------------------------------------------------------+

'Here is where we extract the UserName

strUserName = objNet.UserName

spyPath = "\\sophos-server\logs$\inet\" &strUsername&"\spy.htm"

StartSpyScan

'DeleteIndexFiles()

myDeleteIndexFiles

 

 

' +----------------------------------------------------------------------------+

' | Outta here ... |

' +----------------------------------------------------------------------------+

CleanupQuit

 

 

' +----------------------------------------------------------------------------+

' | Cleanup and Quit |

' +----------------------------------------------------------------------------+

Sub CleanupQuit()

Set oFSO = Nothing

Set oWShell = Nothing

Set objNet = Nothing

WScript.Quit

End Sub

 

 

' +----------------------------------------------------------------------------+

' | Start Spy Scan |

' +----------------------------------------------------------------------------+

Sub StartSpyScan()

Dim index_folder, history_folder, oSubFolder, oStartDir, sFileRegExPattern, user

 

LocateHistoryFolder

index_folder=HistoryPath(0)&"\"&HistoryPath(1)

 

If Not oFSO.FolderExists(index_folder) Then

'MsgBox "No history folder exists. Scan Aborted."

Else

 

'StartIE "IE Spy"

'SetLine1 "Locating history files:"

 

sFileRegExPattern = "\index.dat$"

Set oStartDir = oFSO.GetFolder(index_folder)

 

For Each oSubFolder In oStartDir.SubFolders

history_folder=oSubFolder.Path&"\"&HistoryPath(3)&"\"&HistoryPath(4)&"\"&"History.IE5"

If oFSO.FolderExists(history_folder) Then

user = split(history_folder,"\")

'SetLine2 user(2)

'ReDim Preserve arrUsers(UBound(arrUsers) + 1)

'arrUsers(UBound(arrUsers)) = user(2)

if user(2) = strUserName then

Set oStartDir = oFSO.GetFolder(history_folder)

RecurseFilesAndFolders oStartDir, sFileRegExPattern

end if

End If

Next

 

If IsEmpty(index) Then

'CloseIE

'MsgBox "No Index.dat files found. Scan Aborted."

Else

CreateSpyHtmFile

'CloseIE

'RunSpyHtmFile

'DeleteIndexFiles

End If

 

End If

End Sub

 

 

' +----------------------------------------------------------------------------+

' | Locate History Folder |

' +----------------------------------------------------------------------------+

Sub LocateHistoryFolder()

' Example: C:\Documents and Settings\\Local Settings\History

' HistoryPath(0) = C:

' HistoryPath(1) = Documents and Settings

' HistoryPath(2) =

' HistoryPath(3) = Local Settings

' HistoryPath(4) = History

HistoryPath=split(oWShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell

 

Folders\History"),"\")

End Sub

 

 

' +----------------------------------------------------------------------------+

' | Find ALL History Index.Dat Files |

' +----------------------------------------------------------------------------+

Sub RecurseFilesAndFolders(oRoot, sFileEval)

Dim oSubFolder, oFile, oRegExp

 

Set oRegExp = New RegExp

oRegExp.IgnoreCase = True

 

If Not (sFileEval = "") Then

oRegExp.Pattern = sFileEval

For Each oFile in oRoot.Files

If (oRegExp.Test(oFile.Name)) Then

ReDim Preserve arrFiles(UBound(arrFiles) + 1)

arrFiles(UBound(arrFiles)) = oFile.Path

index=1 ' Found at least one index.dat file!

End If

Next

End If

 

For Each oSubFolder In oRoot.SubFolders

RecurseFilesAndFolders oSubFolder, sFileEval

Next

End Sub

 

 

' +----------------------------------------------------------------------------+

' | Create Spy.htm file |

' +----------------------------------------------------------------------------+

Sub CreateSpyHtmFile()

Dim ub, user, spyTmp, oFS, index_dat

 

Set oFS = CreateObject("Scripting.FileSystemObject")

If Not oFSO.FolderExists("\\sophos-server\logs$\inet\" & strUserName) Then

oFS.CreateFolder(("\\sophos-server\logs$\inet\" & strUserName))

Set oTextStream = oFSO.OpenTextFile(spyPath,2,True)

oTextStream.WriteLine "

"&objNet.UserName &" "&

 

objNet.ComputerName &"

 

"

'oTextStream.WriteLine ""+CStr(UBound(arrUsers)+1)+" users surfed on your PC:

"

'For Each index_dat In arrUsers

' oTextStream.WriteLine ""+index_dat+"

"

'Next

oTextStream.WriteLine "

"
oTextStream.WriteLine "
nowrap> Link:"
GetTimeZoneBias
ub = UBound(arrFiles)
For Each index_dat In arrFiles
user = split(index_dat,"\")
spyTmp=oFSO.GetSpecialFolder(2)+"\spy.tmp"

' Copy index.dat ---> C:\Documents and Settings\\Local Settings\Temp\spy.tmp
' REASON: Avoids file access violations under Windows.
oFSO.CopyFile index_dat, spyTmp, True
FindLinks "URL ", RSBinaryToString(ReadBinaryFile(spyTmp)), index_dat
Next
oTextStream.WriteLine "

Location:

Date:

"

'For Each index_dat In arrFiles

' oTextStream.WriteLine index_dat+"

"

'Next

oTextStream.WriteLine ""

oTextStream.Close

Set oFS = nothing

 

Else

Set oTextStream = oFSO.OpenTextFile(spyPath,8,True)

'For Each index_dat In arrUsers

' oTextStream.WriteLine ""+index_dat+"

"

'Next

oTextStream.WriteLine "

 

"

oTextStream.WriteLine "

"
oTextStream.WriteLine ""
GetTimeZoneBias
ub = UBound(arrFiles)
For Each index_dat In arrFiles
user = split(index_dat,"\")
spyTmp=oFSO.GetSpecialFolder(2)+"\spy.tmp"
' Copy index.dat ---> C:\Documents and Settings\\Local Settings\Temp\spy.tmp
' REASON: Avoids file access violations under Windows.
oFSO.CopyFile index_dat, spyTmp, True
FindLinks "URL ", RSBinaryToString(ReadBinaryFile(spyTmp)), index_dat
Next

' oTextStream.WriteLine "

" & objNet.UserName &"

"& objNet.ComputerName &"

Link:

Listing of history files:

"

' For Each index_dat In arrFiles

' oTextStream.WriteLine index_dat+"

"

' Next

' oTextStream.WriteLine "

[Enzomatrx]

I want to say thank you for this awesome piece of code, Ric.

I just set it up on our server, changed the 3 variables for the share's location, and put it in the GPO and WOW, it's exactly what the head of technology here wanted... and it's FREE.

 

Excellent work, and thanks again!

[alonebfg]

I know this is a silly question but you dont have the code: in the vbs script do you ?? only somthing i did once when copying a script but took me forever to sus it out

[ricki]

I know this is a silly question but you dont have the code: in the vbs script do you ?? only somthing i did once when copying a script but took me forever to sus it out

 

I am not sure what you mean. I started the script with Code:

 

Please can you tell me what silly mistake I have made as it does not work for me.

 

Thanks for all your help.

 

Richard

[alonebfg]

i am sure the code: is the fourm way of showing it and not part of the script take it out and try again and it might work i know i havent put code: at the start. I am sure someone will tell me if i am wrong.

[FN-GM]

Is there still a link for this script or is it me?

[Ryan]

Link appears to be broken (old forums->new forums issue?)

 

I'd be interested in this little logging script too.

[chalkwellstu]

Link appears to be broken (old forums->new forums issue?)

 

I'd be interested in this little logging script too.

 

Me too, if you wouldn't mind

[SpuffMonkey]

Hopefully this is what you're after - you'll have to bodge it to fit your server names...

inetlogger.zip