SRX

What is the best way to create a report on what web sites employees are visiting?

We have a single Juniper SRX 210H.

JamesNT

I would create a filter rule to route traffic to a proxy server.  Squid is a great free solution.  Then use one of the many Squid log file parsers....like Webalizer.  This will show you IP to URL.

If you want to track users to URL, then you will need a seperate solution that intergrates user authnetication and URL filtering. I use a Bluecoat applaice with the Junier routing HTTP traffic.

The Juniper, even this the URL filtering license, will not give you logs on user activity.  You can get information into SYSLOG, but you will need to parse it....and I dont know of any tool to do this.

Can the SRX210 forward SYSLOG messages to a Kiwi Syslog server or another one?

If I can just get the IP addresses of the workstations, I can get the locally logged on user and parse the log file using SQL Server Integration Services.

JamesNT

The SRX can send logs to a syslog server.  You can see the IP of the source and the destination IP, but not the URL. 

I would setup SQUID or explicit HTTP proxy settings (GPO/WPAD/PAC) and this will make it easy to get the information that you need.