Trying to log when and where a particular user is using the internet by mac/ip

elementalwindx · Oct 7, 2015, 4:44 PM

And what keeps them form fooling around on their phones over their own connection.. Kind of pointless to track what happens on your GUEST network that is not tied to your production network.

You might be nice and filter it for malware, etc.. But other than that - why should you care. As to the users messing around on internet.. Why not just use their own phone, or fire up their own hotspot on their phone, etc. etc.

Trying to track is a exercise in futility if you ask me when pretty much everyone carries around their own connection in their pocket..

I agree with you except this is what the boss is asking of me. These users don't know how to setup their own hotspots either. Can we please stay on topic? Thanks.

KOM · Oct 7, 2015, 4:47 PM

You don't have to use Squid as a cache, just as a middle man. Even with just squid, you will be doing a lot of report parsing. Combine squid with squidguard and you can block URLs based on their category, including white & black lists.

elementalwindx · Oct 7, 2015, 5:20 PM

@KOM:

You don't have to use Squid as a cache, just as a middle man. Even with just squid, you will be doing a lot of report parsing. Combine squid with squidguard and you can block URLs based on their category, including white & black lists.

I'll give that a try. Whats the difference between squid and squid3? First impression is squid3 is supposed to be the newest version but when I read the version numbers on the package page it seems "squid" is the newest version. Correct?

doktornotor · Oct 7, 2015, 5:22 PM

@elementalwindx:

"squid" is the newest version. Correct?

No!!! "Squid" is 2.7 branch of Squid, abandoned ages ago upstream, abandoned at FreeBSD as well and completely unmaintained at pfSense as well… I made an attempt to at least mark that version as unsupported, but that didn't fly either.

Also note, the package version has nothing to do with the binaries version.

KOM · Oct 7, 2015, 5:32 PM

Remember to set the hard disk cache size to 1 or 0 (the smallest it will allow), and set the filesystem type to Null.

johnpoz · Oct 7, 2015, 5:38 PM

you can turn on logging in the forwarder if you want to log queries..

your going to get a LOT of noise!! You would be amazed at all the queries a box will do without the user actually doing anything..

elementalwindx · Oct 7, 2015, 5:53 PM

@KOM:

Remember to set the hard disk cache size to 1 or 0 (the smallest it will allow), and set the filesystem type to Null.

I've got it set up and working. lightsquid reporting utility is nifty but certainly very basic looking.

Why would I set those sizes and types?

Which squid version should I have installed? I used regular squid.

KOM · Oct 7, 2015, 6:20 PM

Why would I set those sizes and types?

Because you don't want it caching, just reporting.

Which squid version should I have installed?

Squid3 package 0.3.8. Also look at Sarg (another reporter based on squid's access.log) and squidGuard 1.9.15 for URL filtering.

elementalwindx · Oct 7, 2015, 6:49 PM

@KOM:

Why would I set those sizes and types?

Because you don't want it caching, just reporting.

Which squid version should I have installed?

Squid3 package 0.3.8. Also look at Sarg (another reporter based on squid's access.log) and squidGuard 1.9.15 for URL filtering.

Tried Sarg but I just keep getting this under view report:

Error: Could not find report index file.
Check and save Sarg settings and try to force Sarg schedule.

but the realtime report is working although thats not what we need.

KOM · Oct 7, 2015, 6:51 PM

To fix Sarg, do this from console:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports