Les Mikesell wrote:
Depending on the nature of the content and the number of users, running a squid with caching enabled can be a resource win - and it will give you the log you want as long as the browser(s) are configured to use it.
if you have control over the internet gateway, you can force -all- web traffic to transparently be routed to the squid proxy, and then process the squid access and error logs, perhaps with a perl script (perl really rocks for this sort of thing).