we have a network with about 20 users. we suspect that 1 user is using the network to access websites they shouldn't during work. we have already issued an Acceptable Use Policy.
Now we need to gather evidence that this person is still accessing forbidden websites before further action is taken.
I've looked at the syslog tool but it logs all access from all computers on the network. I know this persons IP Address so is there any way I can log the what websites are been visited from this IP over a period of time, say for example a week
many thanks

Syslog will keep a log of all sites accessed in the User Access log but you can also set it up to log in the Firewall log if you haven't already, to do that you'd need to make a firewall rule that has Direction: LAN > WAN, Source: the IP that you want to log, Destination and Source set to Any and Action of Pass Immediately and tick the Syslog box next to that.
That rule should then log any traffic from that IP in the Firewall tab of Syslog

One other thing to try would be SmartMonitor:
http://www.draytek.co.uk/products/SmartMonitor.html
That would keep a log on a PC that you could check per IP address with times, but it's a bit troublesome to get it working with the 2820, best to use an ethernet hub or a switch that you can set up a monitor port on:
http://draytek.com/user/SupportAppnotesDetail.php?ID=884

excellent voodle, thanks for the quick reply will give that ago

cheers

some more detail - this particular user is using the company web to access a facebook game. i know the LAN IP of the PC (192.168.51.42) used and I know the dest IP's of the servers that run the facebook game
192.118.x.x
69.63.x.x

i've created an IP group with these IP's in and then added this group to the dest IP in the firewall rule. the problem is that syslog still captures all web activity from this user when we only want to see access to the facebook game
any ideas ?
many thanks

try using OpenDNS, its free and esy to set up.

hi,
can Smart Monitor be used on all traffic on a 2820 router? By this I mean the other 3 router LAN ports and the wireless SSIDs?
I guess not but thought should ask.
Peter