Need internet activity log of each client

SOLVED
Poonyalid
Comes here often

Need internet activity log of each client

Hi I’m using MX65 and MX65W.

 

Our new Thailand IT laws need us to keep internet usage log of all employees for at least six months backward.

 

the log must contain who use which IP to access which website and with protocol or port, etc.

 

Normally I’m using proxy server (Wingate) and i use 3rd party log analyzer Software (SawMill, ProxyInspector) to generate report with very deep details.

 

I’m newbie to Meraki and don’t know how is the log and how to config? Do I need to use syslog server?

 

I have internal Windows AD domain.

 

Thabk you very much.

Poonyalif

1 ACCEPTED SOLUTION
MerakiDave
Meraki Employee
Meraki Employee

Go to Network Wide > Configure > General, scroll down to the "Reporting" section of that page, click the link to add a syslog server, put in its IP address and from the "Roles" dropdown box, select URLs.  In addition, if you have a Meraki MX appliance, you can opt to go to the 13.x versions of firmware, which introduced URL Logging.  With that, on that same "Reporting" section of the page, you'll get a checkbox to log all web activity.  Once enabled, you would go to Organization > Monitor > Hosted Logs to view everything.  Here's a support doc on it here https://documentation.meraki.com/MX-Z/Monitoring_and_Reporting/URL_Logging  Here's a screenshot of what it would look like with both a syslog server and URL Logging. 

URL Reporting.jpg

 

View solution in original post

8 REPLIES 8
PhilipDAth
Kind of a big deal
Kind of a big deal

Can you post a url pointing to this law change so I can understand it further?

In short, yes you will need to enable the syslog function to a syslog server to get six months of detail per user.
MerakiDave
Meraki Employee
Meraki Employee

Go to Network Wide > Configure > General, scroll down to the "Reporting" section of that page, click the link to add a syslog server, put in its IP address and from the "Roles" dropdown box, select URLs.  In addition, if you have a Meraki MX appliance, you can opt to go to the 13.x versions of firmware, which introduced URL Logging.  With that, on that same "Reporting" section of the page, you'll get a checkbox to log all web activity.  Once enabled, you would go to Organization > Monitor > Hosted Logs to view everything.  Here's a support doc on it here https://documentation.meraki.com/MX-Z/Monitoring_and_Reporting/URL_Logging  Here's a screenshot of what it would look like with both a syslog server and URL Logging. 

URL Reporting.jpg

 

@MerakiDave I'm interested in the URL Logging. I'm looking at the network-wide>general and under reporting, I don't see any tick box for URL logging, I'm running 14.7 on the MX network. Is this still available? 

Eliot F | Simplifying IT with Cloud Solutions
Found this helpful? Give me some Kudos! (click on the little up-arrow below)

It should still be available, I don't think it's a closed beta, so chances are you need to ping Meraki Support to enable it.  If that's not the case private message me and I'll investigate.

Hey @MerakiDave, reached out to support and got the following reply,

 

Greetings Eliot,

Thank you for contacting Cisco Meraki Technical Support.

Unfortunately, we have reached a limit on the beta users for this feature and we are not accepting any more networks or customers to the beta at this time.

Any chance you can help out? I'm really keen to get my hands on this feature.

Eliot F | Simplifying IT with Cloud Solutions
Found this helpful? Give me some Kudos! (click on the little up-arrow below)

Aw man, sorry to hear that, didn't realize the beta got closed.  I'll ask around and drop you a note with any updates. 

Thank you very much for all replies, I'll try and will let you know the results ASAP.

 

Thanks again.

Poonyalid

Hi,

 

I implement Syslog server Kiwi on Windows Server.

After I added syslog server in Meraki, I found syslog start running in the Kiwi syslog monitor.

 

But I found that Meraki have no log anymore since I enable the syslog server.

 

If it's correctly by designed, do I need to see report at the Kiwi syslog server instead?

 

If yes, how to see the report?

 

Thank you very much.

Poonyalid

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels