Workgroup Manager: Enabling Parental Controls web logging for network users

If you use Workgroup Manager to enforce Parental Controls for your network users, websites that users visit will not be logged by default. You can use Workgroup Manager to import a configured preference file to enable logging.

On each client computer, the raw data will be stored in: /Library/Application Support/Apple/ParentalControls/Users/account-shortname/events.data .

Use the following steps on a client computer to generate the necessary preference file:

1. Log in as the administrator account for the workstation.

2. Create a local account named "Web Log" with a shortname of "weblog" in the Accounts pane of System Preferences.

3. Activate Parental Controls for the Web Log account.

4. Log out of the administrator account.

5. Log in as the Web Log account. This will create the necessary property lists.

6. Log out of the Web Log account.

7. Log in as the administrator.

8. Copy the /Library/Managed Preferences/weblog/com.apple.familycontrols.logging.plist file to your Open Directory server.

9. Delete or disable the Web Log account.

10. Log out of the client computer.

On your Open Directory server:

1. Open Workgroup Manager, select the Group or Computer Group for which you'll be enabling web site logging, then click on the Preferences icon in the toolbar.

2. Click the Detail tab.

3. Click Add (+) below the list of managed preferences.

4. Navigate to where you copied the preference file, then select the com.apple.familycontrols.logging.plist file.

5. Choose Always from the "Manage imported preferences" option in the file navigation panel.

6. Click Add.

7. In the managed preferences list, double click the com.apple.familycontrols.logging entry.

8. Click the disclosure triangle to show the contents of the "Always" preference domain. The property "web" controls whether or not web logging will be enabled. This should be set to True.

Repeat the steps in Workgroup Manager as desired for all Groups or Computer Groups for which you need to enable web logging.

Because managed preferences may be cached, workstations should be restarted after importing and enabling web logging settings. When users in the logging-enabled groups log in, or when users log in to a computer that is a member of logging-enabled computer groups, the system should begin logging which websites they visit. If you block selected websites, these attempts will also be logged in the events.data file.

Learn more

There are some important considerations for reviewing the events.data file:

• This events.data file is stored on the local workstation or portable, and is not stored or automatically copied to any server. You'll need to copy the events.data file from the local workstations, or access the events.data fie directly on the workstation, in order to review the websites the user visited.

• The events.data file is a SQLite3 database and is generally not readable by applications such as text editors. You'll need to use an application that will read the SQLite3 database format to see the data stored in this file. An open source command-line utility that can read this file, sqlite3, is included with Mac OS X. AppleCare does not provide support for the sqlite3 command. Detailed instructions about using the sqlite3 command can be found with the built-in command-line documentation, which you can access with the following command in Terminal: man sqlite3

• You can find more information about SQLite at <http://www.sqlite.org/> and <http://www.sqlite.org/docs.html>.

Note: The file format for events.data is subject to change.