How to view the images a user has viewed using Smoothwall reports and Powershell

Reporting is a key part of any IT position and nowhere is this more apparent than when it comes to web filtering. Being able to block or filter users requests is one thing, but reporting on who was blocked, and why, is every bit as important.

This is why thismorning I was asked to report on images being viewed by certain users. There was a concern about the content of the images but not the site. The files were hosted on legitimate, un-blocked, websites but there was a worry that the images themselves might be counter to some of the policies and agreements we have in place internally.

This was a difficult one to report on. Though our smoothwall gives you a decent number of reporting options, none of them currently show the images themselves, just the URLs of the images.

So I created the following powershell script. This will go through the output of the “Complete user audit trail” report from a Smoothwall and download any pictures mentioned there in to a folder with the same name as the report. Then you can easily scroll through the images and look for the ones you need.

1. Run your “Complete user audit trail” by logging on to your Smoothwalls web console and clicking on Logs and Reports > Reports > User Reports > Complete User Audit Trail. Enter the Username and click Run Report.
2. Save the report as a CSV file by clicking CSV in the top right corner of the report screen.
   
3. Rename the CSV file after the user so that it’s easy to find.
4. Copy the Powershell script below in to a file in the same directory and call it “Smoothwallquery.ps1”.
5. Run the following command line. The only parameter is -file which points to the csv file you just saved.[code]smoothwallquery.ps1 -file test.user.csv[/code]
6. You should now get a folder named after the user with the images that were visited during that report period.

The powershell script

Here’s the powershell script. If you have any questions feel free to use the comment section.

#Check command line params
Param (
 [string]$file
)

#Is the -file param used, if not, complain.
if (-not($file)) {Throw "Please provide a CSV filename to parse"}


#Configure the proxy connection
(New-Object System.Net.WebClient).Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials

#Import the CSV file
$csv = import-csv $file

#get just the CSV file basename
$csvbase = (get-item $file).basename

#Create a folder using the name of the file.
New-Item -ErrorAction Ignore -ItemType directory -Path $csvbase

#Go through each line in the CSV
$csv | ForEach-Object { 

 #Increment our loop counter
 $i++

 if ($_.url -like "*.jpg" -or $_.url -like "*.png" -or $_.url -like "*.gif") { 
 
 #Get the filename from the URL for saving the file
 $pieces=$_.url.split("/")
 $numpieces=$pieces.Count
 $outputfilename=$pieces[$NumOfPieces-1]

 #Output the filename we are working on
 write-host $_.url


 try {
 #Grab the file from the URL and save it. Prepends the index so that we can allow for duplicate filenames.
 Invoke-WebRequest -uri $_.url -OutFile $csvbase\$i"__"$outputfilename
 $fileswritten++
 } catch {
 #If we have an error then display something nice
 write-host "Not valid URL/Content Not Found - " $_.url 
 $webfail++
 }
 
 }
 }

 #Display some nice finishing info
 write-host `n`n
 write-host "------------------------------------"
 write-host $fileswritten files written to .\$csvbase. There were $webfail errors getting files.