For the web stuff, you could force everyone to use your squid proxy. You can configure squid to use apache's log format and use apache tools such as webalizer to monitor traffic. There are also some tools customized for squid. There are a few ways you can go with a Web Proxy. If you want to force it, you will have to allow outgoing web traffic only from your proxy server. This is a given for any method.