It depends on how big your network is, and what you're trying to monitor. For small to medium networks, Nagios seems to be the platform of choice.
Once you get over a certain size, though, 'monitoring' gets split up into a variety of different functions, which may or may not be handled by the same tools. The three that I was taught are:
- Fault management
- Performance management
- Forensics/correlation
Fault management is catching any events in the environment that require immediate action to fix. Link failures, hardware failures, loss of WAN circuits, etc. This is normally tied into your alerting system. I've heard Nagios does this quite well.
Performance management covers things that aren't an immediate issue, but could become so unless they're given attention. This basically covers anything to do with monitoring utilisation and trending it. LAN/WAN bandwidth, router/switch CPU, error and discard counters on interfaces. This is the kind of stuff you look at when you're planning your purchases and projects for the coming year; it tells you what parts of the network need attention, and which are ticking along happily. I'm a fan of Cacti; it handles all data gathering and presentation in one package, with built in support for SNMP polling of devices.
Forensics/correlation is for those cases where a one off incident has occurred and been resolved, and you need to look at historical data. This can either be to get a better idea of what actually happened and what the consequences were, or to look for instances of similar failures in the past. Either way, it generally requires a single repository of as much log data as you can feasibly retain, indexed and readily searchable. Splunk is absolutely fantastic in this regard, even the free edition; in addition, you can even get your server logs into Splunk. As long as everything is NTP synced, you have one repository which show you what your applications, servers and network infrastructure saw at various points during an incident.
The other things you're looking to audit are more covered in terms of network security, than network monitoring. For example, monitoring/restricting user browsing is easily accomplished through the use of a properly configured proxy. Users trying to connect to external IM services should be blocked by your Internet firewall; again, firewall logs can be exported to an analyser and reports run looking for suspicious traffic patterns. In fact, if you can, try and avoid letting your user workstations access the Internet directly, by ensuring that the Internet is not routeable from inside your LAN. This forces all internet traffic to go through a proxy of your choosing, ensuring that you have full control of all inbound and outbound traffic.
