My company is offering public wireless in a number of locations. Access is controlled by an OpenBSD box running pf and Squid in transparent proxy mode. Using a tool like SARG, I can easily generate an HTML report that shows IP addresses and amount of data transferred. However, utilizing the data requires a human to look at the generated log and see if there is a problem.
I was wondering if there was any tool I could use to send us an alert if a single user exceeded a certain threshold of data transfer? Something that would analyze the log like SARG, but rather than generating a report simply send an e-mail if any "problems" are detected.
Edit 1-as squid is set up as a transparent proxy, there are no "users" per-se. Rather, it logs IP's which I can match up to MAC addresses using the DHCP logs. I'm just looking for something that can send me an e-mail if a given IP transfers more than x amount of data in a given time period.