Hi all,

I'm a bit of a linux noobie, but I've been thrust into an network
admin role, ack!

Anyway, I've managed setup a proxy server thing on our gateway machine
with shorewall and all works as it should (yay!). But I'd like to
track the internet usage for certain sites (like facebook!) and for
certain PCs.
My current shorewall accounting file looks like so:

web:COUNT - eth0 eth1
web:COUNT - eth1 eth0
DONE web

COUNT - eth0 eth1
COUNT - eth1 eth0
DONE -

which gives a nice account of all internet traffic through the
gateway. (duplicated as one would imagine).
But if I add

facebook:COUNT - eth0:www.facebook.com eth1
facebook:COUNT - eth1
eth0:www.facebook.com
DONE facebook

or
tim:COUNT - eth0 eth1:192.168.0.10
tim:COUNT - eth1:192.168.0.10 eth0
DONE tim

when I do "shorewall show facebook tim" it shows zero packets received/
counted.

Clearly what I'm doing is not correct.

Can someone point me in the right direction? Or even suggest some
better tools for bandwidth tracking?

Many thanks
Tim