Also please note that "browse time" is a bit of the amount of lies there will be in the report.
Technically the firewall can log for how long each session were being active.
Using http(s) there are two methods, one session per http-transaction (that is one session per file transfered from the server) or one session for multiple http-transactions (when using keepalive which often has a timeout of 120-300 seconds or a timeout for number of inline transactions).
That gives that for the first case we get close to reality but it will only show for how long the network itself were being used. While the other will have a slack unless the client reloads info from the webserver within this timeout for the keepalive session.
That brings us that any "for how long is the client browsing the internet" is only (to use politically correct words) an "educated guess" (or lie as I prefer to call it ;-)
Having that said there might be methods to get the stats closer to reality. For example Google analytics seems to use the following cookies:
_utmb: saved for 30min or when last updated, used for browsing time and number of pageviews.
_utmz: saved for 6 months, used to save the referer (how the client found this site).
_utma: saved for 2 years, used to identify unique visitor(s).
A good example for such falsepositive when it comes to browsing time reports (that is for how many minutes or hours each client spends on browsing instead of doing their actual job - unless their job is to perform browsing) is when you login to facebook or for that matter visit any newsrelated sites or for that matter stockrelated sites. Most sites will today autorefresh every 5 minutes or such.
Which gives that if you visit these sites when you arrive to work in the morning and then minimize the browserwindow the statistics regarding "browsing time report" will show that you were using your browser for 8 straight hours in a row where its most likely that you perhaps used it when you arrived at work, came back from lunch and perhaps before leaving work to check if anything odd has happend in the surroundings while you were at work.
But as long as you know this and the people reading this report (please add this disclaimer on each and every page of the report so the reader wont miss it) then im fine with it.
Because there are lies, damned lies and statistics =)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!