NW Audit may do just what you want. But I've heard it is relatively broken in NW6 (NAAS), and in prior versions can be a bear to

Note: I heard today that BMgr read-ahead can make the log files look like there are unknown users browsing. Disable that if you have it

Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://nscsysop.hypermart.net ***