You can use 802.1X to require each user or computer to authenticate itself to the network in order to receive network services. It's commonly used on Wi-Fi networks as part of the "enterprise" flavor of WPA and WPA2, but it can be done on wired Ethernet as well with most modern manageable switches.
Wi-Fi APs and manageable Ethernet switches use RADIUS to authenticate these 802.1X users to the network. RADIUS can also be used for accounting (keeping track of who used the network for how long).
There are free implementations of RADIUS, including FreeRADIUS. I imagine there are several choices of log analysis / reporting tools available for FreeRADIUS as well.
Unless you use something like 802.1X to know for sure which user or machine is connecting to your network, it's hard to know that you're really capturing the kind of information you're looking for. If you were an all-Windows shop, and already have a Windows 2Kx Server box, and and you had some way to keep non-Windows machines off the network, and you had a way to ensure that the Windows client machines couldn't get anything done on the network unless they're bound to an Active Directory domain and an AD domain user is logged in, then maybe you could use that. But otherwise, it's hard to reliably identify when every Wi-Fi smartphone, iPad, Mac, or whatnot connects or disconnects from the network just to web surf unless you force them to authenticate via 802.1X.