there are tons of different options out there, im partial to websense for logging, restricting, etc.
We used Websense until recently but are now changing to a Barracuda Web Filter instead. Cheaper, integrated hardware unit so no extra server or OS licensing costs, and it adds a lot of anti-exploit and malware protection (incl. an active-x temporaroly-downloadable Spyware cleaner that can be set to automatically trigger when a client shows signs of infection). It can be placed transparently in front of your firewall or set as a std. proxy, though the former gives better protection and requires no extra configuration on your clients or firewall. All in all a very nice little unit and we've already had a very positive experience with their Spam firewall so I have a lot of faith in it.