Understand the problem before trying to fix it (Score 3, Interesting)

The 3-strikes law covers P2P traffic only. Adding web traffic reporting isn't going to do anything to help you.

Now if you are being asked to do web traffic reporting then sit down with management and work out what they want, why and who is going to be responsible for reviewing traffic (hint - this should be HR not IT). Doing this should give you enough information to justify some expenditure, even if it is just a new server/VM for Squid.