Maximum PC

So here's the thing. My employer has a couple of workers he doesn't really trust. He asked me to try and find a way to monitor his actions on the PC. I tried to find an auditing software but everything I could find is either very expensive or not really stealthy. I thought about capturing the packets between the PC and the router (since I'm mostly interested in the web traffic) and filtering them on the fly to save only the important information. I am not however sure if that's possible, and if - how to do that.
How would you go about doing that? Any ideas, solutions?

There are lots of free things you can do, but I doubt that there is any free package.

What exactly do you want to do? Monitor internet usage? Why not just block sites?

Automated or would you like to be able to logon to his computer and watch everything he does?

Ya, "trust" can mean a lot of different things. Is he using email to send out trade secrets, watching pR0n or spending too much time on farmville, or possibly DL'ing torrents? Each issue has it's own practical solution. Oh! And is he issued his own computer, or is it shared or roaming?

If it's just generic "let's see what he's doing when I'm away", the built in remote desktop could be enough. Windows7 now allows you just to jump in without them accepting or acknowledging on their part, but older versions were pretty noticeable. Teamviewer is a 3rd party app that could be massaged to be pretty silent as well. Just taking a peek now and then should be enough to cement a suspicion. But then ya move on to gathering proof so that he's not sued, and that can be done by simply recording the remote screen you are viewing.

Email transactions can all be viewed by the IT guy. You can even request him to hold all outgoing emails for review before sending them along. All he'd basically see is him pressing send, it goes to outbox, then to the sent box, he deletes the sent message, but the email is really in a holding pattern waiting for the next step. Might slow down commerce if he's innocent though.

Torrents and such can just be monitoring bandwidth. Or even limit it, which would then force the DL/UL to take longer, and allowing it to be seen. Not many companies really need that much individual bandwidths.

Just some simple starts from a simple mind that can be done right now while the really sneaky comments roll in.
---------------------------------------------------
But IMO, you just install a screen capture device even if they see it and can disable it. The boss then needs to put out a memo to NOT disable it. Disregarding a memo is ammo in itself. But could drive him to other methods which may be harder to catch.

You might want to give Untangle a shot. Particularly the reporting parts of it.

It does have a bit of hardware demands (should run it on a dedicated server), but works rather well. It features logging capabilities and other things.

Got an older (read: kinda-obsolete) PC that's collecting dust handy?
My suggestion would be to replace the router with a Smoothwall (it'll run on damned-near anything), and installing the web-filtering and logging modules to it.
Completely transparent to the end-users, and completely free (assuming that you have the hardware available.)

Just get some intern to stand and watch over their shoulders while they work. That might be the most cost effective route to take.

I only want a software can filter unwanted content or track working time

ITALC, it's very good. You can take screenshot and remote control...