Sarg package for pfsense

Hugovsky · Apr 18, 2012, 1:52 PM

@Hugovsky:

Another problem:

"Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 62998077 bytes) in /usr/local/www/sarg_frame.php on line 52"

When tryed to load Sites and users.

It's a pfsense php memory limitation, you can work around this by accessing HTML reports directly http://pfsense_IP/sarg-reports/

thanks

klamath · Apr 20, 2012, 11:02 AM

Hi Marcelloc
Could you sort all reports for Bytes Reverse???

marcelloc · Apr 20, 2012, 12:45 PM

@klamath:

Hi Marcelloc
Could you sort all reports for Bytes Reverse???

You can sort sarg by clicking on column header.

klamath · Apr 20, 2012, 7:46 PM

I mean… by default! without any click!

@marcelloc:

@klamath:

Hi Marcelloc
Could you sort all reports for Bytes Reverse???

You can sort sarg by clicking on column header.

marcelloc · Apr 20, 2012, 11:21 PM

Did you tried to select bytes on user option and sort fields in reverse options on general tab?

klamath · Apr 21, 2012, 12:26 AM

@marcelloc:

Did you tried to select bytes on user option and sort fields in reverse options on general tab?

Yes… I did it for the first try.
Can I edit the file sarg.conf on the console???

now i've got this error on Redirector report page:

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 49259754 bytes) in /usr/local/www/sarg_frame.php on line 52

I'm on AMD64

marcelloc · Apr 21, 2012, 1:04 AM

On amd64 it can be set to 256. I'll include it on next release.

For now, use http://pfsense.IP/sarg-reports

Hemingway · Apr 22, 2012, 1:42 PM

@marcelloc
First, thanks for this wonderfull Package!

I have installed Squid and Sarg and both work fine. I make daily reports with the scheduler.
The Syntax for daily reports is "-d date +%d/%m/%Y-date +%d/%m/%Y", but now
i need weekly, monthly and annual reports. What's the right Syntax to make this?

Thanks, Hemingway

IGIdeus · Apr 22, 2012, 2:40 PM

@marcelloc:

Did you tried to select bytes on user option and sort fields in reverse options on general tab?

Hi,
I also have a problem with sorting Top users & Users report.
I tried mentioned option but it doesn't work.
I need to manually change config file with options:

TAG: topuser_sort_field field normal/reverse

# Sort field for the Topuser Report.
# Allowed fields: USER CONNECT BYTES TIME

topuser_sort_field BYTES REVERSE

TAG: user_sort_field field normal/reverse

# Sort field for the User Report.
# Allowed fields: SITE CONNECT BYTES TIME

user_sort_field BYTES REVERSE

But when I change the configuration in GUI then everything is reverted to NORMAL.
Could you please extend the "User Sort Field" with "BYTES(reverse)"?

Best regards
IGIdeus

marcelloc · Apr 23, 2012, 1:49 PM

I've just pushed a fix to Sort Fields in Reverse order check.

Reinstall the package in 15 minutes.

lucapsg · Apr 24, 2012, 9:02 AM

I'm trying to read the full name of the user via LDAP to show in Sarg reports, but I can not make it work.

In Sarg->User I use the same configuration, functional, used for Squid and pfSense, with a specific user, verified with Diagnostic-> Authentication.

Just about this, I found an oddity …
In the 'LDAP search filter' I put the string '(sAMAccountName =% s)' but in /usr/local/etc/sarg/sarg.conf, is not registered ::), but every other change, yes.
So, the next page load I was expecting a blank or default value, whereas it appeared the correct string ???
Where is it recorded? And, above all, irrespective of the position, this is used in the LDAP query?

The LDAP directory is Active Directory on Windows 2003 and in the Event Viewer I have not seen any attempt to access by Sarg. Perhaps because of what I just said?

The software I use are all the latest (I think):

PfSense 2.0.1-RELEASE (i386) built on Wed Dec 12 18:24:17 EST 2011
Squid 2.7.9 pkg v.4.3.1
SquidGuard 1.4_2 pkg v.1.9.1
Sarg 2.3.2 pkg v.0.4.1

Any suggestions?
Thanks for the nice job, Marcelloc!

marcelloc · Apr 24, 2012, 1:25 PM

lucapsg,

I've just pushed a fix to LDAP filter Search check.

Reinstall the package in 15 minutes.

Thanks for your feedback

lucapsg · Apr 24, 2012, 2:27 PM

Wow, a rocket!
Update installed, now the value entered in the 'LDAP search filter' is properly registered in sarg.conf. (I'm curious, where it was saved before?)
After saving each tab and pressing 'Force update now' in the report still does not appear the full name of the user.
From the Windows logs, there's no news, no attempt to access.
I look forward to doing more tests.

marcelloc · Apr 24, 2012, 2:44 PM

try to tcpdump connections from pfsense to active directory.

maybe you have a ldap server fqdn configured that pfsense can't resolve.

lucapsg · Apr 24, 2012, 2:57 PM

As I said, I'm using the same configuration used in System-> User Manager-> Servers and tests made by Diagnostic-> Authentication confirm it is working.
However, to remove any doubt, in the 'LDAP Hostname' I'm using the IP.
Now I check with tcpdump … stay tuned...

Donny · Apr 24, 2012, 4:01 PM

Hello Marcelloc,

I just a little bit confuse between SARG ldap setting (User tab) and Squid authentication with LDAP. If I understand collect when I used Squid authentication with LDAP, I don't need to use SARG ldap settings right.
Could you explain what is difference between SARG ldap setting and Squid authentication with LDAP, please?

Thank u

lucapsg · Apr 24, 2012, 3:23 PM

During the update of the report and also in the tab 'Realtime', tcpdump has not caught anything on port 389.
To verify that the settings used in 'tcpdump' is correct I tried to capture traffic made with Diagnostic-> Authentication and actually a bit of broth was captured.
pfSense is 192.168.152.1 while Windows 2003 is 192.168.152.200, both in a VMware test environment:

17:08:16.107802 IP 192.168.152.1.61250 > 192.168.152.200.389: tcp 0
17:08:16.109616 IP 192.168.152.200.389 > 192.168.152.1.61250: tcp 0
17:08:16.109692 IP 192.168.152.1.61250 > 192.168.152.200.389: tcp 0
17:08:16.109964 IP 192.168.152.1.61250 > 192.168.152.200.389: tcp 62
17:08:16.112227 IP 192.168.152.200.389 > 192.168.152.1.61250: tcp 22
ecc…

@Donny: In Squid LDAP is used to "authenticate", while in Sarg to replace the username with the full name of the user in reports.

Donny · Apr 24, 2012, 4:09 PM

@lucapsg:

During the update of the report and also in the tab 'Realtime', tcpdump has not caught anything on port 389.
To verify that the settings used in 'tcpdump' is correct I tried to capture traffic made with Diagnostic-> Authentication and actually a bit of broth was captured.
pfSense is 192.168.152.1 while Windows 2003 is 192.168.152.200, both in a VMware test environment:

17:08:16.107802 IP 192.168.152.1.61250 > 192.168.152.200.389: tcp 0
17:08:16.109616 IP 192.168.152.200.389 > 192.168.152.1.61250: tcp 0
17:08:16.109692 IP 192.168.152.1.61250 > 192.168.152.200.389: tcp 0
17:08:16.109964 IP 192.168.152.1.61250 > 192.168.152.200.389: tcp 62
17:08:16.112227 IP 192.168.152.200.389 > 192.168.152.1.61250: tcp 22
ecc…

@Donny: In Squid LDAP is used to "authenticate", while in Sarg to replace the username with the full name of the user in reports.

Hello lucapsg,

It mean, I have to use both if I need full user name of the user in sarg reports. Is it correct?

Thank u

Hugovsky · Apr 24, 2012, 4:21 PM

HI all. I have same problem with ldap. With system>user manager some traffic shows up in tcpdump and correctly connects. Nothing with users in sarg reports.

Edit: last package update was just now.

lucapsg · Apr 24, 2012, 4:26 PM

@Donny, well, if you have an LDAP directory and you want to authenticate users (Squid) And you also want to display the full name of the user in report (Sarg), then YES.
Or at least we're working on so that this is possible ;)

Sarg can do also (and already does) replacement using its own internal function. See field 'Users Association' in Status->Sarg Reports->Users, but in my judgment is only recommended for a small number of users and/or if Squid authenticates users with their own list.

@ Marcelloc, any news?