Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sarg package for pfsense

    Scheduled Pinned Locked Moved pfSense Packages
    467 Posts 99 Posters 502.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      Lectrician
      last edited by

      Confusing me a tat  ;D

      How should I set this up to create a log each day?  I have open WiFi which turns on at 8am and off at midnight, so although the log being created at 11:59pm is fine, 12:01 would be better  :P

      Can't quite work it around in my head?

      If I don't have -d on the sarg args line, how do I specify the previous day in the schedule?

      ALSO

      Is it possible to delete some of the reports before they rotate?  I have my rotate set as 90 days, the first 6 or so reports are pointless and I would like to delete them if possible?

      Thanks!

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        I'll change the schedule on the package to run at minute 59.
        use the same day arg that is available on package schedule description.

        I did not included a remove previous logs on current package version, but maybe on a future release.

        Try to clean it using a shell script on cron.

        att,
        Marcello Coutinho

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • A
          aru
          last edited by

          Hi,

          I am having problems with sarg package. I am running pfsense 2.1-BETA0 (i386) built on Tue Aug 28 14:42:47 EDT 2012 FreeBSD 8.3-RELEASE-p4 with squid 3 with dansguardian and freeradius 2. 
          Everything works except sarg.  I have configured sarg as suggested on this forum ie, i have selected default options mentioned in brackets including index and tree file.

          At console if i run sarg -x -z it shows errors with input log file location and output directory locations as in /usr/pbi/sarg-i386/etc/sarg/sarg.conf

          I found that from web gui, the config file is at /usr/local/etc/sarg/sarg.conf.  I created a symlink from /usr/pbi/sarg-i386/etc/sarg to point to /usr/local/etc/sarg/sarg.conf

          After this I ran sarg -x -z from pfsense box and reports created at /usr/local/sarg-reports which can be seen
          from gui and cron job creates report based on schedule, but "force update now" doesn't create any report and
          realtime also does'nt show any report.  Sorry if this is answered already, but I couldn't find anywhere.

          Kindly help,

          Thanks
          Arun

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            I did had not time yet to make sarg running without manual symlinks on 2.1.

            It will work fine on next package release.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • A
              aru
              last edited by

              Hi Marcello, I could not get it to work as I installed other packages from the gui.  My procedure may be wrong.
              Need your help.  I am new to pfsense/freebsd & linux.  I could not understand your reply.

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @aru:

                I am new to pfsense/freebsd & linux.  I could not understand your reply.

                This package need some fixes do work with 2.1. I'll do it when I have time.

                If you do not need ipv6, sarg package works fine on  pfsense 2.0.1

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • A
                  aru
                  last edited by

                  Thanks for your quick reply Marcello.

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    Sarg pkg v 0.6 is out with gzip compress report options to reduce 4 times reports disk usage.

                    sarg_compress.png
                    sarg_compress.png_thumb

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • S
                      serialdie
                      last edited by

                      @marcelloc:

                      Sarg pkg v 0.6 is out with gzip compress report options to reduce 4 times reports disk usage.

                      Awesome.

                      Thanks marcelloc!

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        version 0.6.1 is out with

                        • pfsense 2.1 support

                        • max report age option

                        backup you data and test it on labs before using report max age option on production. I'm not responsible for data lost.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • M
                          miles267
                          last edited by

                          I recently updated to Sarg 2.3.2 pkg v.0.6.1.  Since then my reports have stopped refreshing.  When  attempt to force an update now, the system log reports the following error:

                          php: /pkg_edit.php: The command '/usr/local/bin/sarg -d date +%d/%m/%Y-date +%d/%m/%Y' returned exit code '1', the output was 'SARG: (util) Cannot open file /etc/sarg/exclude_codes (exclude_codes)'

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            Reinstall the package, save sarg config on gui and try again.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • M
                              miles267
                              last edited by

                              @marcelloc:

                              Reinstall the package, save sarg config on gui and try again.

                              unfortunately that didn't correct the issue.  tried 2X.  however, I did go into my schedule and for this task:

                              Rotate Logs and Restart Daemon
                              -d date +%d/%m/%Y-date +%d/%m/%Y

                              I checked the 'Enable Compression'
                              Setting: Default gzip compression (recommended)

                              Then SAVED and FORCEd UPDATE NOW.  It then appeared to refresh my VIEW REPORT data.  Though it left a gap between 9/18 and 9/20 (no entry listed for 9/19).  I will monitor to see whether 9/21 data appears automatically tomorrow without any manual intervention.

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                using sarg -x  exclude_codes path is  "/usr/local/etc/sarg/exclude_codes" instead of  "/etc/sarg/exclude_codes".

                                That's what resintall package/save config do.

                                The gzip option reduces 4 times reports disk usage.

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • M
                                  miles267
                                  last edited by

                                  @marcelloc:

                                  using sarg -x  exclude_codes path is  "/usr/local/etc/sarg/exclude_codes" instead of  "/etc/sarg/exclude_codes".

                                  That's what resintall package/save config do.

                                  OK.  I am a bit confused.  So when I uninstalled and reinstalled the Sarg package to update to the latest version, it moved the exclude_codes path

                                  FROM: "/usr/local/etc/sarg/exclude_codes"
                                  TO: "/etc/sarg/exclude_codes"

                                  Do I need to add the argument 'sarg -x' somewhere?  Also my EXCLUDE CODES dialog box on the Sarg GENERAL tab is empty.

                                  Thanks again.

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    No need to change config files or dirs. Just check the sarg -x output.

                                    On my tests, after reinstall/save config file is correct and sarg ir running fine.

                                    SARG: Init
                                    SARG: Loading configuration from /usr/local/etc/sarg/sarg.conf
                                    SARG: Loading exclude host file from: /usr/local/etc/sarg/exclude_hosts.conf
                                    SARG: Loading exclude file from: /usr/local/etc/sarg/exclude_users.conf
                                    SARG: Reading host alias file "/usr/local/etc/sarg/hostalias"
                                    SARG: List of host names to alias:
                                    SARG: Parameters:
                                    SARG:           Hostname or IP address (-a) =
                                    SARG:                    Useragent log (-b) =
                                    SARG:                     Exclude file (-c) = /usr/local/etc/sarg/exclude_hosts.conf
                                    SARG:                  Date from-until (-d) =
                                    SARG:    Email address to send reports (-e) =
                                    SARG:                      Config file (-f) = /usr/local/etc/sarg/sarg.conf
                                    SARG:                      Date format (-g) = USA (mm/dd/yyyy)
                                    SARG:                        IP report (-i) = No
                                    SARG:                        Input log (-l) = /var/squid/logs/access.log
                                    SARG:               Resolve IP Address (-n) = No
                                    SARG:                       Output dir (-o) = /usr/local/sarg-reports/
                                    SARG: Use Ip Address instead of userid (-p) = No
                                    SARG:                    Accessed site (-s) =
                                    SARG:                             Time (-t) =
                                    SARG:                             User (-u) =
                                    SARG:                    Temporary dir (-w) = /tmp/sarg
                                    SARG:                   Debug messages (-x) = Yes
                                    SARG:                 Process messages (-z) = No
                                    SARG:  Previous reports to keep (--lastlog) = 0
                                    SARG:
                                    SARG: sarg version: 2.3.2 Nov-23-2011
                                    SARG: Reading access log file: /var/squid/logs/access.log
                                    SARG: Records in file: 3298, reading: 100.00%
                                    SARG:    Records read: 3298, written: 3297, excluded: 0
                                    SARG: Squid log format
                                    SARG: Period: 2012 Apr 03-2012 Sep 14
                                    SARG: pre-sorting files
                                    SARG: Making file: /tmp/sarg/164_XXXXXX
                                    SARG: Making file: /tmp/sarg/127_0_0_1
                                    SARG: Making file: /tmp/sarg/164_XXXXX
                                    SARG: Making file: /tmp/sarg/teste1
                                    SARG: Sorting file: /tmp/sarg/164_XXXXX.utmp
                                    SARG: Making report: 164.XXXXX
                                    SARG: Sorting file: /tmp/sarg/127_0_0_1.utmp
                                    SARG: Making report: 127.0.0.1
                                    SARG: Sorting file: /tmp/sarg/164_XXXXX.utmp
                                    SARG: Making report: 164.XXXXX
                                    SARG: Sorting file: /tmp/sarg/teste1.utmp
                                    SARG: Making report: teste1
                                    SARG: Making index.html
                                    SARG: Successful report generated on /usr/local/sarg-reports/2012Apr03-2012Sep14
                                    SARG: Purging temporary file sarg-general
                                    SARG: End
                                    
                                    

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      miles267
                                      last edited by

                                      Thank you.  Sarg -x from a shell command prompt complete successfully (no errors) similar to result you posted from your log.  If my Sarg doesn't update on it's own on 9/21 (without a forced update), I'll advise.

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        @namek:

                                        Hello, Is it possible to change the unit from bytes to something higher? like KB or MB?

                                        Sure. :)

                                        Just select Show values in reports using abbreviation on sarg general tab.

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • I
                                          ilium007
                                          last edited by

                                          I can;t seem to see any option to restrict access to SARG reports. I can't have direct user access to these ports. I know this was supposed to be fixed in 0.6 but I am running the latest and direct access still works. How can we disable / password protect this ? Cheers.

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            sarg create reports on /usr/local/sarg-reports, check if you still have both dirs.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.