Sarg package for pfsense

aru · Sep 12, 2012, 11:18 AM

Hi,

I am having problems with sarg package. I am running pfsense 2.1-BETA0 (i386) built on Tue Aug 28 14:42:47 EDT 2012 FreeBSD 8.3-RELEASE-p4 with squid 3 with dansguardian and freeradius 2.
Everything works except sarg. I have configured sarg as suggested on this forum ie, i have selected default options mentioned in brackets including index and tree file.

At console if i run sarg -x -z it shows errors with input log file location and output directory locations as in /usr/pbi/sarg-i386/etc/sarg/sarg.conf

I found that from web gui, the config file is at /usr/local/etc/sarg/sarg.conf. I created a symlink from /usr/pbi/sarg-i386/etc/sarg to point to /usr/local/etc/sarg/sarg.conf

After this I ran sarg -x -z from pfsense box and reports created at /usr/local/sarg-reports which can be seen
from gui and cron job creates report based on schedule, but "force update now" doesn't create any report and
realtime also does'nt show any report. Sorry if this is answered already, but I couldn't find anywhere.

Kindly help,

Thanks
Arun

marcelloc · Sep 12, 2012, 2:36 PM

I did had not time yet to make sarg running without manual symlinks on 2.1.

It will work fine on next package release.

aru · Sep 12, 2012, 2:46 PM

Hi Marcello, I could not get it to work as I installed other packages from the gui. My procedure may be wrong.
Need your help. I am new to pfsense/freebsd & linux. I could not understand your reply.

marcelloc · Sep 12, 2012, 2:49 PM

@aru:

I am new to pfsense/freebsd & linux. I could not understand your reply.

This package need some fixes do work with 2.1. I'll do it when I have time.

If you do not need ipv6, sarg package works fine on pfsense 2.0.1

aru · Sep 12, 2012, 2:55 PM

Thanks for your quick reply Marcello.

marcelloc · Sep 14, 2012, 4:15 PM

Sarg pkg v 0.6 is out with gzip compress report options to reduce 4 times reports disk usage.

serialdie · Sep 16, 2012, 5:09 PM

@marcelloc:

Sarg pkg v 0.6 is out with gzip compress report options to reduce 4 times reports disk usage.

Awesome.

Thanks marcelloc!

marcelloc · Sep 17, 2012, 8:22 PM

version 0.6.1 is out with

pfsense 2.1 support
max report age option

backup you data and test it on labs before using report max age option on production. I'm not responsible for data lost.

miles267 · Sep 20, 2012, 1:35 PM

I recently updated to Sarg 2.3.2 pkg v.0.6.1. Since then my reports have stopped refreshing. When attempt to force an update now, the system log reports the following error:

php: /pkg_edit.php: The command '/usr/local/bin/sarg -d date +%d/%m/%Y-date +%d/%m/%Y' returned exit code '1', the output was 'SARG: (util) Cannot open file /etc/sarg/exclude_codes (exclude_codes)'

marcelloc · Sep 20, 2012, 2:27 PM

Reinstall the package, save sarg config on gui and try again.

miles267 · Sep 20, 2012, 2:48 PM

@marcelloc:

Reinstall the package, save sarg config on gui and try again.

unfortunately that didn't correct the issue. tried 2X. however, I did go into my schedule and for this task:

Rotate Logs and Restart Daemon
-d date +%d/%m/%Y-date +%d/%m/%Y

I checked the 'Enable Compression'
Setting: Default gzip compression (recommended)

Then SAVED and FORCEd UPDATE NOW. It then appeared to refresh my VIEW REPORT data. Though it left a gap between 9/18 and 9/20 (no entry listed for 9/19). I will monitor to see whether 9/21 data appears automatically tomorrow without any manual intervention.

marcelloc · Sep 20, 2012, 3:11 PM

using sarg -x exclude_codes path is "/usr/local/etc/sarg/exclude_codes" instead of "/etc/sarg/exclude_codes".

That's what resintall package/save config do.

The gzip option reduces 4 times reports disk usage.

miles267 · Sep 20, 2012, 3:22 PM

@marcelloc:

using sarg -x exclude_codes path is "/usr/local/etc/sarg/exclude_codes" instead of "/etc/sarg/exclude_codes".

That's what resintall package/save config do.

OK. I am a bit confused. So when I uninstalled and reinstalled the Sarg package to update to the latest version, it moved the exclude_codes path

FROM: "/usr/local/etc/sarg/exclude_codes"
TO: "/etc/sarg/exclude_codes"

Do I need to add the argument 'sarg -x' somewhere? Also my EXCLUDE CODES dialog box on the Sarg GENERAL tab is empty.

Thanks again.

marcelloc · Sep 20, 2012, 3:28 PM

No need to change config files or dirs. Just check the sarg -x output.

On my tests, after reinstall/save config file is correct and sarg ir running fine.

SARG: Init
SARG: Loading configuration from /usr/local/etc/sarg/sarg.conf
SARG: Loading exclude host file from: /usr/local/etc/sarg/exclude_hosts.conf
SARG: Loading exclude file from: /usr/local/etc/sarg/exclude_users.conf
SARG: Reading host alias file "/usr/local/etc/sarg/hostalias"
SARG: List of host names to alias:
SARG: Parameters:
SARG:           Hostname or IP address (-a) =
SARG:                    Useragent log (-b) =
SARG:                     Exclude file (-c) = /usr/local/etc/sarg/exclude_hosts.conf
SARG:                  Date from-until (-d) =
SARG:    Email address to send reports (-e) =
SARG:                      Config file (-f) = /usr/local/etc/sarg/sarg.conf
SARG:                      Date format (-g) = USA (mm/dd/yyyy)
SARG:                        IP report (-i) = No
SARG:                        Input log (-l) = /var/squid/logs/access.log
SARG:               Resolve IP Address (-n) = No
SARG:                       Output dir (-o) = /usr/local/sarg-reports/
SARG: Use Ip Address instead of userid (-p) = No
SARG:                    Accessed site (-s) =
SARG:                             Time (-t) =
SARG:                             User (-u) =
SARG:                    Temporary dir (-w) = /tmp/sarg
SARG:                   Debug messages (-x) = Yes
SARG:                 Process messages (-z) = No
SARG:  Previous reports to keep (--lastlog) = 0
SARG:
SARG: sarg version: 2.3.2 Nov-23-2011
SARG: Reading access log file: /var/squid/logs/access.log
SARG: Records in file: 3298, reading: 100.00%
SARG:    Records read: 3298, written: 3297, excluded: 0
SARG: Squid log format
SARG: Period: 2012 Apr 03-2012 Sep 14
SARG: pre-sorting files
SARG: Making file: /tmp/sarg/164_XXXXXX
SARG: Making file: /tmp/sarg/127_0_0_1
SARG: Making file: /tmp/sarg/164_XXXXX
SARG: Making file: /tmp/sarg/teste1
SARG: Sorting file: /tmp/sarg/164_XXXXX.utmp
SARG: Making report: 164.XXXXX
SARG: Sorting file: /tmp/sarg/127_0_0_1.utmp
SARG: Making report: 127.0.0.1
SARG: Sorting file: /tmp/sarg/164_XXXXX.utmp
SARG: Making report: 164.XXXXX
SARG: Sorting file: /tmp/sarg/teste1.utmp
SARG: Making report: teste1
SARG: Making index.html
SARG: Successful report generated on /usr/local/sarg-reports/2012Apr03-2012Sep14
SARG: Purging temporary file sarg-general
SARG: End

miles267 · Sep 20, 2012, 3:59 PM

Thank you. Sarg -x from a shell command prompt complete successfully (no errors) similar to result you posted from your log. If my Sarg doesn't update on it's own on 9/21 (without a forced update), I'll advise.

marcelloc · Sep 24, 2012, 9:20 PM

@namek:

Hello, Is it possible to change the unit from bytes to something higher? like KB or MB?

Sure. :)

Just select Show values in reports using abbreviation on sarg general tab.

ilium007 · Sep 26, 2012, 9:28 AM

I can;t seem to see any option to restrict access to SARG reports. I can't have direct user access to these ports. I know this was supposed to be fixed in 0.6 but I am running the latest and direct access still works. How can we disable / password protect this ? Cheers.

marcelloc · Sep 26, 2012, 2:46 PM

sarg create reports on /usr/local/sarg-reports, check if you still have both dirs.

ilium007 · Sep 27, 2012, 3:55 AM

Hi - the reports all work, that's not the issue. My problem is that you can access them with a direct URL with no authentication. Is there anyway to resolve this ? Cheers

marcelloc · Sep 27, 2012, 4:03 AM

Reports on /usar/local/www/sarg-reports are visible to everyone.

Since version 0.5 reports are saved on /usr/local/sarg-reports out of www http server.

Check what dirs you have and where new reports are being saved.

Also, enabling report compress, it will not be visible without php script that reads it.