Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sarg package for pfsense

    Scheduled Pinned Locked Moved pfSense Packages
    467 Posts 99 Posters 501.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      Caldwell, there is no bug on sarg package for squid and dansguardian logs.

      just take a a look on forum for a working config that I'm using and check your squid access log config.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        Nachtfalke,

        Maybe a grep on squid log file for denied entries????

        This way there will be only denied access to report.

        Did you tried to select only denied sites on reports to generate?

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          @marcelloc:

          Nachtfalke,

          Maybe a grep on squid log file for denied entries????

          This way there will be only denied access to report.

          You think of a possibility that a script could do the grep on the access.log, just save the denied entries in a new file and delete the original one ?
          Didn't try that but could be a possibility.

          @marcelloc:

          Did you tried to select only denied sites on reports to generate?

          Not sure if I did that. But I saw all sites so I suppose that I didn't try that. Perhaps I can try this if I find some spare time. I uninstalled SARG some days ago.

          1 Reply Last reply Reply Quote 0
          • E
            expert_az
            last edited by

            2.0.1-RELEASE (amd64)

            Hello i'm getting this error on logs:

            php: : The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 16119722, reading: 0.00%^MSARG: Records in file: 5000, reading: 0.03%^MSARG: Records in file: 10000, reading: 0.06%^MSARG: Records in file: 15000, reading: 0.09%^MSARG: Records in file: 20000, reading: 0.12%^MSARG: Records in file: 25000, reading: 0.16%^MSARG: Records in file: 30000, reading: 0.19%^MSARG: Records in file: 35000, reading: 0.22%^MSARG: Records in file: 40000, reading: 0.25%^MSARG: Records in file: 45000, reading: 0.28%^MSARG: Records in file: 50000, reading: 0.31%^MSARG: Records in file: 55000, reading: 0.34%^MSARG: Records in file: 60000, reading: 0.37%^MSARG: Records in file: 65000, reading: 0.40%^MSARG: Records in file: 70000, reading: 0.43%^MSARG: Records in file: 75000, reading: 0.47%^MSARG: Records in file: 80000, reading: 0.50%^MSARG: Records in file: 85000, reading: 0.53%^MSARG: Records in file: 90000, reading: 0.56%^MSARG: Records in file: 95000, reading: 0.59%^MS

            and when i try running sarg from console getting this log:

            sarg
            SARG: Records in file: 16121346, reading: 100.00%
            sort: open failed: /tmp/sarg/denied.log.unsort: No such file or directory
            SARG: sort command return status 2
            SARG: sort command: sort -T "/tmp/sarg" -t "    " -k 3,3 -k 5,5 -o "/tmp/sarg/denied.log" "/tmp/sarg/denied.log.unsort"

            i did reinstall

            1 Reply Last reply Reply Quote 0
            • B
              bernie156
              last edited by

              Hi, I just did a fresh installation of pfSense, then squid 2.7.9 pkg v.4.3.1 and after that Sarg 2.3.2 pkg v.0.6.1.

              Running a simple report generation with "force update now" gives this output:

              php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 13455, reading: 0.00%^MSARG: Records in file: 5000, reading: 37.16%^MSARG: Records in file: 10000, reading: 74.32%^MSARG: cannot open /usr/local/sarg-reports/2013/01/18-19/sarg-date for writing SARG:: No such file or directory SARG: Records in file: 13455, reading: 100.00%'

              Sarg created a folder at that time: /usr/local/sarg-reports/2013/01/18-19.5  with the content
              drwxr-xr-x  2 root  wheel  114176 Jan 19 16:00 192_168_24_10
              drwxr-xr-x  2 root  wheel    512 Jan 19 16:00 192_168_24_201
              -rw-r–r--  1 root  wheel    1402 Jan 19 16:00 download.html.gz
              -rw-r--r--  1 root  wheel    1581 Jan 19 16:00 index.html.gz
              -rw-r--r--  1 root  wheel      22 Jan 19 16:00 sarg-date
              -rw-r--r--  1 root  wheel  177652 Jan 19 16:00 sarg-general
              -rw-r--r--  1 root  wheel  65450 Jan 19 16:00 sarg-sites
              -rw-r--r--  1 root  wheel      2 Jan 19 16:00 sarg-users
              -rw-r--r--  1 root  wheel  23027 Jan 19 16:00 siteuser.html.gz
              -rw-r--r--  1 root  wheel    4893 Jan 19 16:00 topsites.html.gz

              So I do not understand what to with "MSARG: cannot open /usr/local/sarg-reports/2013/01/18-19/sarg-date for writing SARG:: No such file or directory"

              Can someone help me?

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                What sarg options did you selected on GUI? Did you tried to remove this report before running sarg again?

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • B
                  bernie156
                  last edited by

                  I only selected Report Options "Convert to IP address" and "Top Users" and "Top Sites" on the General Tab. The scheduled report has no Sarg args set.

                  No, I didn't try to remove a report. Tab "View Report" says always
                  Error: Could not find report index file.
                  Check and save sarg settings and try to force sarg schedule.

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    Check config options. One you will need is create index file

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • B
                      bernie156
                      last edited by

                      Selected all options wich were default "(yes)".  And - as expected - got: "Error: Could not find report index file. Check and save sarg settings and try to force sarg schedule."

                      As you can see in my first post, the index.html is there but cannot be found.

                      Today /usr/local/sarg-reports/18Jan2013-20Jan2013 contains
                      -rw-r–r--  1 root  wheel    1156 Jan 20 11:38 index.html.gz
                      -rw-r--r--  1 root  wheel      22 Jan 20 11:38 sarg-date
                      -rw-r--r--  1 root  wheel  408865 Jan 20 11:38 sarg-general
                      -rw-r--r--  1 root  wheel    100 Jan 20 11:38 top

                      Log says today:
                      php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 29632, reading: 0.00%^MSARG: Records in file: 5000, reading: 16.87%^MSARG: Records in file: 10000, reading: 33.75%^MSARG: Records in file: 15000, reading: 50.62%^MSARG: Records in file: 20000, reading: 67.49%^MSARG: Records in file: 25000, reading: 84.37%^MSARG: Cannot delete /usr/local/sarg-reports/18Jan2013-20Jan2013/d192_168_24_201.html - No such file or directory SARG: Records in file: 29632, reading: 100.00%'

                      1 Reply Last reply Reply Quote 0
                      • B
                        bernie156
                        last edited by

                        I did a fresh install of pfSense, squid 3 and Sarg, selected all Sarg default options and it works. Thanks for your effort anyway.

                        1 Reply Last reply Reply Quote 0
                        • K
                          KeltecRFB
                          last edited by

                          Raising a Necro-Thread instead of creating a new one.

                          Is there way to configure Sarg to show denied access reporting and what Proxy\Dans acl triggered it?  Can that be done in the GUI or is it in CLI only?

                          Thanks!

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            @KeltecRFB:

                            Is there way to configure Sarg to show denied access reporting and what Proxy\Dans acl triggered it?  Can that be done in the GUI or is it in CLI only?

                            Sarg only understands squid log format, so I think it sarg is not able to log what ACL denied a url.

                            Do you have a sarg config that does it?

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • N
                              novicenaja
                              last edited by

                              @marcelloc:

                              Hi all,

                              I've just published sarg package for pfsense with squid,squidguard and dansguardian log Analysis as well real time report tab.

                              Squidguard functions are under devel yet but squid and dansguardians(as well as I tested) are working.

                              After almost everything done, I found an old sarg package published on forum by joaohf and merged some function calls from this old thread.

                              Another good point is that sarg is able to forward logs via email, so I'm planning to include it for nanobsd installs.

                              have fun and feedback!  :)

                              att,
                              Marcello Coutinho

                              ขอบคุณครับ (khob kun krub) Thank you verymuch

                              1 Reply Last reply Reply Quote 0
                              • P
                                pszafer
                                last edited by

                                For over a week I've been trying to config SARG because sometimes it works and sometimes not.

                                The problem is: "SARG: Cannot set the locale LC_ALL to the environment variable".

                                Sometimes when I restart webconfigurator and in shell set LC_ALL: setenv LC_ALL "en_US" it works from webGUI,
                                but more often it does not work at all.

                                Could you give me some trail where I can look for my mistakes, please?

                                Graphs should be generated from squid access log.
                                I can generate it from shell without any problem but not by command
                                "/usr/local/bin/php /usr/local/www/sarg.php 1"
                                it gives above error.

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  what version of sarg and pfsense are you using?

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    Topper727
                                    last edited by

                                    Hello,

                                    I have
                                    2.1-BETA1 (amd64)
                                    built on Wed Apr 10 18:48:44 EDT 2013
                                    FreeBSD 8.3-RELEASE-p7

                                    squidGuard Network Management 1.4_4 pkg v.1.9.2
                                    Lightsquid Network Report         1.8.2 pkg v.2.32
                                    Sarg         Network Report         2.3.2 pkg v.0.6.1
                                    squid3 Network                3.1.20 pkg 2.0.6

                                    I get for View Report
                                    Error: Could not find report index file.
                                    Check and save sarg settings and try to force sarg schedule.

                                    In the system log
                                    php: /pkg_edit.php: The command '/usr/pbi/sarg-amd64/bin/sarg ' returned exit code '1', the output was 'SARG: Cannot set the locale LC_ALL to the environment variable'

                                    Realtime works

                                    Dell 2950 g3 server
                                    Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
                                    Current: 2000 MHz, Max: 2667 MHz
                                    8 CPUs: 2 package(s) x 4 core(s)
                                    8152 MiB and 600meg 10k drive
                                    Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      pszafer
                                      last edited by

                                      I have also pfSense 2.1-BETA and the Sarg package 2.3.2 pkg v.0.6.1.

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        baba
                                        last edited by

                                        Hello, sorry, i can't understand a thing…
                                        Can I configure ldap settings in sarg to display username instead of IP if i use squid in trasnsparent mode without authentication?
                                        Thanks

                                        1 Reply Last reply Reply Quote 0
                                        • technicalT
                                          technical
                                          last edited by

                                          @pszafer:

                                          For over a week I've been trying to config SARG because sometimes it works and sometimes not.

                                          The problem is: "SARG: Cannot set the locale LC_ALL to the environment variable".

                                          Sometimes when I restart webconfigurator and in shell set LC_ALL: setenv LC_ALL "en_US" it works from webGUI,
                                          but more often it does not work at all.

                                          Could you give me some trail where I can look for my mistakes, please?

                                          Graphs should be generated from squid access log.
                                          I can generate it from shell without any problem but not by command
                                          "/usr/local/bin/php /usr/local/www/sarg.php 1"
                                          it gives above error.

                                          i have same problems in the pfsense 2.0.2 Release
                                          sarg
                                          squid3
                                          squidguard

                                          Necati Selim GÜNER
                                          IT Technician

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tempest69
                                            last edited by

                                            Hello,
                                            same error for me with pfsense 2.1 (last version disponible at this time), fresh squid and sarg install , i was getting the message

                                            php: /pkg_edit.php: The command '/usr/pbi/sarg-amd64/bin/sarg ' returned exit code '1', the output was 'SARG: Cannot set the locale LC_ALL to the environment variable'
                                            

                                            until i change sarg config from

                                            Date Format =European
                                            to
                                            Date Format=American (default)

                                            well its not a real solution (but today it doesn't matter 05/05/2013 is the same in American and European !!!)

                                            Edit :Message seems to have gone… but no, it is still here!!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.