Sarg package for pfsense

bernie156 · Jan 19, 2013, 3:17 PM

Hi, I just did a fresh installation of pfSense, then squid 2.7.9 pkg v.4.3.1 and after that Sarg 2.3.2 pkg v.0.6.1.

Running a simple report generation with "force update now" gives this output:

php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 13455, reading: 0.00%^MSARG: Records in file: 5000, reading: 37.16%^MSARG: Records in file: 10000, reading: 74.32%^MSARG: cannot open /usr/local/sarg-reports/2013/01/18-19/sarg-date for writing SARG:: No such file or directory SARG: Records in file: 13455, reading: 100.00%'

Sarg created a folder at that time: /usr/local/sarg-reports/2013/01/18-19.5 with the content
drwxr-xr-x 2 root wheel 114176 Jan 19 16:00 192_168_24_10
drwxr-xr-x 2 root wheel 512 Jan 19 16:00 192_168_24_201
-rw-r–r-- 1 root wheel 1402 Jan 19 16:00 download.html.gz
-rw-r--r-- 1 root wheel 1581 Jan 19 16:00 index.html.gz
-rw-r--r-- 1 root wheel 22 Jan 19 16:00 sarg-date
-rw-r--r-- 1 root wheel 177652 Jan 19 16:00 sarg-general
-rw-r--r-- 1 root wheel 65450 Jan 19 16:00 sarg-sites
-rw-r--r-- 1 root wheel 2 Jan 19 16:00 sarg-users
-rw-r--r-- 1 root wheel 23027 Jan 19 16:00 siteuser.html.gz
-rw-r--r-- 1 root wheel 4893 Jan 19 16:00 topsites.html.gz

So I do not understand what to with "MSARG: cannot open /usr/local/sarg-reports/2013/01/18-19/sarg-date for writing SARG:: No such file or directory"

Can someone help me?

marcelloc · Jan 19, 2013, 4:05 PM

What sarg options did you selected on GUI? Did you tried to remove this report before running sarg again?

bernie156 · Jan 19, 2013, 10:47 PM

I only selected Report Options "Convert to IP address" and "Top Users" and "Top Sites" on the General Tab. The scheduled report has no Sarg args set.

No, I didn't try to remove a report. Tab "View Report" says always
Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

marcelloc · Jan 20, 2013, 2:52 AM

Check config options. One you will need is create index file

bernie156 · Jan 20, 2013, 10:46 AM

Selected all options wich were default "(yes)". And - as expected - got: "Error: Could not find report index file. Check and save sarg settings and try to force sarg schedule."

As you can see in my first post, the index.html is there but cannot be found.

Today /usr/local/sarg-reports/18Jan2013-20Jan2013 contains
-rw-r–r-- 1 root wheel 1156 Jan 20 11:38 index.html.gz
-rw-r--r-- 1 root wheel 22 Jan 20 11:38 sarg-date
-rw-r--r-- 1 root wheel 408865 Jan 20 11:38 sarg-general
-rw-r--r-- 1 root wheel 100 Jan 20 11:38 top

Log says today:
php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 29632, reading: 0.00%^MSARG: Records in file: 5000, reading: 16.87%^MSARG: Records in file: 10000, reading: 33.75%^MSARG: Records in file: 15000, reading: 50.62%^MSARG: Records in file: 20000, reading: 67.49%^MSARG: Records in file: 25000, reading: 84.37%^MSARG: Cannot delete /usr/local/sarg-reports/18Jan2013-20Jan2013/d192_168_24_201.html - No such file or directory SARG: Records in file: 29632, reading: 100.00%'

bernie156 · Jan 21, 2013, 9:24 PM

I did a fresh install of pfSense, squid 3 and Sarg, selected all Sarg default options and it works. Thanks for your effort anyway.

KeltecRFB · Jan 29, 2013, 2:43 PM

Raising a Necro-Thread instead of creating a new one.

Is there way to configure Sarg to show denied access reporting and what Proxy\Dans acl triggered it? Can that be done in the GUI or is it in CLI only?

Thanks!

marcelloc · Jan 29, 2013, 2:46 PM

@KeltecRFB:

Is there way to configure Sarg to show denied access reporting and what Proxy\Dans acl triggered it? Can that be done in the GUI or is it in CLI only?

Sarg only understands squid log format, so I think it sarg is not able to log what ACL denied a url.

Do you have a sarg config that does it?

novicenaja · Feb 6, 2013, 7:52 AM

@marcelloc:

Hi all,

I've just published sarg package for pfsense with squid,squidguard and dansguardian log Analysis as well real time report tab.

Squidguard functions are under devel yet but squid and dansguardians(as well as I tested) are working.

After almost everything done, I found an old sarg package published on forum by joaohf and merged some function calls from this old thread.

Another good point is that sarg is able to forward logs via email, so I'm planning to include it for nanobsd installs.

have fun and feedback! :)

att,
Marcello Coutinho

ขอบคุณครับ (khob kun krub) Thank you verymuch

pszafer · Apr 8, 2013, 8:15 AM

For over a week I've been trying to config SARG because sometimes it works and sometimes not.

The problem is: "SARG: Cannot set the locale LC_ALL to the environment variable".

Sometimes when I restart webconfigurator and in shell set LC_ALL: setenv LC_ALL "en_US" it works from webGUI,
but more often it does not work at all.

Could you give me some trail where I can look for my mistakes, please?

Graphs should be generated from squid access log.
I can generate it from shell without any problem but not by command
"/usr/local/bin/php /usr/local/www/sarg.php 1"
it gives above error.

marcelloc · Apr 12, 2013, 9:19 PM

what version of sarg and pfsense are you using?

Topper727 · Apr 13, 2013, 4:54 AM

Hello,

I have
2.1-BETA1 (amd64)
built on Wed Apr 10 18:48:44 EDT 2013
FreeBSD 8.3-RELEASE-p7

squidGuard Network Management 1.4_4 pkg v.1.9.2
Lightsquid Network Report 1.8.2 pkg v.2.32
Sarg Network Report 2.3.2 pkg v.0.6.1
squid3 Network 3.1.20 pkg 2.0.6

I get for View Report
Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

In the system log
php: /pkg_edit.php: The command '/usr/pbi/sarg-amd64/bin/sarg ' returned exit code '1', the output was 'SARG: Cannot set the locale LC_ALL to the environment variable'

Realtime works

pszafer · Apr 16, 2013, 7:29 AM

I have also pfSense 2.1-BETA and the Sarg package 2.3.2 pkg v.0.6.1.

baba · Apr 18, 2013, 9:05 AM

Hello, sorry, i can't understand a thing…
Can I configure ldap settings in sarg to display username instead of IP if i use squid in trasnsparent mode without authentication?
Thanks

technical · May 4, 2013, 7:19 AM

@pszafer:

For over a week I've been trying to config SARG because sometimes it works and sometimes not.

The problem is: "SARG: Cannot set the locale LC_ALL to the environment variable".

Sometimes when I restart webconfigurator and in shell set LC_ALL: setenv LC_ALL "en_US" it works from webGUI,
but more often it does not work at all.

Could you give me some trail where I can look for my mistakes, please?

Graphs should be generated from squid access log.
I can generate it from shell without any problem but not by command
"/usr/local/bin/php /usr/local/www/sarg.php 1"
it gives above error.

i have same problems in the pfsense 2.0.2 Release
sarg
squid3
squidguard

tempest69 · May 5, 2013, 7:18 PM

Hello,
same error for me with pfsense 2.1 (last version disponible at this time), fresh squid and sarg install , i was getting the message

php: /pkg_edit.php: The command '/usr/pbi/sarg-amd64/bin/sarg ' returned exit code '1', the output was 'SARG: Cannot set the locale LC_ALL to the environment variable'

until i change sarg config from

Date Format =European
to
Date Format=American (default)

well its not a real solution (but today it doesn't matter 05/05/2013 is the same in American and European !!!)

Edit :Message seems to have gone… but no, it is still here!!

pszafer · May 6, 2013, 7:36 AM

I did it too (changed date format), but it isn't stable solution, beacuse from 2 weeks Sarg with Date format = American is not working.

estragon · May 20, 2013, 8:56 AM

Hello,
i can't remove Sarg package …

i'm using : 2.1-BETA1 (i386) built on Sun May 19 05:11:18 EDT 2013 FreeBSD 8.3-RELEASE-p8

after an upgrade, i have an issue with sarg package (2.3.6 pkg v.0.6.1) :

Crash report begins. Anonymous machine information:
i386
8.3-RELEASE-p8
FreeBSD 8.3-RELEASE-p8 #1: Sun May 19 05:40:04 EDT 2013 root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8
Crash report details:
PHP Errors:
[20-May-2013 10:44:41 Europe/Paris] PHP Fatal error: Call to undefined function sync_package_sarg() in /etc/inc/pkg-utils.inc(474) : eval()'d code on line 1
[20-May-2013 10:44:45 Europe/Paris] PHP Fatal error: Call to undefined function sync_package_sarg() in /etc/inc/pkg-utils.inc(474) : eval()'d code on line 1
Filename: /var/crash/minfree
2048

i have tray to re install the pack but no success
then i have tray to remove the pack. i receive that feed back :

Removing package…
Starting package deletion for sarg-2.3.6-i386...done.
Removing Sarg components...
Tabs items... done.
Menu items... done.
Loading package instructions...
Deinstall commands...

but the pack still be present !

thanks for the suggestions on better way to clear the systeme (may be just to wait for pkg update ?)

marcelloc · May 20, 2013, 1:43 PM

@estragon:

but the pack still be present !

Check if sarg.inc exists on /usr/local/pkg dir and remove it.

estragon · May 20, 2013, 8:50 PM

Hello,
thanks very much for your help, and just as feed back :
I go on Diagnostics -> Edit File to check, and the file ahas her (with 0kb)
then I go to Diagnostics -> Command Prompt and execute : rm /usr/local/pkg/sarg.inc
then I go to remove the package from the System -> Package

… i have not all well understand, but that works …. thanks very much !

salutations et merci pour votre super travail !
gerard