Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sarg package for pfsense

    Scheduled Pinned Locked Moved pfSense Packages
    467 Posts 99 Posters 564.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bernie156
      last edited by

      Selected all options wich were default "(yes)".  And - as expected - got: "Error: Could not find report index file. Check and save sarg settings and try to force sarg schedule."

      As you can see in my first post, the index.html is there but cannot be found.

      Today /usr/local/sarg-reports/18Jan2013-20Jan2013 contains
      -rw-r–r--  1 root  wheel    1156 Jan 20 11:38 index.html.gz
      -rw-r--r--  1 root  wheel      22 Jan 20 11:38 sarg-date
      -rw-r--r--  1 root  wheel  408865 Jan 20 11:38 sarg-general
      -rw-r--r--  1 root  wheel    100 Jan 20 11:38 top

      Log says today:
      php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 29632, reading: 0.00%^MSARG: Records in file: 5000, reading: 16.87%^MSARG: Records in file: 10000, reading: 33.75%^MSARG: Records in file: 15000, reading: 50.62%^MSARG: Records in file: 20000, reading: 67.49%^MSARG: Records in file: 25000, reading: 84.37%^MSARG: Cannot delete /usr/local/sarg-reports/18Jan2013-20Jan2013/d192_168_24_201.html - No such file or directory SARG: Records in file: 29632, reading: 100.00%'

      1 Reply Last reply Reply Quote 0
      • B
        bernie156
        last edited by

        I did a fresh install of pfSense, squid 3 and Sarg, selected all Sarg default options and it works. Thanks for your effort anyway.

        1 Reply Last reply Reply Quote 0
        • K
          KeltecRFB
          last edited by

          Raising a Necro-Thread instead of creating a new one.

          Is there way to configure Sarg to show denied access reporting and what Proxy\Dans acl triggered it?  Can that be done in the GUI or is it in CLI only?

          Thanks!

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @KeltecRFB:

            Is there way to configure Sarg to show denied access reporting and what Proxy\Dans acl triggered it?  Can that be done in the GUI or is it in CLI only?

            Sarg only understands squid log format, so I think it sarg is not able to log what ACL denied a url.

            Do you have a sarg config that does it?

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • N
              novicenaja
              last edited by

              @marcelloc:

              Hi all,

              I've just published sarg package for pfsense with squid,squidguard and dansguardian log Analysis as well real time report tab.

              Squidguard functions are under devel yet but squid and dansguardians(as well as I tested) are working.

              After almost everything done, I found an old sarg package published on forum by joaohf and merged some function calls from this old thread.

              Another good point is that sarg is able to forward logs via email, so I'm planning to include it for nanobsd installs.

              have fun and feedback!  :)

              att,
              Marcello Coutinho

              ขอบคุณครับ (khob kun krub) Thank you verymuch

              1 Reply Last reply Reply Quote 0
              • P
                pszafer
                last edited by

                For over a week I've been trying to config SARG because sometimes it works and sometimes not.

                The problem is: "SARG: Cannot set the locale LC_ALL to the environment variable".

                Sometimes when I restart webconfigurator and in shell set LC_ALL: setenv LC_ALL "en_US" it works from webGUI,
                but more often it does not work at all.

                Could you give me some trail where I can look for my mistakes, please?

                Graphs should be generated from squid access log.
                I can generate it from shell without any problem but not by command
                "/usr/local/bin/php /usr/local/www/sarg.php 1"
                it gives above error.

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  what version of sarg and pfsense are you using?

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • T
                    Topper727
                    last edited by

                    Hello,

                    I have
                    2.1-BETA1 (amd64)
                    built on Wed Apr 10 18:48:44 EDT 2013
                    FreeBSD 8.3-RELEASE-p7

                    squidGuard Network Management 1.4_4 pkg v.1.9.2
                    Lightsquid Network Report         1.8.2 pkg v.2.32
                    Sarg         Network Report         2.3.2 pkg v.0.6.1
                    squid3 Network                3.1.20 pkg 2.0.6

                    I get for View Report
                    Error: Could not find report index file.
                    Check and save sarg settings and try to force sarg schedule.

                    In the system log
                    php: /pkg_edit.php: The command '/usr/pbi/sarg-amd64/bin/sarg ' returned exit code '1', the output was 'SARG: Cannot set the locale LC_ALL to the environment variable'

                    Realtime works

                    Dell 2950 g3 server
                    Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
                    Current: 2000 MHz, Max: 2667 MHz
                    8 CPUs: 2 package(s) x 4 core(s)
                    8152 MiB and 600meg 10k drive
                    Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

                    1 Reply Last reply Reply Quote 0
                    • P
                      pszafer
                      last edited by

                      I have also pfSense 2.1-BETA and the Sarg package 2.3.2 pkg v.0.6.1.

                      1 Reply Last reply Reply Quote 0
                      • B
                        baba
                        last edited by

                        Hello, sorry, i can't understand a thing…
                        Can I configure ldap settings in sarg to display username instead of IP if i use squid in trasnsparent mode without authentication?
                        Thanks

                        1 Reply Last reply Reply Quote 0
                        • technicalT
                          technical
                          last edited by

                          @pszafer:

                          For over a week I've been trying to config SARG because sometimes it works and sometimes not.

                          The problem is: "SARG: Cannot set the locale LC_ALL to the environment variable".

                          Sometimes when I restart webconfigurator and in shell set LC_ALL: setenv LC_ALL "en_US" it works from webGUI,
                          but more often it does not work at all.

                          Could you give me some trail where I can look for my mistakes, please?

                          Graphs should be generated from squid access log.
                          I can generate it from shell without any problem but not by command
                          "/usr/local/bin/php /usr/local/www/sarg.php 1"
                          it gives above error.

                          i have same problems in the pfsense 2.0.2 Release
                          sarg
                          squid3
                          squidguard

                          Necati Selim GÜNER
                          IT Technician

                          1 Reply Last reply Reply Quote 0
                          • T
                            tempest69
                            last edited by

                            Hello,
                            same error for me with pfsense 2.1 (last version disponible at this time), fresh squid and sarg install , i was getting the message

                            php: /pkg_edit.php: The command '/usr/pbi/sarg-amd64/bin/sarg ' returned exit code '1', the output was 'SARG: Cannot set the locale LC_ALL to the environment variable'
                            

                            until i change sarg config from

                            Date Format =European
                            to
                            Date Format=American (default)

                            well its not a real solution (but today it doesn't matter 05/05/2013 is the same in American and European !!!)

                            Edit :Message seems to have gone… but no, it is still here!!

                            1 Reply Last reply Reply Quote 0
                            • P
                              pszafer
                              last edited by

                              I did it too (changed date format), but it isn't stable solution, beacuse from 2 weeks Sarg with Date format = American is not working.

                              1 Reply Last reply Reply Quote 0
                              • E
                                estragon
                                last edited by

                                Hello,
                                i can't remove Sarg package …

                                i'm using : 2.1-BETA1 (i386) built on Sun May 19 05:11:18 EDT 2013 FreeBSD 8.3-RELEASE-p8

                                after an upgrade, i have an issue with sarg package (2.3.6 pkg v.0.6.1) :

                                Crash report begins.  Anonymous machine information:
                                i386
                                8.3-RELEASE-p8
                                FreeBSD 8.3-RELEASE-p8 #1: Sun May 19 05:40:04 EDT 2013     root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8
                                Crash report details:
                                PHP Errors:
                                [20-May-2013 10:44:41 Europe/Paris] PHP Fatal error:  Call to undefined function sync_package_sarg() in /etc/inc/pkg-utils.inc(474) : eval()'d code on line 1
                                [20-May-2013 10:44:45 Europe/Paris] PHP Fatal error:  Call to undefined function sync_package_sarg() in /etc/inc/pkg-utils.inc(474) : eval()'d code on line 1
                                Filename: /var/crash/minfree
                                2048

                                i have tray to re install the pack but no success
                                then i have tray to remove the pack. i receive that feed back :

                                Removing package…
                                Starting package deletion for sarg-2.3.6-i386...done.
                                Removing Sarg components...
                                Tabs items... done.
                                Menu items... done.
                                Loading package instructions...
                                Deinstall commands...

                                but the pack still be present !

                                thanks for the suggestions on better way to clear the systeme (may be just to wait for pkg update ?)

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  @estragon:

                                  but the pack still be present !

                                  Check if sarg.inc exists on /usr/local/pkg dir and remove it.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    estragon
                                    last edited by

                                    Hello,
                                    thanks very much for your help, and just as feed back :
                                    I go on Diagnostics -> Edit File to check, and the file ahas her (with 0kb)
                                    then I go  to  Diagnostics -> Command Prompt and execute : rm /usr/local/pkg/sarg.inc
                                    then I go to remove the package from the System -> Package

                                    … i have not all well understand, but that works …. thanks very much !

                                    salutations et merci pour votre super travail !
                                    gerard

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      wolivete
                                      last edited by

                                      @elemay:

                                      reinstalling only.

                                      [SOLVED] i also experience if i set up a schedule, and do a 'Force Update Now' i get no report, telling me:

                                      Error: Could not find report index file.
                                      Check sarg settings and try to force sarg schedule.
                                      

                                      in system logs i see:

                                      Apr 10 15:55:45	php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 174067, reading: 0.00%^MSARG: Maybe you have a broken date in your /var/log/dansguardian/access.log file SARG: getword_atoll loop detected after 2 bytes. SARG: Line="xx.xx.xx.xx http" SARG: Record="xx.xx.xx.xx http" SARG: searching for 'x2f''
                                      

                                      i deleted access.log and restarted dansguradian, everythings fine again. :)

                                      For this, I tried to select all in General->Reports Options.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        AudiAddict
                                        last edited by

                                        My sarg stopped working (not creating daily reports) after update to 2.1RC0

                                        Using squid. Schedule says

                                        Status Update Frequency Aditional Args Gzip Post Action Description
                                        on           24h none                                            24hr

                                        When opening reports view it doesn't show the latest (29th of may). Strange thing is it does show  creation date of today when I do full update? but the date stays the same?


                                        As you can see I changed schedule from 1h to 24h (I need daily reports not hourly)

                                        Any idea's how to resolve this? What are the correct settings for squid3 and sarg? Is there a howto or readme available? Action after schedule is set to none (default) but in screenshots in this topic I see it set to rotate log?

                                        Can anybody provide me with a screenshot of there schedule? I just want daily reports of proxy access.

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          Enable report overwrite to avoid multiples reports in the same day.

                                          It looks like you didn't enabled(or disabled) squid logs after may 26.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            nuphero
                                            last edited by

                                            I tried to install SARG some times but always got problem Segmentation fault (Core dumped)
                                            Here is log of sarg -x. Anyone experienced with this issue, please help. Thanks.

                                            [2.0.3-RELEASE][root@pfSense.localdomain]/usr/local(34): sarg -x
                                            SARG: Init
                                            SARG: Loading configuration from /usr/local/etc/sarg/sarg.conf
                                            SARG: Loading exclude host file from: /usr/local/etc/sarg/exclude_hosts.conf
                                            SARG: Loading exclude file from: /usr/local/etc/sarg/exclude_users.conf
                                            SARG: Reading host alias file "/usr/local/etc/sarg/hostalias"
                                            SARG: List of host names to alias:
                                            SARG: Deleting temporary directory "/tmp/sarg"
                                            SARG: Parameters:
                                            SARG:          Hostname or IP address (-a) =
                                            SARG:                    Useragent log (-b) =
                                            SARG:                    Exclude file (-c) = /usr/local/etc/sarg/exclude_hosts.                                                                            conf
                                            SARG:                  Date from-until (-d) =
                                            SARG:    Email address to send reports (-e) =
                                            SARG:                      Config file (-f) = /usr/local/etc/sarg/sarg.conf
                                            SARG:                      Date format (-g) = Europe (dd/mm/yyyy)
                                            SARG:                        IP report (-i) = No
                                            SARG:            Keep temporary files (-k) = No
                                            SARG:                        Input log (-l) = /var/squid/log/access.log
                                            SARG:              Resolve IP Address (-n) = No
                                            SARG:                      Output dir (-o) = /usr/local/sarg-reports/
                                            SARG: Use Ip Address instead of userid (-p) = Yes
                                            SARG:                    Accessed site (-s) =
                                            SARG:                            Time (-t) =
                                            SARG:                            User (-u) =
                                            SARG:                    Temporary dir (-w) = /tmp/sarg
                                            SARG:                  Debug messages (-x) = Yes
                                            SARG:                Process messages (-z) = No
                                            SARG:  Previous reports to keep (–lastlog) = 0
                                            SARG:
                                            SARG: sarg version: 2.3.6 Arp-21-2013
                                            SARG: Reading access log file: /var/squid/log/access.log
                                            SARG: Records in file: 874, reading: 100.00%
                                            SARG:    Records read: 874, written: 874, excluded: 0
                                            SARG: Squid log format
                                            SARG: Period: 30 May 2013
                                            SARG: File /usr/local/sarg-reports/30May2013-30May2013 already exists, moved to                                                                              /usr/local/sarg-reports/30May2013-30May2013.18
                                            SARG: Sorting log /tmp/sarg/10_48_14_29.user_unsort
                                            Segmentation fault (core dumped)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.