Sarg - How to generate weekly/monthly reports

hallan_f

Hello to everyone!!

There's something annoying me for a long time ago…

I'm trying to config weekly and monthly reports on sarg, but it's not working at all, just

daily reports with the default arg...someone to show me the bright side of life again,

i'll be very grateful. Thanks for your time, gentlemen!

periko

I had this issue before, the gui have limits, exist a script that I had use and works, u just have to rotate the log, weekly, Montly, it accept parameters, read the script is very easy, this is the link;

https://build.opensuse.org/package/view_file?file=sarg-reports&package=sarg&project=openSUSE%3AFactory

Try this one, forget about the GUI, this will do what u need.

Will be great to have something like into pfsense sarg GUI.

See u latter!!!

marcelloc

You can use these args to create reports

TODAY
-d date +%d/%m/%Y
YESTERDAY
-d date -v-1d +%d/%m/%Y
WEEKAGO
-d date -v-1w +%d/%m/%Y- date -v-1d +%d/%m/%Y
MONTHAGO
-d date -v-1m +01/%m/%Y-date -v-1m +31/%m/%Y

Keep in mind that log rotate will "clean" previous logs.

I've included this info on sarg gui.

hallan_f

Thanks a lot, Guys!!

I'll try by webgui first and post the result.

Thanks for add this info on sarg package, marcelloc!!

:D

hallan_f

Weekly reports still not working :-[

I can't say about monthly yet…

Here are my conf's on schedule:

on 23h -d date +%d/%m/%Y-date +%d/%m/%Y none

on 7d -d date -v-1w +%d/%m/%Y- date -v-1d +%d/%m/%Y none

on 30d -d date -v-1m +01/%m/%Y-date -v-1m +31/%m/%Y rotate

marcelloc

@hallan_f:

Weekly reports still not working :-[
[/quote]

Did you disabled log rotating on squid too?

Nachtfalke

Hi,

I had problems with additional arguments yesterday on one pfsense, too.
I just added the arguments and then "Force Update Now". This did not create a log.

Then I added the arguments, first clicked "Save" and then after using "Force Update Now" it worked.
Tried with "TODAY" and with "MONTH" and all is ok.

What marcelloc mentions is absolutly important:
As far as I understand it, SARG only analyzes the access.log file which is active. The old - rotated ones - will not be analyzed.
So if you rotate daily or in shorter times then you cannot get a report back for longer than one day.

If the access.log of squid contains 100 days in the past and then you do reports with the custom arguments then your results can be 1 months, 1 week, yesterday or today.
But if your access log of squid only contains 3 days it is not possible to create a log of the last week/month.

And marcelloc mentioned this, too:
If squid log rotation is enabled on squid GUI then squid will roatete logs every mindnight - this will result in the fact that SARG can only analyze the actual day.

So best ist to enable logging on squid GUI (neccessary) and leave the field "log rotations" empty so squid will not rotate the access.log.

Then create a shedule on SARG which creates an report and rotates the log. It dempends on you how many days a log should contain.

I for myself have two SARG shedules:
One which runs evey hour (1h) with no rotation and then one shedule which runs every day (1d) and does the log rotation.

hallan_f

Sorry,

On Squid logging its enable and log rotate, 30d configured.

i'll keep the log rotate on squid empty, and daily reports disabled since my disk is almost full…

Thanks for the help!!!