Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sarg package for pfsense

    Scheduled Pinned Locked Moved pfSense Packages
    467 Posts 99 Posters 507.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tux
      last edited by

      I've been digging sarg codes these past days. I tried hacking the template which overrides any changes on the sarg.conf file.  I hope we can point the directory of squid rather than have it fixed directory

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @tux:

        rather than have it fixed directory

        Do you mean /usr/local/sarg-reports ?

        Sarg package needs this to "jail" report access permissions on pfsense gui.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • T
          tux
          last edited by

          No, I mean the sarg.template file. Since whenever there is a change in the config(on the webconfig) it is overridden by the template.  So I changed the access log path.  Then I also tried creating a folder on a separate drive and symlinked to the default sarg-reports folder but it was a fail. Hope we can configure the path of the access log and same for where to store sarg reports.

          1 Reply Last reply Reply Quote 0
          • S
            spiritbreaker
            last edited by

            Hi marcelloc,

            i figured out that my sarg dont rotate access.log file. I got a 21GB logfile and wonder why my reports takes so long  ;D.

            Log: php: /pkg_edit.php: Sarg: force refresh now with -d date +%d/%m/%Y args, compress(on) and rotate action after sarg finish.

            But i saw only cache.log seams to be rotated.

            If i use the rotation settings on proxy server tab it works…..but then i have no sarg reports over long period ()eg. 30 days).

            Versions:

            PfSense 2.1.5 (i386)

            squid3 3.1.20 pkg 2.1.2
            squidguard 1.4_4 pkg v.1.9.6
            havp 0.91_1 pkg v1.05
            sarg 2.3.6_2 pkg v.0.6.3
            Lightsquid  1.8.2 pkg v.2.33

            thanks

            PS: maybe lightsquid prevent sarg from rotating...so i temporary disabled automatic reports in lightsquid.

            Pfsense running at 11 Locations
            -mobile OPENVPN and IPSEC
            -multiwan failover
            -filtering proxy(squidguard) in bridgemode with ntop monitoring

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              thanks for the feedback, I'll take a look on rotate call done by sarg.

              what pfsense version are you using?

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • S
                spiritbreaker
                last edited by

                hi,

                what pfsense version are you using?

                PfSense 2.1.5 (i386)

                Pfsense running at 11 Locations
                -mobile OPENVPN and IPSEC
                -multiwan failover
                -filtering proxy(squidguard) in bridgemode with ntop monitoring

                1 Reply Last reply Reply Quote 0
                • D
                  djpeach310
                  last edited by

                  Hi I am new to pfsense and i was able to figure out IP sec vpn but i can not get the reports to work nor can I get the realtime to show any dans names.
                  Can any one help me?
                  I am running the latest version of pfsense.

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    @djpeach310:

                    Hi I am new to pfsense and i was able to figure out IP sec vpn but i can not get the reports to work nor can I get the realtime to show any dans names.
                    Can any one help me?
                    I am running the latest version of pfsense.

                    Maybe you forgot to enable logging on squid settings.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • W
                      worldfirst
                      last edited by

                      Hi,

                      My goal with Sarg is to create Squid's daily reports. I have logging and logging rotation both enabled on Squid. My question is why Sarg doesn't show any reports for the previous day (with -d date -v-1d +%d/%m/%Y extra args) even though I definitely have yesterday's reports in /var/squid/logs. Is it because of Squid's own logging rotation feature? Do I need to turn it off? Or is it because of 60 minutes restriction on "Find Limit" option? I'm asking this because Sarg easily creates daily reports with -d date +%d/%m/%Y extra args.

                      I'm using pfSense 2.2-RELEASE (amd64) with Sarg package 2.3.9 pkg v.0.6.4. Enabled Sarg report options are: 1, 5-10, 13-16.

                      Thank you!

                      1 Reply Last reply Reply Quote 0
                      • N
                        Nachtfalke
                        last edited by

                        I had a look in the sarg.conf file when I was looking for somthing other and I found that the configuration there only points to the actual access.log file.

                        
                        access_log /var/log/squid/access.log
                        
                        

                        So I assume when squid rotates your logs then sarg cannot analyze the logs form access.log.1.
                        I did some research and found out that since some newer version of sarg (2.3?) - which is installed on pfsense - there is the possibility to set a "*" so sarg analyzes more logfiles.

                        
                        access_log /var/log/squid/access.log*
                        
                        

                        Source:
                        http://sourceforge.net/p/sarg/discussion/363374/thread/e2e10ffb/

                        1 Reply Last reply Reply Quote 0
                        • W
                          worldfirst
                          last edited by

                          Thanks for your reply!

                          I modified access_log string in sarg.conf and after that I got "file not found" error (Cannot get the modification time of input log file /var/squid/logs/access.log* (No such file or directory)). So the current version doesn't support this feature.

                          1 Reply Last reply Reply Quote 0
                          • T
                            tux
                            last edited by

                            @worldfirst You can not directly edit the sarg.conf since it will be changed backed to its original configuration using the template which is the sarg.template file

                            1 Reply Last reply Reply Quote 0
                            • W
                              worldfirst
                              last edited by

                              Yes, I noticed that.

                              1 Reply Last reply Reply Quote 0
                              • T
                                Taras_
                                last edited by

                                pfSense 2.2 (i386)
                                Squid 3 + Sarg

                                Can't get report, error message:

                                Error: Could not find report index file.
                                Check and save sarg settings and try to force sarg schedule.
                                

                                Interesting thing with 2 almost same commands in console:
                                1. Don't work. No report in destination directory after run, i.e. dir is empty.

                                sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /usr/local/sarg-reports/
                                

                                2. Works fine. Generates report in destination directory and after linking this dir to /usr/local/sarg-reports i can see reports via pfsense's GUI.

                                sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /sarg-reports/
                                

                                So, sarg works for 1st level directory but don't work for 3rd level subdir.

                                Any ideas how to solve problem?

                                1 Reply Last reply Reply Quote 0
                                • Z
                                  zoro_2009
                                  last edited by

                                  I confirm the problem !  :(

                                  1 Reply Last reply Reply Quote 0
                                  • KOMK
                                    KOM
                                    last edited by

                                    Try this from the shell:

                                    rm -r /usr/local/sarg-reports
                                    ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

                                    Use ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports if you have 64-bit build.

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      Taras_
                                      last edited by

                                      @KOM:

                                      Try this from the shell:

                                      rm -r /usr/local/sarg-reports
                                      ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

                                      Thanks! Fixes problem :)

                                      1 Reply Last reply Reply Quote 0
                                      • E
                                        erasmus
                                        last edited by

                                        My Hardware: APU1C4

                                        only this solved the Problem:

                                        in console

                                        rm -rf /usr/local/sarg-reports
                                        ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          Brutos
                                          last edited by

                                          Was having a similar issue glad i found this post fixed the issue for me thanks

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            ak
                                            last edited by

                                            I ran the above commands to delete the directory and create the symlink to /usr/pbi/sarg-amd64/local/sarg-reports. I can see sarg generated logs under here. However on the 'View Report' tab I still get

                                            
                                            Error: Could not find report index file.
                                            Check and save sarg settings and try to force sarg schedule.
                                            
                                            

                                            This is on a fresh pfSense install running 2.2-RELEASE with Sarg 2.3.9 pkg v.0.6.4, Squid3 4.3.10_2 pkg 0.2.6

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.