Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sarg package for pfsense

    Scheduled Pinned Locked Moved pfSense Packages
    467 Posts 99 Posters 510.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      @djpeach310:

      Hi I am new to pfsense and i was able to figure out IP sec vpn but i can not get the reports to work nor can I get the realtime to show any dans names.
      Can any one help me?
      I am running the latest version of pfsense.

      Maybe you forgot to enable logging on squid settings.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • W
        worldfirst
        last edited by

        Hi,

        My goal with Sarg is to create Squid's daily reports. I have logging and logging rotation both enabled on Squid. My question is why Sarg doesn't show any reports for the previous day (with -d date -v-1d +%d/%m/%Y extra args) even though I definitely have yesterday's reports in /var/squid/logs. Is it because of Squid's own logging rotation feature? Do I need to turn it off? Or is it because of 60 minutes restriction on "Find Limit" option? I'm asking this because Sarg easily creates daily reports with -d date +%d/%m/%Y extra args.

        I'm using pfSense 2.2-RELEASE (amd64) with Sarg package 2.3.9 pkg v.0.6.4. Enabled Sarg report options are: 1, 5-10, 13-16.

        Thank you!

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          I had a look in the sarg.conf file when I was looking for somthing other and I found that the configuration there only points to the actual access.log file.

          
          access_log /var/log/squid/access.log
          
          

          So I assume when squid rotates your logs then sarg cannot analyze the logs form access.log.1.
          I did some research and found out that since some newer version of sarg (2.3?) - which is installed on pfsense - there is the possibility to set a "*" so sarg analyzes more logfiles.

          
          access_log /var/log/squid/access.log*
          
          

          Source:
          http://sourceforge.net/p/sarg/discussion/363374/thread/e2e10ffb/

          1 Reply Last reply Reply Quote 0
          • W
            worldfirst
            last edited by

            Thanks for your reply!

            I modified access_log string in sarg.conf and after that I got "file not found" error (Cannot get the modification time of input log file /var/squid/logs/access.log* (No such file or directory)). So the current version doesn't support this feature.

            1 Reply Last reply Reply Quote 0
            • T
              tux
              last edited by

              @worldfirst You can not directly edit the sarg.conf since it will be changed backed to its original configuration using the template which is the sarg.template file

              1 Reply Last reply Reply Quote 0
              • W
                worldfirst
                last edited by

                Yes, I noticed that.

                1 Reply Last reply Reply Quote 0
                • T
                  Taras_
                  last edited by

                  pfSense 2.2 (i386)
                  Squid 3 + Sarg

                  Can't get report, error message:

                  Error: Could not find report index file.
                  Check and save sarg settings and try to force sarg schedule.
                  

                  Interesting thing with 2 almost same commands in console:
                  1. Don't work. No report in destination directory after run, i.e. dir is empty.

                  sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /usr/local/sarg-reports/
                  

                  2. Works fine. Generates report in destination directory and after linking this dir to /usr/local/sarg-reports i can see reports via pfsense's GUI.

                  sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /sarg-reports/
                  

                  So, sarg works for 1st level directory but don't work for 3rd level subdir.

                  Any ideas how to solve problem?

                  1 Reply Last reply Reply Quote 0
                  • Z
                    zoro_2009
                    last edited by

                    I confirm the problem !  :(

                    1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM
                      last edited by

                      Try this from the shell:

                      rm -r /usr/local/sarg-reports
                      ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

                      Use ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports if you have 64-bit build.

                      1 Reply Last reply Reply Quote 0
                      • T
                        Taras_
                        last edited by

                        @KOM:

                        Try this from the shell:

                        rm -r /usr/local/sarg-reports
                        ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

                        Thanks! Fixes problem :)

                        1 Reply Last reply Reply Quote 0
                        • E
                          erasmus
                          last edited by

                          My Hardware: APU1C4

                          only this solved the Problem:

                          in console

                          rm -rf /usr/local/sarg-reports
                          ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports

                          1 Reply Last reply Reply Quote 0
                          • B
                            Brutos
                            last edited by

                            Was having a similar issue glad i found this post fixed the issue for me thanks

                            1 Reply Last reply Reply Quote 0
                            • A
                              ak
                              last edited by

                              I ran the above commands to delete the directory and create the symlink to /usr/pbi/sarg-amd64/local/sarg-reports. I can see sarg generated logs under here. However on the 'View Report' tab I still get

                              
                              Error: Could not find report index file.
                              Check and save sarg settings and try to force sarg schedule.
                              
                              

                              This is on a fresh pfSense install running 2.2-RELEASE with Sarg 2.3.9 pkg v.0.6.4, Squid3 4.3.10_2 pkg 0.2.6

                              1 Reply Last reply Reply Quote 0
                              • KOMK
                                KOM
                                last edited by

                                Check your other options.  Sarg seems to be finicky and will not work right with the wrong combination of report options.  Do you have Generate main index.html and Generate the index tree by file set to Yes, for instance?

                                1 Reply Last reply Reply Quote 0
                                • A
                                  ak
                                  last edited by

                                  Thanks KOM - checked the two options you suggested about index.html and they were selected. I then selected all and thought to try that and reduce it to my original set.

                                  After selecting every option, I ran```
                                  sarg -x

                                  
                                  Thanks for the help.
                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    aityahiaidir
                                    last edited by

                                    for who have this error even after creating symlink /usr/local/sarg-reports to /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports or /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports depending on the version you have installed

                                    Error: Could not find report index file.
                                    Check and save sarg settings and try to force sarg schedule.
                                    
                                    

                                    you certainly chosen SquidGuard as proxy server in Sarg general report setting (with Squid it's work fine).

                                    after some debug,i noticed that Sarg is looking for SquidGuard config file  in the below location

                                    /usr/pbi/squidguard-i386/etc/squidguard/squidGuard.conf
                                    

                                    but the conf file is located in an other folder

                                     /usr/pbi/squidguard-i386/local/etc/squid/squidGuard.conf
                                    

                                    for this Srag break generating index report, even if you try to change the folder in the Sarg configuration file, it will always set to the wrong one after each saving Sarg configuration.

                                    i wil tryed to fixe that with symlink but it's dont work,

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      robatwork
                                      last edited by

                                      I too am having problems with sarg reports, but having looked at this thread I can't see an identical issue - realtime report is OK but normal reports aren't generated, in syslog I get

                                      php-fpm[68742]: /pkg_edit.php: The command 'export LC_ALL=C && /usr/pbi/sarg-amd64/bin/sarg -d `date +%d/%m/%Y' returned exit code '2', the output was ''

                                      In SSH I get

                                      export: Command not found.

                                      Sarg is 2.3.9 v0.6.4 and pfsense is 2.2.1 (amd64) ie. both the latest.

                                      Any ideas?

                                      thanks

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        robatwork
                                        last edited by

                                        Forget that. It was the wrong close quote mark ie should have been:
                                        date +%d/%m/%Y

                                        more dumb questions coming soon.

                                        Oh and add me to the "me too" people who had to do the link command ln -s to get this to work

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jabo53
                                          last edited by

                                          I can't seem to get the report feature to work.  Error:
                                          Error: Could not find report index file.
                                          Check and save sarg settings and try to force sarg schedule.
                                          have forced updates etc… but no help.  I know it can generate them in the cli by running sarg -x and then if I go into the tmp directory I can see them and read them, however the index file is not being created.
                                          I believe the conf file is correct but

                                          TAG: index yes|no|only

                                          #      Generate the main index.html.
                                          #      only - generate only the main index.html

                                          index yes

                                          TAG: index_tree date|file

                                          #      How to generate the index.

                                          index_tree file

                                          TAG:  output_dir

                                          #      The reports will be saved in that directory
                                          #      sarg -o dir

                                          output_dir /usr/local/sarg-reports

                                          any useful info would be appreciated
                                          System
                                          2.2.1-RELEASE (amd64)
                                          built on Fri Mar 13 08:16:49 CDT 2015
                                          FreeBSD 10.1-RELEASE-p6
                                          Squid3 -3.4.10_2 pkg 0.2.7
                                          Sarg 2.3.9 pkg v.0.6.4

                                          1 Reply Last reply Reply Quote 0
                                          • KOMK
                                            KOM
                                            last edited by

                                            Did you try the symlink fix shown abpve?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.