Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Сбор статистики без Squid (только ipcad + lightsquid)

    Scheduled Pinned Locked Moved Russian
    16 Posts 3 Posters 5.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kainpain
      last edited by

      В лог /var/squid/logs/access.log ipcad всё ещё не пишет.. :-\ при старте /usr/local/bin/ipcad -rds выдаёт:

      
Opening alc0... [LCap] [ERSH] [4096] [custom filter compile error] [Error: Can't initialize filter!] [NODEV, yet configured] Initialized as 1
Aggregate network 10.0.0.0/255.0.0.0 -> 255.255.255.255
Aggregate network 172.16.0.0/255.240.0.0 -> 255.255.255.255
Aggregate network 192.168.0.0/255.255.0.0 -> 255.255.255.255
Aggregate network 0.0.0.0/0.0.0.0 -> 255.255.255.255
Configured RSH Server listening at 127.0.0.1
Can't open dump file ipcad.dump
Daemonized.

      :(
      Что может быть не так, подскажите…

      1 Reply Last reply Reply Quote 0
      • K
        kainpain
        last edited by

        @kainpain:

        В лог /var/squid/logs/access.log ipcad всё ещё не пишет.. :-\ при старте /usr/local/bin/ipcad -rds выдаёт:

        
Opening alc0... [LCap] [ERSH] [4096] [custom filter compile error] [Error: Can't initialize filter!] [NODEV, yet configured] Initialized as 1
Aggregate network 10.0.0.0/255.0.0.0 -> 255.255.255.255
Aggregate network 172.16.0.0/255.240.0.0 -> 255.255.255.255
Aggregate network 192.168.0.0/255.255.0.0 -> 255.255.255.255
Aggregate network 0.0.0.0/0.0.0.0 -> 255.255.255.255
Configured RSH Server listening at 127.0.0.1
Can't open dump file ipcad.dump
Daemonized.

        :(
        Что может быть не так, подскажите…

        нашел: в "/usr/local/etc/ipcad.conf",  В секции "INTERFACE OPTIONS" указал "alc0", а нужно было "lan, alc0" (как указанно в Status > Interfaces)

        1 Reply Last reply Reply Quote 0
        • K
          kainpain
          last edited by

          но в "/var/squid/logs/access.log", tolog.sh всё равно не пишет :-[
          при выполнении выдает:
          [code]
          IP accounting cleared

          Плиз, помогите :-\

          1 Reply Last reply Reply Quote 0
          • R
            rubic
            last edited by 

            interface alc0 filter "ip and dst net 192.168.0.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

            такая должна быть строка в "INTERFACE OPTIONS", при условии что 192.168.0.0/24 - ваша локальная сеть.

            1 Reply Last reply Reply Quote 0
            • K
              kainpain
              last edited by

              @rubic:

              interface alc0 filter "ip and dst net 192.168.0.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

              такая должна быть строка в "INTERFACE OPTIONS", при условии что 192.168.0.0/24 - ваша локальная сеть.

              Исправил, всё равно не записывает в access.log  :-[

              Вот, по порядку:
              1. [b]Версия pfSense  2.3.2-RELEASE (amd64)
              2. Установлены и настроены пакеты: Squid (вер. 0.4.22), Lightsquid (вер. 3.0.4), Cron и Shellcmd
              3. В каталог /usr/bin залит rsh (amd64, разрешения 0555)
              4. Установлен ipcad (http://pkg.freebsd.org/freebsd:10:x86:64/latest/All/ipcad-3.7.3_2.txz)
              5. Файл конфигурации ipcad:

              
##################
# GLOBAL OPTIONS #
##################

capture-ports enable;

#####################
# INTERFACE OPTIONS #
#####################

interface alc0 filter "ip and dst net 192.168.5.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

aggregate 192.168.5.0/24 strip 32; 	/* Don't aggregate internal range */
aggregate 10.0.0.0/8 strip 32; 	/* Don't aggregate internal range */
aggregate 172.16.0.0/12 strip 32;	/* Don't aggregate internal range */
aggregate 192.168.0.0/16 strip 32; /* Don't aggregate internal range */
aggregate 0.0.0.0/0 strip 32;	/* Don't aggregate external networks */

##########################
# NetFlow EXPORT OPTIONS #
##########################

netflow export version 5;	# NetFlow export format version {1|5}
netflow timeout active 30;	# Timeout when flow is active, in minutes
netflow timeout inactive 15;	# Flow inactivity timeout, in seconds
netflow engine-type 73;		# v5 engine_type; 73='I' for "IPCAD"
netflow engine-id 1;		# Useful to differentiate multiple ipcads.

netflow ifclass eth mapto 0-99;		# i.e., "eth1"->1, "eth3"->3
netflow ifclass fxp mapto 0-99;		# i.e., "fxp4"->4, "fxp0"->0
netflow ifclass ppp mapto 100-199;	# i.e., "ppp32"->532, "ppp7"->507
netflow ifclass gre mapto 200-299;
netflow ifclass tun mapto 300-399;	# i.e., "tun0"->300

######################
# RSH SERVER OPTIONS #
######################

rsh enable at 127.0.0.1;

rsh root@127.0.0.1 admin;	/* Can shutdown ipcad */
rsh root@127.0.0.1 backup;	/* Can dump/restore/import accounting table */
rsh root@127.0.0.1;		/* Can view and modify accounting tables */
rsh 127.0.0.1 view-only;	/* Other users can view current tables */

rsh ttl = 3;

rsh timeout = 30;

dumpfile = /var/ipcad/ipcad.dump;	# The file is inside chroot(), see below...

#################
# OTHER OPTIONS #
#################

chroot = /var/ipcad;

pidfile = ipcad.pid;

memory_limit = 10m;

              6. В каталоге "/root/" стоит tolog.sh (разр. 0755):

              
rez2=""
iptoname ()
{
rez2=$1
REZ=$(/usr/bin/dig -x $1 +short)
if [ -z $REZ]
then
{
}
else
{
rez2=$REZ
}
fi
}
net="192.168.5"
ttime=`/usr/bin/rsh localhost sh ip acco | /usr/bin/grep 'Accounting data saved' | /usr/bin/awk '{print ($4)}'`
/usr/bin/rsh localhost clear ip accounting
/usr/bin/rsh localhost show ip accounting checkpoint | /usr/bin/grep $net > /root/tolog.txt
while read p1 p2 p3 p4 p5 p6 p7 p8
do
if [ "$p5" != "0" ]
then
rez2=""
iptoname "$p1"
echo "$ttime.000" 1 $p2 "TCP_MISS/200" $p4 "CONNECT" $rez2:"$p5 "-" "DIRECT/"$p1" -"" >>/var/squid/logs/access.log
else
fi
done < /root/tolog.txt
exit 0

              7. В разделе Services —> Shellcmd стоит: /usr/local/bin/ipcad -rds (также команда выполнена единично в шелле)

              8. В разделе Services —> Cron указано поминутное выполнение команды /root/tolog.sh

              :( но в логах сквида ("/var/squid/logs/access.log") нет записей с пометкой "CONNECT"

              • В разделе Services —> Squid Proxy Server "Enable Squid Proxy" - галочкой выключен сквид.

              Подскажите, пожалуйста, в чём может быть причина, что записи не проходят в access.log?

              1 Reply Last reply Reply Quote 0
              • K
                kainpain
                last edited by

                Если, у кого есть время,  :( можете TeamViewer'ом посмотреть? icq: 2950279

                1 Reply Last reply Reply Quote 0
                • K
                  kainpain
                  last edited by

                  :( плиз, хелп.

                  1 Reply Last reply Reply Quote 0
                  • K
                    kainpain
                    last edited by

                    :(
                    Еще немного данных…

                    1. При выполнении в шелл-консоли:  /usr/local/bin/ipcad -rds выдает следующее

                    
Opening alc0... [LCap] [ERSH] [4096] Initialized as 1
Aggregate network 10.0.0.0/255.0.0.0 -> 255.255.255.255
Aggregate network 172.16.0.0/255.240.0.0 -> 255.255.255.255
Aggregate network 192.168.0.0/255.255.0.0 -> 255.255.255.255
Aggregate network 0.0.0.0/0.0.0.0 -> 255.255.255.255
Configured RSH Server listening at 127.0.0.1
Can't open dump file ipcad.dump
Daemonized.

                    2. А при выполнении  /usr/bin/rsh -l root 127.0.0.1 stat это:

                    
Interface alc0: DOWN
Flow entries made: 0
Memory usage: 0% (0 from 10485760)
Free slots for rsh clients: 9
IPCAD uptime is 7 days  2:51
pfSense.localdomain uptime is 7 days  2:52
                    1 Reply Last reply Reply Quote 0
                    • K
                      kainpain
                      last edited by

                      Вот скрин "Status" —› "Services":

                      1 Reply Last reply Reply Quote 0
                      • R
                        rubic
                        last edited by

                        Возьмите tolog.sh из статьи, добейтесь чтобы заработал он, а потом уже занимайтесь творчеством.
                        pfSense перезагрузите, когда все сделаете по статье.

                        1 Reply Last reply Reply Quote 0
                        • K
                          kainpain
                          last edited by

                          @rubic:

                          Возьмите tolog.sh из статьи, добейтесь чтобы заработал он, а потом уже занимайтесь творчеством.
                          pfSense перезагрузите, когда все сделаете по статье.

                          :D :) Огромадное спасибо!!! Lightsquid начал показывать! Прошу, помогите теперь до конца настроить, чтобы выводил читабельный адрес вместо IP адресов.. обязуюсь написать руководство на двух языках (рус+англ)  :)

                          1. Каков должен быть "/usr/local/etc/ipcad.conf", для того, чтобы обрабатывал весь трафик (включая 80 порт, т.к. Squid отключен)? Сейчас выглядит так:

                          
capture-ports enable;

## buffers = 64k;

interface alc0 filter "ip and dst net 192.168.5.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

#
# aggregate <ip>/ <masklen>strip <maskbits>;
#
# Aggregate addresses from the specified network (<ip>/<masklen>),
# by AND'ing with specified mask (<maskbits>).
#
#

aggregate 10.0.0.0/8 strip 32; 	/* Don't aggregate internal range */
aggregate 172.16.0.0/12 strip 32;	/* Don't aggregate internal range */
aggregate 192.168.0.0/16 strip 32; /* Don't aggregate internal range */
aggregate 0.0.0.0/0 strip 32;	/* Don't aggregate external networks */

#
# aggregate <port_range_start>[-<port_range_end>] into <port>;
#
# Aggregate port numbers. Meaningful only if capture-ports is enabled.
#

#aggregate 1024-65535	into 65535;	/* Aggregate wildly */
#aggregate 3128-3128	into 3128;	/* Protect these ports */
#aggregate 150-1023	into 1023;	/* General low range */

# netflow export destination 127.0.0.1 9996;
netflow export version 5;	# NetFlow export format version {1|5}
netflow timeout active 30;	# Timeout when flow is active, in minutes
netflow timeout inactive 15;	# Flow inactivity timeout, in seconds
netflow engine-type 73;		# v5 engine_type; 73='I' for "IPCAD"
netflow engine-id 1;		# Useful to differentiate multiple ipcads.

netflow ifclass eth mapto 0-99;		# i.e., "eth1"->1, "eth3"->3
netflow ifclass fxp mapto 0-99;		# i.e., "fxp4"->4, "fxp0"->0
netflow ifclass ppp mapto 100-199;	# i.e., "ppp32"->532, "ppp7"->507
netflow ifclass gre mapto 200-299;
netflow ifclass tun mapto 300-399;	# i.e., "tun0"->300

rsh enable at 127.0.0.1;

rsh root@127.0.0.1 admin;	/* Can shutdown ipcad */
rsh root@127.0.0.1 backup;	/* Can dump/restore/import accounting table */
rsh root@127.0.0.1;		/* Can view and modify accounting tables */
rsh 127.0.0.1 view-only;	/* Other users can view current tables */

rsh ttl = 3;

rsh timeout = 30;

dumpfile = ipcad.dump;	# The file is inside chroot(), see below...

chroot = /var/ipcad;

pidfile = ipcad.pid;

memory_limit = 1m;</port></port_range_end></port_range_start></maskbits></masklen></ip></maskbits></masklen></ip>

                          2. Каким должен быть "/root/tolog.sh"?
                          Сейчас он таков:

                          
#!/bin/sh
rez2=""
#REZ="q"
iptoname ()
{
rez2=$1
REZ=$(/usr/bin/dig -x $1 +short)
#  echo "REZ - $REZ - $1"
if [ -z $REZ]
then
{ 
# echo
}
else
{ 
rez2=$REZ
}
fi
}

net="192.168.5"
ttime=`/usr/bin/rsh localhost sh ip acco | /usr/bin/grep 'Accounting data saved' | /usr/bin/awk '{print ($4)}'`
/usr/bin/rsh localhost clear ip accounting
/usr/bin/rsh localhost show ip accounting checkpoint | /usr/bin/grep $net > /root/tolog.txt

while read p1 p2 p3 p4 p5 p6 p7 p8
do
#
if [ "$p5" != "0" ] 
then
rez2=""
iptoname "$p1"
echo "$ttime.000" 1 $p2 "TCP_MISS/200" $p4 "CONNECT" $rez2:"$p5 "-" "DIRECT/"$p1" -"" >>/var/squid/logs/access.log
#   echo "$vtime.000" 1 $p2 "TCP_MISS/200" $p4 "CONNECT" $rez2:"$p5 "-" "DIRECT/"$p1" -"" >>/var/squid/logs/access.log
else
fi
done < /root/tolog.txt

exit 0
                          1 Reply Last reply Reply Quote 0
                          • X
                            xpaco
                            last edited by

                            :)
                            на русском: https://forum.pfsense.org/index.php?topic=117423.0
                            на английском: https://forum.pfsense.org/index.php?topic=117432

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.