Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Сбор статистики без Squid (только ipcad + lightsquid)

    Scheduled Pinned Locked Moved Russian
    16 Posts 3 Posters 5.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kainpain
      last edited by

      @kainpain:

      В лог /var/squid/logs/access.log ipcad всё ещё не пишет.. :-\ при старте /usr/local/bin/ipcad -rds выдаёт:

      
Opening alc0... [LCap] [ERSH] [4096] [custom filter compile error] [Error: Can't initialize filter!] [NODEV, yet configured] Initialized as 1
Aggregate network 10.0.0.0/255.0.0.0 -> 255.255.255.255
Aggregate network 172.16.0.0/255.240.0.0 -> 255.255.255.255
Aggregate network 192.168.0.0/255.255.0.0 -> 255.255.255.255
Aggregate network 0.0.0.0/0.0.0.0 -> 255.255.255.255
Configured RSH Server listening at 127.0.0.1
Can't open dump file ipcad.dump
Daemonized.

      :(
      Что может быть не так, подскажите…

      нашел: в "/usr/local/etc/ipcad.conf",  В секции "INTERFACE OPTIONS" указал "alc0", а нужно было "lan, alc0" (как указанно в Status > Interfaces)

      1 Reply Last reply Reply Quote 0
      • K
        kainpain
        last edited by

        но в "/var/squid/logs/access.log", tolog.sh всё равно не пишет :-[
        при выполнении выдает:
        [code]
        IP accounting cleared

        Плиз, помогите :-\

        1 Reply Last reply Reply Quote 0
        • R
          rubic
          last edited by 

          interface alc0 filter "ip and dst net 192.168.0.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

          такая должна быть строка в "INTERFACE OPTIONS", при условии что 192.168.0.0/24 - ваша локальная сеть.

          1 Reply Last reply Reply Quote 0
          • K
            kainpain
            last edited by

            @rubic:

            interface alc0 filter "ip and dst net 192.168.0.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

            такая должна быть строка в "INTERFACE OPTIONS", при условии что 192.168.0.0/24 - ваша локальная сеть.

            Исправил, всё равно не записывает в access.log  :-[

            Вот, по порядку:
            1. [b]Версия pfSense  2.3.2-RELEASE (amd64)
            2. Установлены и настроены пакеты: Squid (вер. 0.4.22), Lightsquid (вер. 3.0.4), Cron и Shellcmd
            3. В каталог /usr/bin залит rsh (amd64, разрешения 0555)
            4. Установлен ipcad (http://pkg.freebsd.org/freebsd:10:x86:64/latest/All/ipcad-3.7.3_2.txz)
            5. Файл конфигурации ipcad:

            
##################
# GLOBAL OPTIONS #
##################

capture-ports enable;

#####################
# INTERFACE OPTIONS #
#####################

interface alc0 filter "ip and dst net 192.168.5.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

aggregate 192.168.5.0/24 strip 32; 	/* Don't aggregate internal range */
aggregate 10.0.0.0/8 strip 32; 	/* Don't aggregate internal range */
aggregate 172.16.0.0/12 strip 32;	/* Don't aggregate internal range */
aggregate 192.168.0.0/16 strip 32; /* Don't aggregate internal range */
aggregate 0.0.0.0/0 strip 32;	/* Don't aggregate external networks */

##########################
# NetFlow EXPORT OPTIONS #
##########################

netflow export version 5;	# NetFlow export format version {1|5}
netflow timeout active 30;	# Timeout when flow is active, in minutes
netflow timeout inactive 15;	# Flow inactivity timeout, in seconds
netflow engine-type 73;		# v5 engine_type; 73='I' for "IPCAD"
netflow engine-id 1;		# Useful to differentiate multiple ipcads.

netflow ifclass eth mapto 0-99;		# i.e., "eth1"->1, "eth3"->3
netflow ifclass fxp mapto 0-99;		# i.e., "fxp4"->4, "fxp0"->0
netflow ifclass ppp mapto 100-199;	# i.e., "ppp32"->532, "ppp7"->507
netflow ifclass gre mapto 200-299;
netflow ifclass tun mapto 300-399;	# i.e., "tun0"->300

######################
# RSH SERVER OPTIONS #
######################

rsh enable at 127.0.0.1;

rsh root@127.0.0.1 admin;	/* Can shutdown ipcad */
rsh root@127.0.0.1 backup;	/* Can dump/restore/import accounting table */
rsh root@127.0.0.1;		/* Can view and modify accounting tables */
rsh 127.0.0.1 view-only;	/* Other users can view current tables */

rsh ttl = 3;

rsh timeout = 30;

dumpfile = /var/ipcad/ipcad.dump;	# The file is inside chroot(), see below...

#################
# OTHER OPTIONS #
#################

chroot = /var/ipcad;

pidfile = ipcad.pid;

memory_limit = 10m;

            6. В каталоге "/root/" стоит tolog.sh (разр. 0755):

            
rez2=""
iptoname ()
{
rez2=$1
REZ=$(/usr/bin/dig -x $1 +short)
if [ -z $REZ]
then
{
}
else
{
rez2=$REZ
}
fi
}
net="192.168.5"
ttime=`/usr/bin/rsh localhost sh ip acco | /usr/bin/grep 'Accounting data saved' | /usr/bin/awk '{print ($4)}'`
/usr/bin/rsh localhost clear ip accounting
/usr/bin/rsh localhost show ip accounting checkpoint | /usr/bin/grep $net > /root/tolog.txt
while read p1 p2 p3 p4 p5 p6 p7 p8
do
if [ "$p5" != "0" ]
then
rez2=""
iptoname "$p1"
echo "$ttime.000" 1 $p2 "TCP_MISS/200" $p4 "CONNECT" $rez2:"$p5 "-" "DIRECT/"$p1" -"" >>/var/squid/logs/access.log
else
fi
done < /root/tolog.txt
exit 0

            7. В разделе Services —> Shellcmd стоит: /usr/local/bin/ipcad -rds (также команда выполнена единично в шелле)

            8. В разделе Services —> Cron указано поминутное выполнение команды /root/tolog.sh

            :( но в логах сквида ("/var/squid/logs/access.log") нет записей с пометкой "CONNECT"

            • В разделе Services —> Squid Proxy Server "Enable Squid Proxy" - галочкой выключен сквид.

            Подскажите, пожалуйста, в чём может быть причина, что записи не проходят в access.log?

            1 Reply Last reply Reply Quote 0
            • K
              kainpain
              last edited by

              Если, у кого есть время,  :( можете TeamViewer'ом посмотреть? icq: 2950279

              1 Reply Last reply Reply Quote 0
              • K
                kainpain
                last edited by

                :( плиз, хелп.

                1 Reply Last reply Reply Quote 0
                • K
                  kainpain
                  last edited by

                  :(
                  Еще немного данных…

                  1. При выполнении в шелл-консоли:  /usr/local/bin/ipcad -rds выдает следующее

                  
Opening alc0... [LCap] [ERSH] [4096] Initialized as 1
Aggregate network 10.0.0.0/255.0.0.0 -> 255.255.255.255
Aggregate network 172.16.0.0/255.240.0.0 -> 255.255.255.255
Aggregate network 192.168.0.0/255.255.0.0 -> 255.255.255.255
Aggregate network 0.0.0.0/0.0.0.0 -> 255.255.255.255
Configured RSH Server listening at 127.0.0.1
Can't open dump file ipcad.dump
Daemonized.

                  2. А при выполнении  /usr/bin/rsh -l root 127.0.0.1 stat это:

                  
Interface alc0: DOWN
Flow entries made: 0
Memory usage: 0% (0 from 10485760)
Free slots for rsh clients: 9
IPCAD uptime is 7 days  2:51
pfSense.localdomain uptime is 7 days  2:52
                  1 Reply Last reply Reply Quote 0
                  • K
                    kainpain
                    last edited by

                    Вот скрин "Status" —› "Services":

                    1 Reply Last reply Reply Quote 0
                    • R
                      rubic
                      last edited by

                      Возьмите tolog.sh из статьи, добейтесь чтобы заработал он, а потом уже занимайтесь творчеством.
                      pfSense перезагрузите, когда все сделаете по статье.

                      1 Reply Last reply Reply Quote 0
                      • K
                        kainpain
                        last edited by

                        @rubic:

                        Возьмите tolog.sh из статьи, добейтесь чтобы заработал он, а потом уже занимайтесь творчеством.
                        pfSense перезагрузите, когда все сделаете по статье.

                        :D :) Огромадное спасибо!!! Lightsquid начал показывать! Прошу, помогите теперь до конца настроить, чтобы выводил читабельный адрес вместо IP адресов.. обязуюсь написать руководство на двух языках (рус+англ)  :)

                        1. Каков должен быть "/usr/local/etc/ipcad.conf", для того, чтобы обрабатывал весь трафик (включая 80 порт, т.к. Squid отключен)? Сейчас выглядит так:

                        
capture-ports enable;

## buffers = 64k;

interface alc0 filter "ip and dst net 192.168.5.0/24 and not src net 10.0.0.0/8 and not 172.16.0.0/12 and not 192.168.0.0/16";

#
# aggregate <ip>/ <masklen>strip <maskbits>;
#
# Aggregate addresses from the specified network (<ip>/<masklen>),
# by AND'ing with specified mask (<maskbits>).
#
#

aggregate 10.0.0.0/8 strip 32; 	/* Don't aggregate internal range */
aggregate 172.16.0.0/12 strip 32;	/* Don't aggregate internal range */
aggregate 192.168.0.0/16 strip 32; /* Don't aggregate internal range */
aggregate 0.0.0.0/0 strip 32;	/* Don't aggregate external networks */

#
# aggregate <port_range_start>[-<port_range_end>] into <port>;
#
# Aggregate port numbers. Meaningful only if capture-ports is enabled.
#

#aggregate 1024-65535	into 65535;	/* Aggregate wildly */
#aggregate 3128-3128	into 3128;	/* Protect these ports */
#aggregate 150-1023	into 1023;	/* General low range */

# netflow export destination 127.0.0.1 9996;
netflow export version 5;	# NetFlow export format version {1|5}
netflow timeout active 30;	# Timeout when flow is active, in minutes
netflow timeout inactive 15;	# Flow inactivity timeout, in seconds
netflow engine-type 73;		# v5 engine_type; 73='I' for "IPCAD"
netflow engine-id 1;		# Useful to differentiate multiple ipcads.

netflow ifclass eth mapto 0-99;		# i.e., "eth1"->1, "eth3"->3
netflow ifclass fxp mapto 0-99;		# i.e., "fxp4"->4, "fxp0"->0
netflow ifclass ppp mapto 100-199;	# i.e., "ppp32"->532, "ppp7"->507
netflow ifclass gre mapto 200-299;
netflow ifclass tun mapto 300-399;	# i.e., "tun0"->300

rsh enable at 127.0.0.1;

rsh root@127.0.0.1 admin;	/* Can shutdown ipcad */
rsh root@127.0.0.1 backup;	/* Can dump/restore/import accounting table */
rsh root@127.0.0.1;		/* Can view and modify accounting tables */
rsh 127.0.0.1 view-only;	/* Other users can view current tables */

rsh ttl = 3;

rsh timeout = 30;

dumpfile = ipcad.dump;	# The file is inside chroot(), see below...

chroot = /var/ipcad;

pidfile = ipcad.pid;

memory_limit = 1m;</port></port_range_end></port_range_start></maskbits></masklen></ip></maskbits></masklen></ip>

                        2. Каким должен быть "/root/tolog.sh"?
                        Сейчас он таков:

                        
#!/bin/sh
rez2=""
#REZ="q"
iptoname ()
{
rez2=$1
REZ=$(/usr/bin/dig -x $1 +short)
#  echo "REZ - $REZ - $1"
if [ -z $REZ]
then
{ 
# echo
}
else
{ 
rez2=$REZ
}
fi
}

net="192.168.5"
ttime=`/usr/bin/rsh localhost sh ip acco | /usr/bin/grep 'Accounting data saved' | /usr/bin/awk '{print ($4)}'`
/usr/bin/rsh localhost clear ip accounting
/usr/bin/rsh localhost show ip accounting checkpoint | /usr/bin/grep $net > /root/tolog.txt

while read p1 p2 p3 p4 p5 p6 p7 p8
do
#
if [ "$p5" != "0" ] 
then
rez2=""
iptoname "$p1"
echo "$ttime.000" 1 $p2 "TCP_MISS/200" $p4 "CONNECT" $rez2:"$p5 "-" "DIRECT/"$p1" -"" >>/var/squid/logs/access.log
#   echo "$vtime.000" 1 $p2 "TCP_MISS/200" $p4 "CONNECT" $rez2:"$p5 "-" "DIRECT/"$p1" -"" >>/var/squid/logs/access.log
else
fi
done < /root/tolog.txt

exit 0
                        1 Reply Last reply Reply Quote 0
                        • X
                          xpaco
                          last edited by

                          :)
                          на русском: https://forum.pfsense.org/index.php?topic=117423.0
                          на английском: https://forum.pfsense.org/index.php?topic=117432

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.