Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unofficial E2guardian package for pfSense

    Scheduled Pinned Locked Moved
    Cache/Proxy
    70
    1.2k
    1.2m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kenrutt @pfsensation
      last edited by

      @pfsensation Thanks for reply on the regex issue. That is a point I had not thought of, on regex using a lot of cpu power. However some sites will load fine and the regex will do fine. But whenever I go to google It will crash E2guardian immediately. I watched the cpu indicator at that point and it never even seemed to kickin much before crash. There must be something in expression that causes it. Here is a sample of what I was using.
      "<a(?:(?!.</a>).).?facebook.com.*?</a>"->"-"
      Don't know if you can see anything out of order or not.
      Thanks

      P 1 Reply Last reply Reply Quote 0
      • P
        pfsensation @kenrutt
        last edited by

        @kenrutt said in Unofficial E2guardian package for pfSense:

        @pfsensation Thanks for reply on the regex issue. That is a point I had not thought of, on regex using a lot of cpu power. However some sites will load fine and the regex will do fine. But whenever I go to google It will crash E2guardian immediately. I watched the cpu indicator at that point and it never even seemed to kickin much before crash. There must be something in expression that causes it. Here is a sample of what I was using.
        "<a(?:(?!.</a>).).?facebook.com.*?</a>"->"-"
        Don't know if you can see anything out of order or not.
        Thanks

        I haven't used regex myself in a while, but why not use the site list ACL to block Facebook instead? It's a much more efficient way of doing it.

        I'll have to test out regex further, just don't have much spare time at the moment. :/

        1 Reply Last reply Reply Quote 0
        • Sei PineS
          Sei Pine
          last edited by

          any guides on how to make lightsquid log e2guardian network activities?

          U 1 Reply Last reply Reply Quote 0
          • U
            ucribrahim @Sei Pine
            last edited by

            @sei-pine I have a blog post about Sarg to report E2guardian activities. Check the following link.

            https://lifeoverlinux.com/how-to-configure-sarg-to-use-with-e2guardian/

            For the Lightsquid, it's easy to setup. You can find how to by searching "e2guardian lightsquid" on the forum.

            ” Online pfSense Firewall & Router Eğitimi | www.udemy.com/pfsense-training “

            Sei PineS 1 Reply Last reply Reply Quote 0
            • Sei PineS
              Sei Pine @ucribrahim
              last edited by Sei Pine

              @ucribrahim i can't seem to get sargs to get report on e2guardian it shows this error
              0_1542164612328_8dee63bf-4888-4367-a35d-8157e2eec336-image.png

              i already tried to do the troubleshoot guide on the page you provided.

              edit:

              this seems to be the problem, any idea on how to fix it ?

              SARG: SARG version: 2.3.11 Jan-14-2018
              SARG: Reading access log file: /var/log/e2guardian/access.log
              SARG: Loop detected in getword_atoll after 2 bytes.
              SARG: Line="92.168.137.5 https"
              SARG: Record="92.168.137.5 https"
              SARG: searching for 'x2f'
              SARG: Invalid date in file "/var/log/e2guardian/access.log"

              B 1 Reply Last reply Reply Quote 0
              • B
                binkec @Sei Pine
                last edited by

                @sei-pine
                Hello
                Check log format in e2g "Report and log" configuration, it must be in "squid format"

                P Sei PineS 2 Replies Last reply Reply Quote 0
                • P
                  pfsensation @binkec
                  last edited by

                  @binkec said in Unofficial E2guardian package for pfSense:

                  @sei-pine
                  Hello
                  Check log format in e2g "Report and log" configuration, it must be in "squid format"

                  +1

                  This should fix the error.

                  1 Reply Last reply Reply Quote 0
                  • Sei PineS
                    Sei Pine @binkec
                    last edited by

                    @binkec its already on squid format. Well i did manage to log e2guardian using lightsquid earlier. Gonna monitor it for now.

                    P 1 Reply Last reply Reply Quote 0
                    • P
                      pfsensation @Sei Pine
                      last edited by

                      @sei-pine said in Unofficial E2guardian package for pfSense:

                      @binkec its already on squid format. Well i did manage to log e2guardian using lightsquid earlier. Gonna monitor it for now.

                      Manually clear your access.log visit some sites then try again. Sarg is complaining of an incorrect date and a loop.

                      Glad to hear you got lightsquid working though, it's simple and it gets the job done.

                      1 Reply Last reply Reply Quote 1
                      • J
                        jetberrocal @marcelloc
                        last edited by

                        @marcelloc are you still active with e2guardian? What is the status?

                        P 1 Reply Last reply Reply Quote 0
                        • R
                          ravegen
                          last edited by

                          @marcelloc, don't we have update fix for the content scanner ?

                          since the update they made for the rotate log fix, the content scanner is no longer working. it makes the pfsense gui hang and I need to restore previous config to make it work.

                          P 1 Reply Last reply Reply Quote 0
                          • P
                            pfsensation @jetberrocal
                            last edited by

                            @jetberrocal said in Unofficial E2guardian package for pfSense:

                            @marcelloc are you still active with e2guardian? What is the status?

                            He's just very busy with work however he is slowly updating it whenever possible, last update was pretty recent.

                            1 Reply Last reply Reply Quote 0
                            • P
                              pfsensation @ravegen
                              last edited by

                              @ravegen said in Unofficial E2guardian package for pfSense:

                              @marcelloc, don't we have update fix for the content scanner ?

                              since the update they made for the rotate log fix, the content scanner is no longer working. it makes the pfsense gui hang and I need to restore previous config to make it work.

                              Are you able to provide any further info? Are you seeing any errors on logs? What's the resource usage like? Are you able to SSH into your box?

                              Like I said earlier, content scanner is not a feature me or Marcelloc really use but let's try to find out why it crashes if possible.

                              R 1 Reply Last reply Reply Quote 0
                              • Sei PineS
                                Sei Pine
                                last edited by Sei Pine

                                Ok here's my feedback about using Lightsquid to get logs on e2guardian, after 2 days it just stop logging e2guardian. i dunno what happened lol

                                edit: seems like when i turn off the transparent proxy on squid proxy server, lightsquid doesn't work.

                                gonna monitor it again for a few days if it'll stop logging.

                                edit: good, its now running fine. earlier was kinda slow or something

                                0_1542691727081_78cfc061-63ce-4204-9531-8ceb57315c2a-image.png

                                1 Reply Last reply Reply Quote 0
                                • R
                                  ravegen @pfsensation
                                  last edited by ravegen

                                  @pfsensation, @marcelloc

                                  attached is the error log.

                                  0_1542682201493_1541384673350-error-resized.png

                                  I have provided that screenshot, months before.

                                  System resource usage is fine, load average 0.14, 0.10, 0.04, cpu & swap usage is 0%, memorage usage is 28%.

                                  I am able to ssh to my box.

                                  Like I said, the content scanner (clamdscan) was perfectly running before the rotate log fix was created and updated to the package.

                                  Respectfully, I think it does not matter if the content scanner is a feature for you or for Marcelloc but rather for the use of the community since it is a feature placed in the package. Such content scanner should have been already removed if it is that useless.

                                  What I am saying is the content scanner was broken since their was a fix on rotate log. Perhaps, the developers who modified the package can differential what changes they have done before and after the rotate log fix and made changes accordingly.

                                  P 1 Reply Last reply Reply Quote 0
                                  • P
                                    pfsensation @ravegen
                                    last edited by

                                    @ravegen said in Unofficial E2guardian package for pfSense:

                                    @pfsensation, @marcelloc

                                    attached is the error log.

                                    0_1542682201493_1541384673350-error-resized.png

                                    I have provided that screenshot, months before.

                                    System resource usage is fine, load average 0.14, 0.10, 0.04, cpu & swap usage is 0%, memorage usage is 28%.

                                    I am able to ssh to my box.

                                    Like I said, the content scanner (clamdscan) was perfectly running before the rotate log fix was created and updated to the package.

                                    Respectfully, I think it does not matter if the content scanner is a feature for you or for Marcelloc but rather for the use of the community since it is a feature placed in the package. Such content scanner should have been already removed if it is that useless.

                                    What I am saying is the content scanner was broken since their was a fix on rotate log. Perhaps, the developers who modified the package can differential what changes they have done before and after the rotate log fix and made changes accordingly.

                                    OK, those errors look config related. I'll have a chat with @marcelloc and then we'll see if we can send out another patch for it. Comparing the last build to your current, there doesn't seem to be any specific changes that would effect the content scanner.

                                    1 Reply Last reply Reply Quote 0
                                    • Sei PineS
                                      Sei Pine
                                      last edited by

                                      i switched to sarg to log e2guardian. lightsquid is totally not working after few hours.

                                      0_1542761130085_26ae12be-41bc-4f08-9cee-2aa089756247-image.png

                                      P 1 Reply Last reply Reply Quote 0
                                      • P
                                        pfsensation @Sei Pine
                                        last edited by

                                        @sei-pine said in Unofficial E2guardian package for pfSense:

                                        i switched to sarg to log e2guardian. lightsquid is totally not working after few hours.

                                        0_1542761130085_26ae12be-41bc-4f08-9cee-2aa089756247-image.png

                                        How long have you set E2 Guardian to keep logs for? And how often are you log rotating? I've not come across this issue so it maybe a config issue.

                                        Sei PineS 1 Reply Last reply Reply Quote 0
                                        • Sei PineS
                                          Sei Pine @pfsensation
                                          last edited by Sei Pine

                                          @pfsensation i leave all lightsquid settings as default (should be fine i guess) but when i try to configure squid and turn off its transparent proxy and mitm (this is interfering with e2guardian so...) lightsquid doesn't log anything.

                                          i dunno, maybe i need to make lightsquid listen to e2guardian ? anyways, i set my e2guardian to keep 20 log files.

                                          P 1 Reply Last reply Reply Quote 0
                                          • B
                                            binkec @pfsensation
                                            last edited by

                                            @pfsensation
                                            Hi, I was busy past two weeks and I tried to install 2.4.4 again and I can see real time traffic. E2g is working except "weighted phrases". I went trough working configuration(2.4.3) and non working(2.4.4) and I couldn't see any difference.
                                            The only difference is in log,
                                            2.4.4 I have this error:
                                            Nov 25 20:47:12 e2guardian 97044 I seem to be running already!
                                            Nov 25 20:54:23 e2guardian 75338 listen0_proxy: 1: Error 53 on accept: errorcount 0
                                            Nov 25 20:54:23 e2guardian 75338 listen0_proxy: 1: Error 53 on accept: errorcount 1
                                            Nov 25 20:57:44 e2guardian 75338 listen0_proxy: 1: Error 53 on accept: errorcount 0
                                            Nov 25 21:00:13 e2guardian 15579 I seem to be running already!
                                            Nov 25 21:04:37 e2guardian 20124 listen0_proxy: 1: Error 53 on accept: errorcount 0
                                            Nov 25 21:04:37 e2guardian 20124 listen0_proxy: 1: Error 53 on accept: errorcount 1
                                            Nov 25 21:04:37 e2guardian 20124 listen0_proxy: 1: Error 53 on accept: errorcount 2
                                            Nov 25 21:04:37 e2guardian 20124 listen0_proxy: 1: Error 53 on accept: errorcount 3
                                            Nov 25 21:04:37 e2guardian 20124 listen0_proxy: 1: Error 53 on accept: errorcount 0
                                            Nov 25 21:14:32 e2guardian 62358 I seem to be running already!
                                            Nov 25 21:17:16 e2guardian 3849 listen0_proxy: 1: Error 53 on accept: errorcount 0
                                            Nov 25 21:17:36 e2guardian 3849 listen0_proxy: 1: Error 53 on accept: errorcount 0

                                            In working 2.4.3 system there is no error.
                                            Regards

                                            P 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post