Sarg package for pfsense
-
Somebody posted these day a workaround for this, try to search on forum for dns rebind ad.
-
Somebody posted these day a workaround for this, try to search on forum for dns rebind ad.
No more ask again because I have 2 or 3 times posted.
Thank u very much Marcelloc
Donny
-
Hi marcelloc,
Great package. But how to manually delete the sarg reports?
My pfsense got problem with full hard disk error and the largest directory is from the sarg reports.
I forgot to use the rotate logs before.And what does Cache-in and Cache-out mean?
Thanks in advance.
-
Hi marcelloc,
Great package. But how to manually delete the sarg reports?
My pfsense got problem with full hard disk error and the largest directory is from the sarg reports.
I forgot to use the rotate logs before.Just delete reports on /usr/local/www/sarg-reports using rm on console/ssh.
-
Hi all,
Just published version 0.4.2 with fixes on squidguard log rotate and a faster boot startup process.
att,
Marcello Coutinho -
here it doesn't show realtime logs since latest upgrade.
anyone else with this problem?
-
Cannot generate anything at all.
Package has been removed, re-installed, directory deleted (under www), recreated, given write rights and still :
sarg -x
SARG: Init
SARG: Loading configuration from /usr/local/etc/sarg/sarg.conf
SARG: Loading exclude host file from: /usr/local/etc/sarg/exclude_hosts.conf
SARG: Loading exclude file from: /usr/local/etc/sarg/exclude_users.conf
SARG: Reading host alias file "/usr/local/etc/sarg/hostalias"
SARG: List of host names to alias:
SARG: Parameters:
SARG: Hostname or IP address (-a) =
SARG: Useragent log (-b) =
SARG: Exclude file (-c) = /usr/local/etc/sarg/exclude_hosts.conf
SARG: Date from-until (-d) =
SARG: Email address to send reports (-e) =
SARG: Config file (-f) = /usr/local/etc/sarg/sarg.conf
SARG: Date format (-g) = Europe (dd/mm/yyyy)
SARG: IP report (-i) = No
SARG: Input log (-l) = /var/squid/logs/access.log
SARG: Resolve IP Address (-n) = No
SARG: Output dir (-o) = /usr/local/www/sarg-reports/
SARG: Use Ip Address instead of userid (-p) = No
SARG: Accessed site (-s) =
SARG: Time (-t) =
SARG: User (-u) =
SARG: Temporary dir (-w) = /tmp/sarg
SARG: Debug messages (-x) = Yes
SARG: Process messages (-z) = No
SARG: Previous reports to keep (–lastlog) = 0
SARG:
SARG: sarg version: 2.3.2 Nov-23-2011
SARG: Reading access log file: /var/squid/logs/access.log
SARG: Records in file: 344851, reading: 100.00%
SARG: Records read: 344851, written: 344691, excluded: 0
SARG: Squid log format
SARG: Period: 06 Apr 2012-07 May 2012
SARG: pre-sorting files
SARG: File /usr/local/www/sarg-reports/2012/04-05/06-07 already exists, moved to /usr/local/www/sarg-reports/2012/04-05/06-07.2
SARG: cannot open /usr/local/www/sarg-reports/2012/04-05/06-07/sarg-date for writing
SARG:: No such file or directorysarg
SARG: Records in file: 344851, reading: 100.00%
SARG: Cannot delete /usr/local/www/sarg-reports/2012/04-05/06-07/d192_168_20_4.html - No such file or directory -
SARG: cannot open /usr/local/www/sarg-reports/2012/04-05/06-07/sarg-date for writing
SARG:: No such file or directory
SARG: Records in file: 344851, reading: 100.00%
SARG: Cannot delete /usr/local/www/sarg-reports/2012/04-05/06-07/d192_168_20_4.html - No such file or directoryYou have permission problems on your install, clean up(not remove) /usr/local/www/sarg-reports and try to run again.
-
SARG: cannot open /usr/local/www/sarg-reports/2012/04-05/06-07/sarg-date for writing
SARG:: No such file or directory
SARG: Records in file: 344851, reading: 100.00%
SARG: Cannot delete /usr/local/www/sarg-reports/2012/04-05/06-07/d192_168_20_4.html - No such file or directoryYou have permission problems on your install, clean up(not remove) /usr/local/www/sarg-reports and try to run again.
Hi Marcelloc
What do you mean by clean ? rm -rf ?
-
What do you mean by clean ? rm -rf ?
could be a rm -rf /usr/local/www/sarg-reports/*
Please be carefull with rm.
-
What do you mean by clean ? rm -rf ?
could be a rm -rf /usr/local/www/sarg-reports/*
Please be carefull with rm.
Of course I'm :)
Here are results, negative I'm afraid
rm -rf /usr/local/www/sarg-reports/*
[2.0.1-RELEASE][root@xxx]/root(5): ls /usr/local/www/sarg-reports
[2.0.1-RELEASE][root@xxx]/root(6): sarg
SARG: Records in file: 344852, reading: 100.00%
SARG: Cannot delete /usr/local/www/sarg-reports/2012/04-05/06-07/d192_168_20_4.html - No such file or directory
[2.0.1-RELEASE][root@xxx]/root(7): -
Check options you selected on sarg gui and try again.
-
Hi there,
I think I found two minor bugs with the sarg configuration:
When configuring exclude strings, the resulting configuration entry looks like this:
exclude_string"testasd' # note the missing space and the wrong quote character at the end
Also, when setting exclude_codes, these are written to the correct configuration file (exclude_codes.conf), but in sarg.conf "exclude_code" (without the .conf", probably the default) is referenced.
Another side note / question:
I'm combining squid and squidGuard. This works quite good so far. My squidGuard config defines several ACLs. After generating some sample reports I noticed that blocked URLs are not marked as blocked in the Squid log file. At least not in the same way when "Plain Squid" would be blocking them. This throws Sarg off, and blocked URLs are included in the list of visited websites without a special marker that these were blocked / redirected.
Is there any way around that? I tried to remove these entries with exclude_strings or exclude_codes (to remove all 403 redirects) - which did not work because of the mentioned bugs. But aside from these options, is there any other way?
Thanks for the good work on the package btw!
Manuel
-
der.tale,
Thanks for your feedback. I've pushed version 0.4.2_1 with these fixes.
check if you can use exclude codes and exclude_string now.
att,
Marcello Coutinho -
Check options you selected on sarg gui and try again.
I have tried to enable and disable options in GUI, tried as well schedule forced.
Unfortunately still no go.Error is the same. -
miodzicho,
Try sarg with the same options I use.
att,
Marcello Coutinho
-
miodzicho,
Try sarg with the same options I use.
att,
Marcello CoutinhoMarcello, you are star :) It works as it should. Many thanks !
-
marcelloc,
thanks for the quick fix, it works now as expected!
der.tale
-
i can't find the sarg menu in the gui. i can't find it under Status after an upgrade to 2.3.2 pkg v.0.4.2_1
-
try to reinstall
-
already did but the same. reinstall and reboot give the same result. no menu. ???
-
The menu is there, I have no idea what is happening with your system.
did you tried to uninstall and then install?
if you want, the url /pkg_edit.php?xml=sarg.xml
-
the first thing I did is an upgrade.
When it failed, i tried to do a reinstall - no web menu
Then I did another upgrade - no web menu
Reboot - no webmenu
Uninstall and reinstall - no webmenu
Reboot - no webmenuI will try to reinstall with no LAN clients connected.
Edit…
After nth time of reinstallation, the menu just popped out. what a relief.
-
Hello all,
Has anyone successes with Sarg report full username from LDAP server of windows 2008?
Thank u
-
Since last update, there is no more squidguard redirector!
The configs remains the same… What happen? -
Great Job for this Package!
-
Hello all,
Has anyone successes with Sarg report full username from LDAP server of windows 2008?
Thank u
Hello marcelloc and all
So quiet here, any news over SARG
-
-
To get this right, LDAP is not working correctly in sarg pfsense package to report usernames in AD on a Windows 2008 Domain? I have been trying to get this to work and have failed. Is everyone having the same issues?
-
questions
I am Brazilian and I can not speak English so I'm translating it in google translator. I hope you understand and help me.
How do I set up the flap schedule? Can anyone give me an example?
My difficulty is the option Sarg ARGS
can anyone give me an example with a correct date, please?
Which option to use in Action after sarg?
After configuring the View Report tab work? For my gives error saying I need to set the flap schedule -
questions
I am Brazilian and I can not speak English so I'm translating it in google translator. I hope you understand and help me.
How do I set up the flap schedule? Can anyone give me an example?
My difficulty is the option Sarg ARGS
can anyone give me an example with a correct date, please?
Which option to use in Action after sarg?
After configuring the View Report tab work? For my gives error saying I need to set the flap schedulekleyverson,
post without google on portuguese forum :)
Lá já tem um tópico para o sarg.
att,
Marcello Coutinho -
Hi Marcello,
I logged into the pfsence box last week (the 15th) before heading out on vacation (how bad is that? not in the best practices guide anyway…) and noticed there was an update for SARG. I applied it.
I logged in again today to generate a SARG report on a site. I noticed SARG hasn't worked since the upgrade. Seems 'topuser_sort_field' is causing it some grief, (wondering if that was the modification you did when I suggested it as a feature add upon your release of the package...)..
has anyone else had this issue and/or is there anything you would like to see? I'll hold off on a re-install or touching anything till i hear back from you.
take care,
gregMay 15 10:46:52 gw-master php: /pkg_mgr_install.php: Beginning package installation for Sarg.
May 15 10:46:55 gw-master php: /pkg_mgr_install.php: [sarg] sarg_xmlrpc_sync.php is starting.
May 15 10:46:55 gw-master php: /pkg_mgr_install.php: [sarg] sarg_xmlrpc_sync.php is starting.
May 15 11:00:01 gw-master php: : Sarg: force refresh now with '' args and both action after sarg finish.
May 15 11:00:01 gw-master php: : The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Unknown sort criterion "NORMAL" for parameter "topuser_sort_field"'
May 15 11:00:01 gw-master php: : executing squid log rotate after sarg.
May 15 12:00:01 gw-master php: : Sarg: force refresh now with '' args and both action after sarg finish.
May 15 12:00:01 gw-master php: : The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Unknown sort criterion "NORMAL" for parameter "topuser_sort_field"'
May 15 12:00:01 gw-master php: : executing squid log rotate after sarg.May 22 16:23:44 gw-master php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Unknown sort criterion "NORMAL" for parameter "topuser_sort_field"'
May 22 16:23:44 gw-master php: /pkg_edit.php: executing squid log rotate after sarg.
w with '' args and action after sarg finish.
Apr 24 21:00:00 gw-master php: : Sarg: force refresh now with '' args and action after sarg finish.
Apr 24 22:00:01 gw-master php: : Sarg: force refresh now with '' args and action after sarg finish.
Apr 24 23:00:00 gw-master php: : Sarg: force refresh now with '' args and action after sarg finish. -
-
Did you tried to change user sort field on sarg gui?
-
Did you tried to change user sort field on sarg gui?
yes, doing that seemed to fix it.
thanks,
greg -
after last update…
squid logs are in /var/squid/logs/access.log' not "/var/log/squid/access.log""
how to fix???system logs:
php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: File not found: /var/log/squid/access.log' -
after last update... squid logs are in /var/squid/logs/access.log' not "/var/log/squid/access.log"" how to fix??? system logs: php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: File not found: /var/log/squid/access.log'
me too the same error at system logs. The squid proxy also got error the line 1378 or 1387 (I am not sure which file name "Squid.conf" or "Squid.inf") after I made config at "General tab", when I click the save button.
SARG also no real time report at all. -
Donny, did you tried to save config after package update?
the code has the correct folder but maybe the default config file of sarg 2.3.2 has /var/log/squid/access.log
$sarg_proxy=array( 'squid_rc'=>'/usr/local/etc/rc.d/squid.sh', 'squid_config'=>'/var/squid/logs/access.log', 'squidguard_config'=>'/usr/local/etc/squidGuard/squidGuard.conf', 'squidguard_block_log'=>'/var/squidGuard/log/block.log', 'dansguardian_config'=>'/usr/local/etc/dansguardian/dansguardian.conf', 'dansguardian_log'=>'/var/log/dansguardian/access.log');
-
Donny, did you tried to save config after package update? the code has the correct folder but maybe the default config file of sarg 2.3.2 has /var/log/squid/access.log
Hallo Marcelloc
First, I have clean install Squid3 and configured, then I click save and I got squid proxy error fatal the line 1378 or 1387 (I am not sure which number) on Chrome web browser and I also not sure which file name "Squid.conf" or "Squid_reverse.inf")
Second, I have clean install SARG last version and configured in General tab, User tab and Schedule tab, then save. When I click update button at Real time report, no real time report appear at all.
I also try to reboot pfsense many time after config Squid3 and SARG but the Real time report still not appear.
Anyway I will try to clean install pfSense and Squid3 and SARG again later.Thank you
Donny -
Anyway I will try to clean install pfSense and Squid3 and SARG again later.
Try sarg just after you get squid up and running.
I'll check this squid3 first run error as soon as possible.
att,
Marcello Coutinho