Sarg package for pfsense
-
I'll try to reproduce this error.
Try to refresh the page with f5 and save again.
-
Hi marcelloc
looks like sarg can't handle large entries on file /var/squidGuard/log/block.log
I don't want erase the file /var/squidGuard/log/block.log, could u help me?
php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 27976, reading: 0.00%^MSARG: Records in file: 5000, reading: 17.87%^MSARG: Records in file: 10000, reading: 35.74%^MSARG: Records in file: 15000, reading: 53.62%^MSARG: Records in file: 20000, reading: 71.49%^MSARG: Records in file: 25000, reading: 89.36%^MSARG: Hour string too long in redirector log file /var/squidGuard/log/block.log SARG: Records in file: 27976, reading: 100.00%'
-
looks like sarg can't handle large entries on file /var/squidGuard/log/block.log
I don't want erase the file /var/squidGuard/log/block.log, could u help me?try to split this log or use sarg args to limit log search.
Hour string too long in redirector log file /var/squidGuard/log/block.log SARG: Records in file: 27976, reading: 100.00%'
I understand this error as some format error on log file/line not a too many records errors.
-
Thanks!
I've set the User_report_limit to 300 and rotate squidguard block log…
It's work for a while... than stopped sudenly again!
php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 86169, reading: 0.00%^MSARG: Records in file: 5000, reading: 5.80%^MSARG: Records in file: 10000, reading: 11.61%^MSARG: Records in file: 15000, reading: 17.41%^MSARG: Records in file: 20000, reading: 23.21%^MSARG: Records in file: 25000, reading: 29.01%^MSARG: Records in file: 30000, reading: 34.82%^MSARG: Records in file: 35000, reading: 40.62%^MSARG: Records in file: 40000, reading: 46.42%^MSARG: Records in file: 45000, reading: 52.22%^MSARG: Records in file: 50000, reading: 58.03%^MSARG: Records in file: 55000, reading: 63.83%^MSARG: Records in file: 60000, reading: 69.63%^MSARG: Records in file: 65000, reading: 75.43%^MSARG: Records in file: 70000, reading: 81.24%^MSARG: Records in file: 75000, reading: 87.04%^MSARG: Records in file: 80000, reading: 92.84%^MSARG: Records in file: 85000, reading: 98.64%^MSARG: Successful report generated on /usr/local/sarg-reports/29May2
- 11 days later
-
i did conf like you,http://forum.pfsense.org/index.php/topic,47765.165.html
its ok now ,thank you for great jobhello marcelloc,i got this error while testing sarg with squid and squidguard,and can't see reports on view report tab
Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.php: : The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 72216, reading: 0.00%^MSARG: Records in file: 5000, reading: 6.92%^MSARG: Records in file: 10000, reading: 13.85%^MSARG: Records in file: 15000, reading: 20.77%^MSARG: Records in file: 20000, reading: 27.69%^MSARG: Records in file: 25000, reading: 34.62%^MSARG: Records in file: 30000, reading: 41.54%^MSARG: Records in file: 35000, reading: 48.47%^MSARG: Records in file: 40000, reading: 55.39%^MSARG: Records in file: 45000, reading: 62.31%^MSARG: Records in file: 50000, reading: 69.24%^MSARG: Records in file: 55000, reading: 76.16%^MSARG: Records in file: 60000, reading: 83.08%^MSARG: Records in file: 65000, reading: 90.01%^MSARG: Records in file: 70000, reading: 96.93%^MSARG: Cannot delete /usr/local/sarg-reports/2012/06/12/debakim.html - No such file or directory SARG: Records in file: 72216, reading: 100.00%'
- about a month later
-
Is Sarg currently broken?
I am running Sarg on Squid2 logs, kept the default Report Options, selected all entries in Report to generate, and set up an hourly schedule.
After forcing the update, the View Report gives me:
Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.{$dir}/{$url} in sarg_frame-php contains /usr/local/sarg-reports/index.html, which does not exist, but report files have been generated under /usr/local/sarg-reports/2012/07/26 which mirrors today's date.
Any suggestions what to do?
-
Is Sarg currently broken?
No, I have 6 working with latest version
{$dir}/{$url} in sarg_frame-php contains /usr/local/sarg-reports/index.html, which does not exist, but report files have been generated under /usr/local/sarg-reports/2012/07/26 which mirrors today's date.
Any suggestions what to do?
Did you selected "Generate the main index.html" option on gui?
I've attached a screenshot with my current setup.
-
Did you selected "Generate the main index.html" option on gui?
No, I didn't. Now that I did it, it is working.
Thanx.
-
Can somebody explain if I need to set up log rotation in the schedule or not? And how this works?
I have it set to default ( do nothing) in SAR and have my squid settings set to 186 days log rotation (aprox 6 months).
Do I need to use the log rotation of SARG as wel? What does it do exactly? Clean up my old logs?
-
Do I need to use the log rotation of SARG as wel?
No, just one log rotate is fine.
What does it do exactly? Clean up my old logs?
Rotate logs and keep last 10 rotated files.(access.log.0 access.log.1 access.log.2…)
att,
Marcello Coutinho -
Thanks for your reply.
Does it mean that it reads through the whole file everytime? So If I have it set to rotate in squid settings every 6 months will this cause it to be slow at generating the report?
-
Thanks for your reply.
Does it mean that it reads through the whole file everytime? So If I have it set to rotate in squid settings every 6 months will this cause it to be slow at generating the report?
Yes, you can use date arg in schedules, but sarg will read all file the same way looking for logs on that date range.
-
If I change the rotation to 1 month in squid settings? Will it "save" my old logs in SARG? So I can view the internet logs older than one month?
So.. if I set squid to rotate every 30 days, does SARG delete the old data? Or does it display the old logs (from the last months) even though they have been rotated? (renamed?)
-
If I change the rotation to 1 month in squid settings? Will it "save" my old logs in SARG? So I can view the internet logs older than one month?
yes
So.. if I set squid to rotate every 30 days, does SARG delete the old data? Or does it display the old logs (from the last months) even though they have been rotated? (renamed?)
no
-
Maybe a language barrier here.. but do you mean yes I can still view the older internet proxy logs (older than 30 days) in SARG even though I set it to rotate every 30 days in Squid?
-
Maybe a language barrier here.. but do you mean yes I can still view the older internet proxy logs (older than 30 days) in SARG even though I set it to rotate every 30 days in Squid?
yes, you can. Sarg create html static reports on /usr/local/sarg-reports.
If you delete your squid logs, reports will be there.
if you run sarg after rotating logs, old reports will not be deleted. -
Hi.
I am struggling to get Sarg to work for me with Squid.
I initially created some reports, and they showed many users, everything seemed fine.
Now, if I click to create logs on the schedule (force), using a wide date range, I get just one user in the report? I know there is more activity than that!
I tried to delete sarg (and used file manager to delete sarg folders I could see), reinstalled (it seemed to still remember my settings), but now I just get:
Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.when I try to view reports (after trying to force them again). There are loads of log files in the squid log folder.
I set the schedule to 1d, rotate and restart, but it never seemed to create a report when I looked, only when I forced it?
What am I doing wrong?
Thanks :)
-
Check my config on previous thread page
http://forum.pfsense.org/index.php/topic,47765.msg277422.html#msg277422 -
Thanks.
My setup is similar to your screen shot, except I turn userid into IP address. I have changed the config and resaved, but it still will not work correctly.
I managed to get it to create a single report, but the report shows 0 users and has nothing in it.
I then left it a few days and tried to create a new report in the same way but nothing appears on the report page?
Is it possible to remove the package completely and re-install? When I tried that, when reinstalling, it knew all my settings from the last time, so obviously did not fully uninstall? What files would I need to delete to have a completely clean re-install?
When you select "restart proxy" on the schedule, does this clear the squid logs?
Should the schedule run every day if I enter 1d? When during the day would it?
Really struggling to get this going!
Cheers.
-
Is it possible to remove the package completely and re-install? When I tried that, when reinstalling, it knew all my settings from the last time, so obviously did not fully uninstall? What files would I need to delete to have a completely clean re-install?
There is no file to delete, all sarg settings stays on pfsense xml file.
When you select "restart proxy" on the schedule, does this clear the squid logs?
No, just a restart.
Should the schedule run every day if I enter 1d? When during the day would it?
It runs at 00:00 via cron job. You can install cron package to see it.
-
-
Hi,
My Sarg settings also same. Schedule is 1d, but was not working. Then installed the Cron package and edited the cron job,
59 23 * * * root /usr/local/bin/php /usr/local/www/sarg.php 0
Now, I am getting the report.
-
maybe because you selected to rotate logs on squid too. This way sarg has a small log to read.
-
Thanks - I will give that a go and see how it works tomorrow :)
-
Altering the CRON job seems to have sorted it, thanks.
-
marcelloc,
I have kept Squid log rotate for 5 days and sarg schedule Post action is none.
Now SARG reports are generated every day after editing the schedule in the cron (59 23 …).
Thanks for the package.
-
Now SARG reports are generated every day after editing the schedule in the cron (59 23 …).
It makes sense. You've included the -d arg on your schedule, so if it runs at 00:00, it will get no log from current day.
The change to 23:59 is a good workaround for that.att,
Marcello Coutinho -
Confusing me a tat ;D
How should I set this up to create a log each day? I have open WiFi which turns on at 8am and off at midnight, so although the log being created at 11:59pm is fine, 12:01 would be better :P
Can't quite work it around in my head?
If I don't have -d on the sarg args line, how do I specify the previous day in the schedule?
ALSO
Is it possible to delete some of the reports before they rotate? I have my rotate set as 90 days, the first 6 or so reports are pointless and I would like to delete them if possible?
Thanks!
-
I'll change the schedule on the package to run at minute 59.
use the same day arg that is available on package schedule description.I did not included a remove previous logs on current package version, but maybe on a future release.
Try to clean it using a shell script on cron.
att,
Marcello Coutinho - 29 days later
-
Hi,
I am having problems with sarg package. I am running pfsense 2.1-BETA0 (i386) built on Tue Aug 28 14:42:47 EDT 2012 FreeBSD 8.3-RELEASE-p4 with squid 3 with dansguardian and freeradius 2.
Everything works except sarg. I have configured sarg as suggested on this forum ie, i have selected default options mentioned in brackets including index and tree file.At console if i run sarg -x -z it shows errors with input log file location and output directory locations as in /usr/pbi/sarg-i386/etc/sarg/sarg.conf
I found that from web gui, the config file is at /usr/local/etc/sarg/sarg.conf. I created a symlink from /usr/pbi/sarg-i386/etc/sarg to point to /usr/local/etc/sarg/sarg.conf
After this I ran sarg -x -z from pfsense box and reports created at /usr/local/sarg-reports which can be seen
from gui and cron job creates report based on schedule, but "force update now" doesn't create any report and
realtime also does'nt show any report. Sorry if this is answered already, but I couldn't find anywhere.Kindly help,
Thanks
Arun -
I did had not time yet to make sarg running without manual symlinks on 2.1.
It will work fine on next package release.
-
Hi Marcello, I could not get it to work as I installed other packages from the gui. My procedure may be wrong.
Need your help. I am new to pfsense/freebsd & linux. I could not understand your reply. -
@aru:
I am new to pfsense/freebsd & linux. I could not understand your reply.
This package need some fixes do work with 2.1. I'll do it when I have time.
If you do not need ipv6, sarg package works fine on pfsense 2.0.1
-
Thanks for your quick reply Marcello.
-
-
Sarg pkg v 0.6 is out with gzip compress report options to reduce 4 times reports disk usage.
Awesome.
Thanks marcelloc!
-
version 0.6.1 is out with
-
pfsense 2.1 support
-
max report age option
backup you data and test it on labs before using report max age option on production. I'm not responsible for data lost.
-
-
I recently updated to Sarg 2.3.2 pkg v.0.6.1. Since then my reports have stopped refreshing. When attempt to force an update now, the system log reports the following error:
php: /pkg_edit.php: The command '/usr/local/bin/sarg -d
date +%d/%m/%Y
-date +%d/%m/%Y
' returned exit code '1', the output was 'SARG: (util) Cannot open file /etc/sarg/exclude_codes (exclude_codes)' -
Reinstall the package, save sarg config on gui and try again.
-
Reinstall the package, save sarg config on gui and try again.
unfortunately that didn't correct the issue. tried 2X. however, I did go into my schedule and for this task:
Rotate Logs and Restart Daemon
-ddate +%d/%m/%Y
-date +%d/%m/%Y
I checked the 'Enable Compression'
Setting: Default gzip compression (recommended)Then SAVED and FORCEd UPDATE NOW. It then appeared to refresh my VIEW REPORT data. Though it left a gap between 9/18 and 9/20 (no entry listed for 9/19). I will monitor to see whether 9/21 data appears automatically tomorrow without any manual intervention.