Sarg package for pfsense

tux

I've been digging sarg codes these past days. I tried hacking the template which overrides any changes on the sarg.conf file. I hope we can point the directory of squid rather than have it fixed directory

marcelloc

@tux:

rather than have it fixed directory

Do you mean /usr/local/sarg-reports ?

Sarg package needs this to "jail" report access permissions on pfsense gui.

tux

No, I mean the sarg.template file. Since whenever there is a change in the config(on the webconfig) it is overridden by the template. So I changed the access log path. Then I also tried creating a folder on a separate drive and symlinked to the default sarg-reports folder but it was a fail. Hope we can configure the path of the access log and same for where to store sarg reports.

spiritbreaker

Hi marcelloc,

i figured out that my sarg dont rotate access.log file. I got a 21GB logfile and wonder why my reports takes so long ;D.

Log: php: /pkg_edit.php: Sarg: force refresh now with -d date +%d/%m/%Y args, compress(on) and rotate action after sarg finish.

But i saw only cache.log seams to be rotated.

If i use the rotation settings on proxy server tab it works…..but then i have no sarg reports over long period ()eg. 30 days).

Versions:

PfSense 2.1.5 (i386)

squid3 3.1.20 pkg 2.1.2
squidguard 1.4_4 pkg v.1.9.6
havp 0.91_1 pkg v1.05
sarg 2.3.6_2 pkg v.0.6.3
Lightsquid 1.8.2 pkg v.2.33

thanks

PS: maybe lightsquid prevent sarg from rotating...so i temporary disabled automatic reports in lightsquid.

marcelloc

thanks for the feedback, I'll take a look on rotate call done by sarg.

what pfsense version are you using?

spiritbreaker

hi,

what pfsense version are you using?

PfSense 2.1.5 (i386)

djpeach310

Hi I am new to pfsense and i was able to figure out IP sec vpn but i can not get the reports to work nor can I get the realtime to show any dans names.
Can any one help me?
I am running the latest version of pfsense.

marcelloc

@djpeach310:

Hi I am new to pfsense and i was able to figure out IP sec vpn but i can not get the reports to work nor can I get the realtime to show any dans names.
Can any one help me?
I am running the latest version of pfsense.

Maybe you forgot to enable logging on squid settings.

worldfirst

Hi,

My goal with Sarg is to create Squid's daily reports. I have logging and logging rotation both enabled on Squid. My question is why Sarg doesn't show any reports for the previous day (with -d date -v-1d +%d/%m/%Y extra args) even though I definitely have yesterday's reports in /var/squid/logs. Is it because of Squid's own logging rotation feature? Do I need to turn it off? Or is it because of 60 minutes restriction on "Find Limit" option? I'm asking this because Sarg easily creates daily reports with -d date +%d/%m/%Y extra args.

I'm using pfSense 2.2-RELEASE (amd64) with Sarg package 2.3.9 pkg v.0.6.4. Enabled Sarg report options are: 1, 5-10, 13-16.

Thank you!

Nachtfalke

I had a look in the sarg.conf file when I was looking for somthing other and I found that the configuration there only points to the actual access.log file.


access_log /var/log/squid/access.log

So I assume when squid rotates your logs then sarg cannot analyze the logs form access.log.1.
I did some research and found out that since some newer version of sarg (2.3?) - which is installed on pfsense - there is the possibility to set a "*" so sarg analyzes more logfiles.


access_log /var/log/squid/access.log*

Source:
http://sourceforge.net/p/sarg/discussion/363374/thread/e2e10ffb/

worldfirst

Thanks for your reply!

I modified access_log string in sarg.conf and after that I got "file not found" error (Cannot get the modification time of input log file /var/squid/logs/access.log* (No such file or directory)). So the current version doesn't support this feature.

tux

@worldfirst You can not directly edit the sarg.conf since it will be changed backed to its original configuration using the template which is the sarg.template file

worldfirst

Yes, I noticed that.

Taras_

pfSense 2.2 (i386)
Squid 3 + Sarg

Can't get report, error message:

Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

Interesting thing with 2 almost same commands in console:
1. Don't work. No report in destination directory after run, i.e. dir is empty.

sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /usr/local/sarg-reports/

2. Works fine. Generates report in destination directory and after linking this dir to /usr/local/sarg-reports i can see reports via pfsense's GUI.

sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /sarg-reports/

So, sarg works for 1st level directory but don't work for 3rd level subdir.

Any ideas how to solve problem?

zoro_2009

I confirm the problem ! :(

KOM

Try this from the shell:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

Use ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports if you have 64-bit build.

Taras_

@KOM:

Try this from the shell:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

Thanks! Fixes problem :)

erasmus

My Hardware: APU1C4

only this solved the Problem:

in console

rm -rf /usr/local/sarg-reports
ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports

Brutos

Was having a similar issue glad i found this post fixed the issue for me thanks

ak

I ran the above commands to delete the directory and create the symlink to /usr/pbi/sarg-amd64/local/sarg-reports. I can see sarg generated logs under here. However on the 'View Report' tab I still get


Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

This is on a fresh pfSense install running 2.2-RELEASE with Sarg 2.3.9 pkg v.0.6.4, Squid3 4.3.10_2 pkg 0.2.6