Sarg package for pfsense

Nachtfalke

I had a look in the sarg.conf file when I was looking for somthing other and I found that the configuration there only points to the actual access.log file.


access_log /var/log/squid/access.log

So I assume when squid rotates your logs then sarg cannot analyze the logs form access.log.1.
I did some research and found out that since some newer version of sarg (2.3?) - which is installed on pfsense - there is the possibility to set a "*" so sarg analyzes more logfiles.


access_log /var/log/squid/access.log*

Source:
http://sourceforge.net/p/sarg/discussion/363374/thread/e2e10ffb/

worldfirst

Thanks for your reply!

I modified access_log string in sarg.conf and after that I got "file not found" error (Cannot get the modification time of input log file /var/squid/logs/access.log* (No such file or directory)). So the current version doesn't support this feature.

tux

@worldfirst You can not directly edit the sarg.conf since it will be changed backed to its original configuration using the template which is the sarg.template file

worldfirst

Yes, I noticed that.

Taras_

pfSense 2.2 (i386)
Squid 3 + Sarg

Can't get report, error message:

Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

Interesting thing with 2 almost same commands in console:
1. Don't work. No report in destination directory after run, i.e. dir is empty.

sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /usr/local/sarg-reports/

2. Works fine. Generates report in destination directory and after linking this dir to /usr/local/sarg-reports i can see reports via pfsense's GUI.

sarg -x -f /usr/pbi/sarg-i386/etc/sarg/sarg.conf -o /sarg-reports/

So, sarg works for 1st level directory but don't work for 3rd level subdir.

Any ideas how to solve problem?

zoro_2009

I confirm the problem ! :(

KOM

Try this from the shell:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

Use ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports if you have 64-bit build.

Taras_

@KOM:

Try this from the shell:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

Thanks! Fixes problem :)

erasmus

My Hardware: APU1C4

only this solved the Problem:

in console

rm -rf /usr/local/sarg-reports
ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports

Brutos

Was having a similar issue glad i found this post fixed the issue for me thanks

ak

I ran the above commands to delete the directory and create the symlink to /usr/pbi/sarg-amd64/local/sarg-reports. I can see sarg generated logs under here. However on the 'View Report' tab I still get


Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

This is on a fresh pfSense install running 2.2-RELEASE with Sarg 2.3.9 pkg v.0.6.4, Squid3 4.3.10_2 pkg 0.2.6

KOM

Check your other options. Sarg seems to be finicky and will not work right with the wrong combination of report options. Do you have Generate main index.html and Generate the index tree by file set to Yes, for instance?

ak

Thanks KOM - checked the two options you suggested about index.html and they were selected. I then selected all and thought to try that and reduce it to my original set.

After selecting every option, I ran```
sarg -x


Thanks for the help.

aityahiaidir

for who have this error even after creating symlink /usr/local/sarg-reports to /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports or /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports depending on the version you have installed

Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

you certainly chosen SquidGuard as proxy server in Sarg general report setting (with Squid it's work fine).

after some debug,i noticed that Sarg is looking for SquidGuard config file in the below location

/usr/pbi/squidguard-i386/etc/squidguard/squidGuard.conf

but the conf file is located in an other folder

 /usr/pbi/squidguard-i386/local/etc/squid/squidGuard.conf

for this Srag break generating index report, even if you try to change the folder in the Sarg configuration file, it will always set to the wrong one after each saving Sarg configuration.

i wil tryed to fixe that with symlink but it's dont work,

robatwork

I too am having problems with sarg reports, but having looked at this thread I can't see an identical issue - realtime report is OK but normal reports aren't generated, in syslog I get

php-fpm[68742]: /pkg_edit.php: The command 'export LC_ALL=C && /usr/pbi/sarg-amd64/bin/sarg -d `date +%d/%m/%Y' returned exit code '2', the output was ''

In SSH I get

export: Command not found.

Sarg is 2.3.9 v0.6.4 and pfsense is 2.2.1 (amd64) ie. both the latest.

Any ideas?

thanks

robatwork

Forget that. It was the wrong close quote mark ie should have been:
date +%d/%m/%Y

TAG: index yes|no|only

# Generate the main index.html.
# only - generate only the main index.html

index yes

TAG: index_tree date|file

# How to generate the index.

index_tree file

TAG: output_dir

# The reports will be saved in that directory
# sarg -o dir

output_dir /usr/local/sarg-reports

any useful info would be appreciated
System
2.2.1-RELEASE (amd64)
built on Fri Mar 13 08:16:49 CDT 2015
FreeBSD 10.1-RELEASE-p6
Squid3 -3.4.10_2 pkg 0.2.7
Sarg 2.3.9 pkg v.0.6.4

KOM

Did you try the symlink fix shown abpve?

jabo53

I have the same problem
"Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule."

I can view the realtime with no problem though.

It appears the reports are being generated but to:
"/usr/pbi/sarg-amd64/local/sarg-reports"

I checked the conf file and the report path is: /usr/local/sarg-reports
Tried changing it to:"/usr/pbi/sarg-amd64/local/sarg-reports" but no difference.
Tried creating symb link from "/usr/pbi/sarg-amd64/local/sarg-reports" to /usr/local/sarg-reports with the direction from another post in this thread and yes the reports were there but still the the same error message.

I can see I am not the only one with this issue but I have not seen a real solution yet. Is this a bug with squid3 dev or a problem with sarg?

Do I need to manually put in some type of integration parameters as squidguard puts in for itself?

Or if someone has the info on how to configure sarg to send the reports via email that would be good also.

Jabo

jabo53

@KOM:

Did you try the symlink fix shown abpve?

Yes I did, see here
https://forum.pfsense.org/index.php?topic=47765.msg511144#msg511144

Thanks
Jabo