Sarg package for pfsense

jabo53

I have the same problem
"Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule."

I can view the realtime with no problem though.

It appears the reports are being generated but to:
"/usr/pbi/sarg-amd64/local/sarg-reports"

I checked the conf file and the report path is: /usr/local/sarg-reports
Tried changing it to:"/usr/pbi/sarg-amd64/local/sarg-reports" but no difference.
Tried creating symb link from "/usr/pbi/sarg-amd64/local/sarg-reports" to /usr/local/sarg-reports with the direction from another post in this thread and yes the reports were there but still the the same error message.

I can see I am not the only one with this issue but I have not seen a real solution yet. Is this a bug with squid3 dev or a problem with sarg?

Do I need to manually put in some type of integration parameters as squidguard puts in for itself?

Or if someone has the info on how to configure sarg to send the reports via email that would be good also.

Jabo

jabo53

@KOM:

Did you try the symlink fix shown abpve?

Yes I did, see here
https://forum.pfsense.org/index.php?topic=47765.msg511144#msg511144

Thanks
Jabo

sujyo1

Here is my Sarg in action!! In system log no sarg error and date is correct when i force update sarg reports but In Sarg View reports and Sarg real time are showing old reports!!

2.1.5-RELEASE (i386)
built on Mon Aug 25 07:44:26 EDT 2014
FreeBSD 8.3-RELEASE-p16

Intel(R) Atom(TM) CPU N280 @ 1.66GHz
2 CPUs: 1 package(s) x 1 core(s) x 2 HTT threads

$ squid -v
Squid Cache: Version 2.7.STABLE9

Sarg 2.3.6_2 pkg v.0.6.3

SYSTEM LOG:

Apr 18 02:00:00 php: sarg.php: Sarg: force refresh now with -d date +%d/%m/%Y-date +%d/%m/%Y args, compress(on) and none action after sarg finish.

Apr 18 01:17:47 php: /pkg_edit.php: Sarg: force refresh now with -d date +%d/%m/%Y-date +%d/%m/%Y args, compress(on) and none action after sarg finish.
Apr 18 01:17:47 check_reload_status: Syncing firewall
Apr 18 01:17:40 php: /pkg_edit.php: Sarg: force refresh now with -d date +%d/%m/%Y-date +%d/%m/%Y args, compress(on) and none action after sarg finish.

SARG VIEW REPORT:

Squid User Access Report
FILE/PERIOD CREATION DATE USERS BYTES AVERAGE
2015Mar23-2015Mar23 Mon Mar 23 23:00:24 2015 3 58,608 19,536
2015Mar22-2015Mar22 Sun Mar 22 23:00:27 2015 18 4,130,379,537 229,465,529
2015Mar21-2015Mar21 Sat Mar 21 23:00:33 2015 37 3,529,371,665 95,388,423
2015Mar20-2015Mar20 Fri Mar 20 23:00:28 2015 32 3,079,436,066 96,232,377
2015Mar19-2015Mar19 Thu Mar 19 23:00:29 2015 19 4,513,906,771 237,574,040
2015Mar18-2015Mar18 Wed Mar 18 23:00:26 2015 17 2,775,934,852 163,290,285
2015Mar17-2015Mar17 Tue Mar 17 23:00:24 2015 19 1,386,602,417 72,979,074
2015Mar16-2015Mar16 Mon Mar 16 23:00:23 2015 15 1,118,870,024 74,591,33

SARG REALTIME:

DATE/TIME IP/NAME USERID TYPE ACCESSED SITE
2015-03-23 00:13 10.10.10.171 - GET captive.apple.com
2015-03-23 00:09 10.10.10.33 - GET i.ytimg.com
2015-03-22 23:59 10.10.10.171 - GET captive.apple.com
2015-03-22 23:59 10.10.10.33 - GET safesecuredownload.com
2015-03-22 23:59 10.10.10.33 - GET gomotrak.com

firetxelo

@KOM:

Try this from the shell:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

Use ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports if you have 64-bit build.

This fix the problem… try it

VictorCheng

@marcelloc:

@namek:

Hello, Is it possible to change the unit from bytes to something higher? like KB or MB?

Sure. :)

Just select Show values in reports using abbreviation on sarg general tab.

Hello, I no longer see the Show values options in Sarg (pfSense 2.2.2, Sarg 0.6.4). I see nothing like that on the General tab.
On the Users tab I can select User Sort Field: BYTES(default), SITE normal, CONNECT and TIME.
I want to display Sarg reports in Megabytes instead of Bytes.
Help anyone?

Requiring

@firetxelo:

@KOM:

Try this from the shell:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

Use ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports if you have 64-bit build.

This fix the problem… try it

thank's its work on my pfsense…. ;) ;) ;)

robatwork

Hello all,

My sarg installation is in a bit of a mess. Rather than trying to fix what I think are multiple issues, I want to completely remove sarg including any logs and settings, and install it again from scratch. I have tried an uninstall but this doesn't get rid of everything. Any simple pointers on how to nuke sarg totally?
thanks!

aGeekhere

I get the same sarg error

Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

Has a fix been found yet?

sujyo1

did try all but same here…

Jun 10 02:00:00 php: sarg.php: Sarg: force refresh now with -d date +%d/%m/%Y-date +%d/%m/%Y args, compress(on) and none action after sarg finish.

Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

ddimick

@KOM:

Try this from the shell:

rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-i386/local/sarg-reports /usr/local/sarg-reports

Use ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports if you have 64-bit build.

Fixed for me as well, had to perform on a brand new install.

paracetamol

Hi,
My SARG schedule work half time:
First schedule is ok
Second run i have this error:

SARG: Period: 24 Dec 2015
SARG: File /usr/local/sarg-reports/2015/12/24 already exists, moved to /usr/local/sarg-reports/2015/12/24.2
SARG: cannot open /usr/local/sarg-reports/2015/12/24/sarg-date for writing
SARG:: No such file or directory

third run is OK

Have you an idea ??

Thanks

marcelloc

Select overwrite reports on settings tab.

jadog

Can anybody tell me if it would be possible to setup Sarg to email the the reports in a viewable format? Maybe some sort of a cron job could do this?

Angel_19

Hi

pfSense 2.2.6
I received the following error message:

php: sarg.php: The command 'export LC_ALL=C && /usr/pbi/sarg-i386/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 1732, reading: 0.00%^MSARG: cannot open /usr/local/sarg-reports/2016/03/21/sarg-date for writing SARG:: No such file or directory SARG: Records in file: 1732, reading: 100.00%'

What could be the problem?

Nytridr

Its been discontinued.

https://forum.pfsense.org/index.php?topic=110405.msg614621#msg614621

spiv

How do i remove Sarg on pfsense 2.3
Any command that i can type to remove it. I can see the menu link and keep on having crash report on the package. Please look at the attached screenshot.

sarg1.png_thumb

sarg2.png_thumb

speedup

@spiv:

How do i remove Sarg on pfsense 2.3
Any command that i can type to remove it. I can see the menu link and keep on having crash report on the package. Please look at the attached screenshot.

I have some problem too. anybody help?

un 24 12:00:00 	php 		/usr/local/www/sarg.php: The command 'export LC_ALL=C && /usr/local/bin/sarg -d `date +%d/%m/%Y`' returned exit code '127', the output was '/usr/local/bin/sarg: not found'

speedup

no one help?

Nachtfalke

Don't know what the correct way ist, but you should:


rm -rf /usr/local/pkg/sarg*
rm -rf /usr/local/www/sarg*

Don't know exactly where the reports are stored so probably first search for them and then delete these folders.

search:


find / -iname "*sarg*"

Then remove it with "rm -rf"

Further install "cron" package and then delete all existing cronjobs which contain something with "sarg" in it.

Delete the remaining "sarg" entries from your config. In my environment this is:


vi /cf/conf/config.xml

There I deleted the pars beginning/ending with:


<sarg></sarg>
<sarguser></sarguser>
<sargschedule></sargschedule>
<sargrealtime></sargrealtime>

So after rebooting everything should be ok. Of courxe, please crwate a backup of the configu before you start deleting something.

Regards.

techsecure

It is an awesome tool, sad it is not available now.