Sarg package for pfsense

marcelloc

Are you using just squid?

Can you check in log files if you can see the auth user?

klamath

Thanks Marcelo…

I've got some problem to get it done...
It doesn't work for me...
Can you help me?

[Sarg]Sarg config error: log file () does not exists .:.

Apr 10 23:00:29 php: /pkg_edit.php: executing squid log rotate after sarg.
Apr 10 23:00:29 php: /pkg_edit.php: executing squidguard log rotate after sarg.
Apr 10 23:00:29 php: /pkg_edit.php: The command '/usr/local/bin/sarg ' returned exit code '1', the output was 'SARG: Records in file: 49003, reading: 0.00%^MSARG: Records in file: 5000, reading: 10.20%^MSARG: Records in file: 10000, reading: 20.41%^MSARG: Records in file: 15000, reading: 30.61%^MSARG: Records in file: 20000, reading: 40.81%^MSARG: Records in file: 25000, reading: 51.02%^MSARG: Records in file: 30000, reading: 61.22%^MSARG: Records in file: 35000, reading: 71.42%^MSARG: Records in file: 40000, reading: 81.63%^MSARG: Records in file: 45000, reading: 91.83%^MSARG: Cannot delete /usr/local/www/sarg-reports/08Apr2012-10Apr2012/d192_168_1_106.html - No such file or directory SARG: Records in file: 49003, reading: 100.00%'
Apr 10 23:00:28 php: /pkg_edit.php: Sarg: force refresh now with '' args and rotate action after sarg finish.

Command line

sarg
SARG: Records in file: 49194, reading: 100.00%
SARG: Cannot delete /usr/local/www/sarg-reports/2012/04/08-10/d192_168_1_106.html - No such file or directory

marcelloc

Can you clean this problematic folder and try to run Sarg again?

My current schedules are
1h with no action after sarg
1d with rotate and restart.

Index options are selected on sarg configuration as well report overwrite.

Donny

@marcelloc:

Are you using just squid?

Can you check in log files if you can see the auth user?

First I have uninstall SARG and Squid-reverse because It is not work. After that I tried to install normal Squid-proxy and SARG again. When I created local user on Squid-proxy, I can not use capital and small letter like this: "Donny" but just only small letter: "donny" if I try to login via web browsers otherwise I can not login.

Now I turn off authenticate and go back to use "Transparent proxy" again. I will check log file in this evening and test again. I have to go to work now. bye

Thank u Marcelloc

Donny

Hello all, SARG with authenticate local user from the Squid is working now. At "realtime report and View report tab" show a local user name that I used to login via web browser. This is my step:
1. I have installed Squid-reverse and config a basic option that I need to use and I also create Local user and enable authentication to "local"
2. I installed SARGv.0.4.1. At Sarg setting > General > Report Option. I do not select "Use Ip Address instead userid in reports (no)". if I select this option it does not show any local user name. After that I created
schedule to make a report and I select option > action after sarg "Rotate log and Restart proxy daemon" and then "Force Update now". See screenshot
3. At web browser (Firefox) go to Tools > Options > Advanced > at Network tab > Connecting Settings, I configured proxy IP address like this example: 172.31.21.1 and use port 3128.
4. The next step I will try to test SARG with Squid-reverse and Dansguardian.

Thank a lot

SargSettingsLocalUsersWork.png_thumb

RealTimeLocalUsersSquid.png_thumb
Sites&LocalUsersSquid.png
Sites&LocalUsersSquid.png_thumb

Donny

Hello everyone, Can I use SARG and Dansguardian to make some report without Squid-reverse ? because Dansguardian have already included Squid v.2.7.9 .

marcelloc

You can if you configure squid by hand instead of using squid gui.

The package filer could help you on editing file and restarting service.

Donny

@marcelloc:

You can if you configure squid by hand instead of using squid gui.

The package filer could help you on editing file and restarting service.

Thank u, I have tested Dandsguardian right now but it is a little confuse some option. I read a lot at Dansguardian blog on pfsense. I have tried some basic step that some guy has posted in here: http://forum.pfsense.org/index.php/topic,47856.0.html but another option on Dansguardian, it make me too complicated. anyway I will try and test it first and I will ask some help later if I can not solve the problem. (I think many people here need some Dansguardian tutorial basic to understand.)

marcelloc

This dansguardian wiki maybe usefull to understand how it works

http://contentfilter.futuragts.com/wiki/doku.php?id=Main%20Index&DokuWiki=924cce1d7ede32b3512092f5f759126e

Donny

Hello Marcelloc, I just tested Dansguardian to block facebook (http and https). it is working and very usefull package. I really like all this packages "SARG, Squid-reverse and Dansguardian" very much. and Thank u again for your hard work.

Donny

Hello, Just want to know, how far email option system log report work with SARG ?

Thank u

marcelloc

@Donny:

Hello, Just want to know, how far email option system log report work with SARG ?

I'm looking at rrd mail report package to see how it work but I have no idea on when I'll have time to implement it.

Donny

After install SARG I got some error : Sarg config error: dansguardian log file () does not exists. In this case I have already configured Squid3 and also Dansguardian.
At Dansquardian > Report and log tab I selected log File Format to Squid log File Format
At SARG Settings > General tab > proxy server I selected to dansguardian. reboot or not reboot system at this point I always got warning Sarg config error: dansguardian log file () does not exists If I change proxy server to Squid the warning error is disappear.

This is my system log file:

Apr 16 01:19:37 php: : Reloading Dansguardian
Apr 16 01:19:37 php: : Reloading Dansguardian
Apr 16 01:19:38 php: : Reloading Dansguardian
Apr 16 01:19:38 php: : Reloading Dansguardian
Apr 16 01:19:38 php: : Reloading Dansguardian
Apr 16 01:19:40 php: : [squid] xmlrpc sync is starting.
Apr 16 01:19:41 php: : Starting Squid
Apr 16 01:19:41 squid[19250]: Squid Parent: child process 19565 started
Apr 16 01:19:41 check_reload_status: Reloading filter
Apr 16 01:19:41 php: : [squid] xmlrpc sync is starting.
Apr 16 01:19:42 php: : Reloading Squid for configuration sync
Apr 16 01:19:42 check_reload_status: Reloading filter
Apr 16 01:19:42 php: : [squid] xmlrpc sync is starting.
Apr 16 01:19:42 php: : Reloading Squid for configuration sync
Apr 16 01:19:42 php: : [squid] xmlrpc sync is starting.
Apr 16 01:19:43 php: : Reloading Squid for configuration sync
Apr 16 01:19:43 php: : [squid] xmlrpc sync is starting.
Apr 16 01:19:43 php: : Reloading Squid for configuration sync
Apr 16 01:19:43 php: : [squid] xmlrpc sync is starting.
Apr 16 01:19:44 php: : Reloading Squid for configuration sync
Apr 16 01:19:44 php: : Not calling package sync code for dependency squidcache of squid3 because some include files are missing.
Apr 16 01:19:44 php: : Not calling package sync code for dependency squidnac of squid3 because some include files are missing.
Apr 16 01:19:44 php: : Not calling package sync code for dependency squidtraffic of squid3 because some include files are missing.
Apr 16 01:19:44 php: : Not calling package sync code for dependency squidupstream of squid3 because some include files are missing.
Apr 16 01:19:44 php: : Not calling package sync code for dependency squidreverse of squid3 because some include files are missing.
Apr 16 01:19:44 php: : Not calling package sync code for dependency squidauth of squid3 because some include files are missing.
Apr 16 01:19:44 php: : Not calling package sync code for dependency squidusers of squid3 because some include files are missing.
Apr 16 01:19:46 php: : Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:46 php: : New alert found: Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:46 check_reload_status: Syncing firewall
Apr 16 01:19:46 php: : [sarg] sarg_xmlrpc_sync.php is starting.
Apr 16 01:19:46 php: : Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:46 php: : New alert found: Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:46 check_reload_status: Syncing firewall
Apr 16 01:19:46 php: : [sarg] sarg_xmlrpc_sync.php is starting.
Apr 16 01:19:46 php: : Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:46 php: : New alert found: Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:47 php: : [sarg] sarg_xmlrpc_sync.php is starting.
Apr 16 01:19:47 php: : Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:47 php: : New alert found: Sarg config error: dansguardian log file () does not exists
Apr 16 01:19:47 php: : [sarg] sarg_xmlrpc_sync.php is starting.
Apr 16 01:19:50 php: : IPSEC: One or more IPsec tunnel endpoints has changed its IP. Refreshing.
Apr 16 01:19:50 login: login on ttyv0 as root
Apr 16 01:19:50 sshlockout[58708]: sshlockout/webConfigurator v3.0 starting up
Apr 16 01:19:54 Squid_Alarm[11282]: Squid has exited. Reconfiguring filter.
Apr 16 01:19:54 Squid_Alarm[11604]: Attempting restart…
Apr 16 01:19:57 Squid_Alarm[13545]: Reconfiguring filter…
Apr 16 01:19:57 check_reload_status: Reloading filter
Apr 16 01:20:16 apinger: Error while feeding rrdtool: Broken pipe
Apr 16 01:21:16 apinger: /usr/local/bin/rrdtool respawning too fast, waiting 300s.

marcelloc

Can you check if /var/log/dansguardian folder exists?

Donny

@marcelloc:

Can you check if /var/log/dansguardian folder exists?

Hello Marcelloc, I already check dansguardian. It is still exists. see some screenshot

Sarg_Danguardian_log_file_not_exist.png_thumb

Donny

@Donny:

@marcelloc:

Can you check if /var/log/dansguardian folder exists?

Hello Marcelloc, I already check dansguardian. It is still exists. see some screenshot

Ok anyway I will try again.

marcelloc

@Donny:

Ok anyway I will try again.

Run sarg cmd on console and check if it returns errors.

Donny

@marcelloc:

@Donny:

Ok anyway I will try again.

Run sarg cmd on console and check if it returns errors.

I just clean install pfsense again. Installed dansguardian and squid3. I checked at system log file I saw many error there.

Apr 17 20:02:46 php: /pkg_mgr_install.php: The command '/usr/local/etc/rc.d/dansguardian stop' returned exit code '126', the output was '/usr/local/etc/rc.d/dansguardian: Permission denied'
Apr 17 20:02:46 php: : New alert found:
Apr 17 20:02:46 check_reload_status: Reloading filter
Apr 17 20:07:39 check_reload_status: Syncing firewall
Apr 17 20:07:39 php: /pkg_mgr_install.php: Beginning package installation for squid3.
Apr 17 20:07:40 check_reload_status: Syncing firewall
Apr 17 20:08:46 check_reload_status: Syncing firewall
Apr 17 20:08:46 php: /pkg_mgr_install.php: Creating squid cache subdirs in /var/squid/cache

Apr 17 20:08:46
php: /pkg_mgr_install.php: The command '/usr/local/sbin/squid -k shutdown' returned exit code '1', the output was '2012/04/17 20:08:46| WARNING: (B) '::/0' is a subnetwork of (A) '::/0' 2012/04/17 20:08:46| WARNING: because of this '::/0' is ignored to keep splay tree searching predictable 2012/04/17 20:08:46| WARNING: You should probably remove '::/0' from the ACL named 'all' 2012/04/17 20:08:46| ERROR: Directive 'upgrade_http0.9' is obsolete. 2012/04/17 20:08:46| cache_cf.cc(381) parseOneConfigFile: squid.conf:2931 unrecognized: 'broken_vary_encoding''

Apr 17 20:08:51
php: /pkg_mgr_install.php: The command '/usr/local/sbin/squid -k kill' returned exit code '1', the output was '2012/04/17 20:08:51| WARNING: (B) '::/0' is a subnetwork of (A) '::/0' 2012/04/17 20:08:51| WARNING: because of this '::/0' is ignored to keep splay tree searching predictable 2012/04/17 20:08:51| WARNING: You should probably remove '::/0' from the ACL named 'all' 2012/04/17 20:08:51| ERROR: Directive 'upgrade_http0.9' is obsolete. 2012/04/17 20:08:51| cache_cf.cc(381) parseOneConfigFile: squid.conf:2931 unrecognized: 'broken_vary_encoding''

Apr 17 20:08:51
php: /pkg_mgr_install.php: The command '/usr/local/sbin/squid -z' returned exit code '1', the output was '2012/04/17 20:08:51| WARNING: (B) '::/0' is a subnetwork of (A) '::/0' 2012/04/17 20:08:51| WARNING: because of this '::/0' is ignored to keep splay tree searching predictable 2012/04/17 20:08:51| WARNING: You should probably remove '::/0' from the ACL named 'all' 2012/04/17 20:08:51| ERROR: Directive 'upgrade_http0.9' is obsolete. 2012/04/17 20:08:51| cache_cf.cc(381) parseOneConfigFile: squid.conf:2931 unrecognized: 'broken_vary_encoding''

After I tried to reboot pfsense and squid has some files missing again.

Apr 17 20:33:28 php: : Not calling package sync code for dependency squidcache of squid3 because some include files are missing.
Apr 17 20:33:28 php: : Not calling package sync code for dependency squidnac of squid3 because some include files are missing.
Apr 17 20:33:28 php: : Not calling package sync code for dependency squidtraffic of squid3 because some include files are missing.
Apr 17 20:33:28 php: : Not calling package sync code for dependency squidupstream of squid3 because some include files are missing.
Apr 17 20:33:28 php: : Not calling package sync code for dependency squidreverse of squid3 because some include files are missing.
Apr 17 20:33:28 php: : Not calling package sync code for dependency squidauth of squid3 because some include files are missing.
Apr 17 20:33:28 php: : Not calling package sync code for dependency squidusers of squid3 because some include files are missing.

I did not install SARG yet because I want to find out some bugs between Dandsguardian and Squid.

I will running SARG cmd on console after I have installed SARG.

marcelloc

config squid options, save
config dansguardian save

check if errors persists.

Donny

another error found

Apr 17 21:13:53 php: : XML error: XML_ERR_NAME_REQUIRED at line 1 in /usr/local/pkg/dansguardian_users_footer.xml
Apr 17 21:13:53 php: : XML error: Invalid document end at line 99 in /usr/local/pkg/dansguardian_users_header.xml
Apr 17 21:13:53 php: : XML error: Invalid document end at line 100 in /usr/local/pkg/dansguardian_ips_header.xml

Both of squid and dansguardian used proxy interface: LAN (no loopback interface selected)

If I use squid as "Transparent proxy" I got this error as below but if I don't use squid as "Transparent proxy" I don't get this error (as you said before try to use squid without "Transparent proxy").

Of course, I have installed NAT rules to redirect from squid port 3128 to DG port 8080.

Apr 17 21:52:39 php: : SQUID is installed but not started. Not installing "nat" rules.
Apr 17 21:52:39 php: : SQUID is installed but not started. Not installing "pfearly" rules.
Apr 17 21:52:39 php: : SQUID is installed but not started. Not installing "filter" rules.

So it mean that using squid in transparent mode still have some bugs and problem.

config squid options, save
config dansguardian, save

No error found in the system log.