Sarg issues



  • Hello I got squid and havp installed in proxy mode.

    Today I got sarg installed but I cant seem to get it to work. It works on real time but is not generating reports.
    when I run sarg -x I get a coredump.

    SARG: Init
    SARG: Loading configuration from /usr/pbi/sarg-i386/etc/sarg/sarg.conf
    SARG: Loading exclude host file from: /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf
    SARG: Loading exclude file from: /usr/pbi/sarg-i386/etc/sarg/exclude_users.conf
    SARG: Reading host alias file "/usr/pbi/sarg-i386/etc/sarg/hostalias"
    SARG: List of host names to alias:
    SARG: Deleting temporary directory "/tmp/sarg"
    SARG: Parameters:
    SARG:          Hostname or IP address (-a) =
    SARG:                    Useragent log (-b) =
    SARG:                    Exclude file (-c) = /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf
    SARG:                  Date from-until (-d) =
    SARG:    Email address to send reports (-e) =
    SARG:                      Config file (-f) = /usr/pbi/sarg-i386/etc/sarg/sarg.conf
    SARG:                      Date format (-g) = USA (mm/dd/yyyy)
    SARG:                        IP report (-i) = No
    SARG:            Keep temporary files (-k) = No
    SARG:                        Input log (-l) = /var/squid/logs/access.log
    SARG:              Resolve IP Address (-n) = No
    SARG:                      Output dir (-o) = /usr/local/sarg-reports/
    SARG: Use Ip Address instead of userid (-p) = No
    SARG:                    Accessed site (-s) =
    SARG:                            Time (-t) =
    SARG:                            User (-u) =
    SARG:                    Temporary dir (-w) = /tmp/sarg
    SARG:                  Debug messages (-x) = Yes
    SARG:                Process messages (-z) = No
    SARG:  Previous reports to keep (–lastlog) = 0
    SARG:
    SARG: sarg version: 2.3.6 Arp-21-2013
    SARG: Reading access log file: /var/squid/logs/access.log
    SARG: Records in file: 718, reading: 100.00%
    SARG:    Records read: 718, written: 718, excluded: 0
    SARG: Squid log format
    SARG: Period: 2013 Oct 21
    SARG: Sorting log /tmp/sarg/10_30_2_1.user_unsort
    SARG: Making file: /tmp/sarg/10_30_2_1
    Segmentation fault (core dumped)

    When I run sarg I get

    SARG: Records in file: 723, reading: 100.00%
    SARG: cannot open /usr/local/sarg-reports/2013/10/21/sarg-date for writing
    SARG:: No such file or directory

    When I drill down to the dir I see that is not creating the dir with normal numbers but instead as:

    /usr/local/sarg-reports/2013/10/21.1

    I am using pfsense 2.1 RELEASE i386.

    Thoughts?

    TIA!



  • BumP :(



  • check overwrite report option on sarg gui. This will prevent multiple reports of same day.



  • @marcelloc:

    check overwrite report option on sarg gui. This will prevent multiple reports of same day.

    marcelloc,

    As always Thank you!
    I got pass the dir issue but I am still unable to display the report and still getting:

    kernel: pid 12000 (sarg), uid 0: exited on signal 11 (core dumped)



  • I get:

    Error: Could not find report index file.
    Check and save sarg settings and try to force sarg schedule.

    When I try to view the report.



  • Here is more tha can help…

    Oct 22 11:47:38 php: /pkg_edit.php: executing squid log rotate after sarg.
    Oct 22 11:47:38 php: /pkg_edit.php: The command 'export LC_ALL=C && /usr/pbi/sarg-i386/bin/sarg ' returned exit code '139', the output was 'SARG: Records in file: 13233, reading: 0.00%^MSARG: Records in file: 5000, reading: 37.78%^MSARG: Records in file: 10000, reading: 75.57%'





  • Do you have more then one report running simultaneously?

    Maybe one via cron and other via console?

    I had some issues with sarg but it was a report reading error(special chars or url size) But I think this bug was present on previous versions.

    Are your squid logs on default format?



  • @marcelloc:

    Do you have more then one report running simultaneously?

    Maybe one via cron and other via console?

    I had some issues with sarg but it was a report reading error(special chars or url size) But I think this bug was present on previous versions.

    Are your squid logs on default format?

    marcelloc,

    No. I have not run any of them. It's a default install.
    Yes default squid logs. I am also running havp in transparent mode.


Log in to reply