Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sarg Not Showing Reports

    Scheduled Pinned Locked Moved Cache/Proxy
    17 Posts 9 Posters 6.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      ElectroPulse
      last edited by

      Hello, all!

      I have run into a bit of a problem getting Sarg running… Squid is installed and running properly, including logging. Sarg is installed and set to check Squid's logs.

      I tried running:

      export LC_ALL=C && sarg -x
      

      …and the following is the output:

      SARG: Init
      SARG: Loading configuration from /usr/local/etc/sarg/sarg.conf
      SARG: Loading exclude host file from: /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf
      SARG: Loading exclude file from: /usr/pbi/sarg-i386/etc/sarg/exclude_users.conf
      SARG: Reading host alias file "/usr/pbi/sarg-i386/etc/sarg/hostalias"
      SARG: List of host names to alias:
      SARG: Parameters:
      SARG:           Hostname or IP address (-a) = 
      SARG:                    Useragent log (-b) = 
      SARG:                     Exclude file (-c) = /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf
      SARG:                  Date from-until (-d) = 
      SARG:    Email address to send reports (-e) = 
      SARG:                      Config file (-f) = /usr/local/etc/sarg/sarg.conf
      SARG:                      Date format (-g) = USA (mm/dd/yyyy)
      SARG:                        IP report (-i) = No
      SARG:             Keep temporary files (-k) = No
      SARG:                        Input log (-l) = /var/squid/logs/access.log
      SARG:               Resolve IP Address (-n) = No
      SARG:                       Output dir (-o) = /usr/local/sarg-reports/
      SARG: Use Ip Address instead of userid (-p) = No
      SARG:                    Accessed site (-s) = 
      SARG:                             Time (-t) = 
      SARG:                             User (-u) = 
      SARG:                    Temporary dir (-w) = /tmp/sarg
      SARG:                   Debug messages (-x) = Yes
      SARG:                 Process messages (-z) = No
      SARG:  Previous reports to keep (--lastlog) = 0
      SARG: 
      SARG: sarg version: 2.3.9 Sep-21-2014
      SARG: Reading access log file: /var/squid/logs/access.log
      SARG: Records in file: 221, reading: 0.00%
      SARG:    Records read: 221, written: 221, excluded: 0
      SARG: Squid log format
      SARG: Period: 2015 Mar 24
      SARG: File /usr/local/sarg-reports/2015Mar24-2015Mar24 already exists, moved to /usr/local/sarg-reports/2015Mar24-2015Mar24.10
      SARG: Sorting log /tmp/sarg/192_168_2_106.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_106
      SARG: Sorting log /tmp/sarg/192_168_2_113.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_113
      SARG: Sorting log /tmp/sarg/192_168_21_112.user_unsort
      SARG: Making file: /tmp/sarg/192_168_21_112
      SARG: Sorting log /tmp/sarg/192_168_2_20.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_20
      SARG: Sorting log /tmp/sarg/192_168_21_245.user_unsort
      SARG: Making file: /tmp/sarg/192_168_21_245
      SARG: Sorting log /tmp/sarg/192_168_2_30.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_30
      SARG: Sorting log /tmp/sarg/192_168_21_103.user_unsort
      SARG: Making file: /tmp/sarg/192_168_21_103
      SARG: Sorting log /tmp/sarg/192_168_2_116.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_116
      SARG: Sorting log /tmp/sarg/192_168_2_187.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_187
      SARG: Sorting log /tmp/sarg/192_168_2_10.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_10
      SARG: Sorting log /tmp/sarg/192_168_2_114.user_unsort
      SARG: Making file: /tmp/sarg/192_168_2_114
      SARG: Sorting file: /tmp/sarg/192_168_2_106.utmp
      SARG: Making report: 192.168.2.106
      SARG: Sorting file: /tmp/sarg/192_168_2_113.utmp
      SARG: Making report: 192.168.2.113
      SARG: Sorting file: /tmp/sarg/192_168_21_112.utmp
      SARG: Making report: 192.168.21.112
      SARG: Sorting file: /tmp/sarg/192_168_2_20.utmp
      SARG: Making report: 192.168.2.20
      SARG: Sorting file: /tmp/sarg/192_168_21_245.utmp
      SARG: Making report: 192.168.21.245
      SARG: Sorting file: /tmp/sarg/192_168_2_30.utmp
      SARG: Making report: 192.168.2.30
      SARG: Sorting file: /tmp/sarg/192_168_21_103.utmp
      SARG: Making report: 192.168.21.103
      SARG: Sorting file: /tmp/sarg/192_168_2_116.utmp
      SARG: Making report: 192.168.2.116
      SARG: Sorting file: /tmp/sarg/192_168_2_187.utmp
      SARG: Making report: 192.168.2.187
      SARG: Sorting file: /tmp/sarg/192_168_2_10.utmp
      SARG: Making report: 192.168.2.10
      SARG: Sorting file: /tmp/sarg/192_168_2_114.utmp
      SARG: Making report: 192.168.2.114
      SARG: Making index.html
      SARG: Successful report generated on /usr/local/sarg-reports/2015Mar24-2015Mar24
      SARG: Purging temporary file sarg-general
      SARG: End
      SARG: Records in file: 221, reading: 100.00%
      

      So, it IS creating the reports… And even more strangely, it's even seeing past reports (judging by the line "SARG: File /usr/local/sarg-reports/2015Mar24-2015Mar24 already exists, moved to /usr/local/sarg-reports/2015Mar24-2015Mar24.10"... The last number ("10" in this case) even increments every time I run it). However, when I browse to /usr/local/sarg-reports it shows it as empty. And, when I got to the "View Report" tab in Sarg, it shows it as empty.

      Traffic is passing through Squid, and is being logged in /var/squid/logs/access.log just fine.

      Any thoughts? I've tried setting

      Thanks!
      ElectroPulse

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        Sarg is picky about the reports you select and the options you use.

        Here is what I use and it seems to work for me:

        sarg.png
        sarg.png_thumb

        1 Reply Last reply Reply Quote 0
        • E
          ElectroPulse
          last edited by

          @KOM:

          Sarg is picky about the reports you select and the options you use.

          Here is what I use and it seems to work for me:

          Thank you for the reply!

          Tried those settings, didn't work unfortunately… I have Sarg set up EXACTLY how I have it on another pfSense server, and it still doesn't work. I've compared all the settings side-by-side, and it's not wanting to work.

          The thing that's strange to me is that according to the above posted diagnostic messages, it is indicating that reports are indeed being generated and being seen by Sarg when it generates new reports (thus why it is incrementing the report number), but the reports folder is blank.

          Any ideas?

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            Are you running 2.1.x or 2.2?  Sarg under 2.1.x had an issue with a quick fix:

            rm -r /usr/local/sarg-reports
            ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports
            

            Substitute sarg-i386 for sarg-amd64 if you have the 32-bit build.

            If you're running 2.2 then I don't know.

            1 Reply Last reply Reply Quote 0
            • E
              ElectroPulse
              last edited by

              @KOM:

              Are you running 2.1.x or 2.2?  Sarg under 2.1.x had an issue with a quick fix:

              rm -r /usr/local/sarg-reports
              ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports
              

              Substitute sarg-i386 for sarg-amd64 if you have the 32-bit build.

              If you're running 2.2 then I don't know.

              Ah, I neglected to give that info.

              No, we're running 2.2… Any idea whether that might work on 2.2? I'll give it a try in just a little bit.

              EDIT: Hey! That worked! I didn't realize that the folder it looks in is a softlink to another location... I browsed to where the files are actually located, and there they were. I ran the commands you gave me to re-create the softlink, and voila, it worked! Thanks a bunch :)

              1 Reply Last reply Reply Quote 0
              • KOMK
                KOM
                last edited by

                From what I understand, this fix shouldn't have worked under 2.2 since the package was corrected weeks ago.  Perhaps it's broken again

                1 Reply Last reply Reply Quote 0
                • E
                  ElectroPulse
                  last edited by

                  @KOM:

                  From what I understand, this fix shouldn't have worked under 2.2 since the package was corrected weeks ago.  Perhaps it's broken again

                  Hmm… It's been a little while, so I don't remember whether the upgrade to 2.2 was an upgrade or a clean install with a restore from backup on this campus. If it was an upgrade, I wonder if it could have brought that over from the previous version. I don't know whether Sarg re-creates all folders and softlinks on package reinstall. I just know something wonky was going on with that softlink (the report-generating part of Sarg could see the files that had been created previously, but the report-showing part couldn't see them, nor could I when browsing to it), until I used those commands to delete and re-create it.

                  1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM
                    last edited by

                    There were warnings from ESF people about using these manual hacks and how they could potentially cause problems down the line.  Perhaps this is one of those instances.

                    1 Reply Last reply Reply Quote 0
                    • E
                      ElectroPulse
                      last edited by

                      Just ran into this exact problem once again… But this time, it was on a completely clean 2.2.2 install (except for restoring Captive Portal settings from a backup).

                      The only thing I can think of that I did non-standard, was installing Sarg via the CLI (using "pfSsh.php playback installpkg Sarg"). After running into the problem and immediately recognizing it, I uninstalled it and re-installed it through the gui... Still had to use the manual workaround.

                      EDIT 05/25/15: Just ran into the issue again, when restoring the config and letting pfSense automatically re-install the packages, so doesn't look like it's related to the package install method.

                      1 Reply Last reply Reply Quote 0
                      • R
                        rebytr
                        last edited by

                        Had the same issue today on a fresh install of 2.2.3 running Sarg 0.6.4.  Fix above corrected this problem.

                        1 Reply Last reply Reply Quote 0
                        • P
                          pppower
                          last edited by

                          @KOM:

                          Are you running 2.1.x or 2.2?  Sarg under 2.1.x had an issue with a quick fix:

                          rm -r /usr/local/sarg-reports
                          ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports
                          

                          Substitute sarg-i386 for sarg-amd64 if you have the 32-bit build.

                          If you're running 2.2 then I don't know.

                          Had problems running Sarg 0.6.4 on 2.2.3-RELEASE (amd64).  Workaround above worked a treat.

                          1 Reply Last reply Reply Quote 0
                          • T
                            TheCook
                            last edited by

                            Hello all,

                            I have implemented the link and Sarg can see almost everything.  But, when I get to the final level (the actual reports) I get the same message about not finding the index file.

                            In the 'month' directory I have a heap of directories with names like 30-31.1 30-31.2 all the way to 30-31.24.

                            It looks to me like I have a directory for each hour or so for every day.  So when Sarg looks for a directory for the day (30-31), it can't find it.

                            Have I set something wrong with the limit settings? Or logging in Squid? ::)

                            To put it another way,  if I use my browser to look in the 30-31.1 directory, I get reports.  So it is working fine. It is just that I go to Status>Sarg Reports>ViewReport>year 2015>month August and I get 24 buttons each for 2015 August 30-31 and they all point to x.x.x.x/sarg_frame.php?prevent=179902248&file=/2015/08/30-31/index.html

                            It should be file=/2015/08/30-31.1/index.html or I should have less directories for day 30-31.

                            Forgot to say.  I am running 2.2.4-release(i386) and Sarg 0.6.4

                            1 Reply Last reply Reply Quote 0
                            • J
                              jawz101
                              last edited by

                              My only guess is if you're seeing decimalized / incremental daily folders it's probably due to an hourly schedule?

                              Maybe if you have at least 1 hourly schedule you must also have a daily schedule for any schedules based on higher timeframes to function so it also has whole-number day folders to work with.

                              Or just don't use hourly schedules ever and avoid the issue.

                              Just guessing.

                              1 Reply Last reply Reply Quote 0
                              • M
                                melissa6roman
                                last edited by

                                Hi,

                                I'm new using pfSense and i want to get reports, so I installed Sarg but I have troubles.

                                I can't get any report, neither with schedule or realtime.
                                When I try to force the report on schedule tab I get this warning message. Warning: symlink(): No such file or directory in /usr/local/pkg/sarg.inc on line 97

                                Then I checked the files on the console. In  /usr/local/ there are bin, captiveportal, etc, include, info, lib, libdata, libexec, man, openssi, phg, sbin, share, tests and www, in pkg there isn't any file from sarg. Also I checked /usr/pbi/ and I got .hashdir, share, squidguard-squid3-i386, ect, and squid-i386, in etc there isn't anything from sarg.

                                I need help to get the reports please.

                                Sarg: 2.3.6_2 pkg v0.6.9
                                squid: 2.7.9 pkg v.4.3.4

                                1 Reply Last reply Reply Quote 0
                                • R
                                  reinaldo.gomes
                                  last edited by

                                  "Warning: symlink(): No such file or directory in /usr/local/pkg/sarg.inc on line 97 "

                                  Your symlink is pointing to the wrong location. Delete it and remake it.

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    epionier
                                    last edited by

                                    When I installed SARG a few weeks ago I had a problem with the reports that didn`t show up.

                                    The following provided instructions of KOM:

                                    rm -r /usr/local/sarg-reports
                                        ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports

                                    helped and everything was working as expected afterwards.

                                    Unfortunately a couple of days ago a new package update of SARG was available and I reinstalled the package with the update.
                                    Since then the problem with the SARG reports is back and it says:

                                    "Error: Could not find report index file. Check and save Sarg settings and try to force Sarg schedule."

                                    I checked the file structure and the link "/usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports" still exists.

                                    Is there a solution without deleting existing reports in the folder??

                                    1 Reply Last reply Reply Quote 0
                                    • KOMK
                                      KOM
                                      last edited by

                                      Doktornotor may have fixed that package to remove the need for the manual symlink.  I would completely uninstall the package, remove the symlink and then install it again.  You may have to manually clean up old traces of Sarg.

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.