Sarg Not Showing Reports



  • Hello, all!

    I have run into a bit of a problem getting Sarg running… Squid is installed and running properly, including logging. Sarg is installed and set to check Squid's logs.

    I tried running:

    export LC_ALL=C && sarg -x
    

    …and the following is the output:

    SARG: Init
    SARG: Loading configuration from /usr/local/etc/sarg/sarg.conf
    SARG: Loading exclude host file from: /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf
    SARG: Loading exclude file from: /usr/pbi/sarg-i386/etc/sarg/exclude_users.conf
    SARG: Reading host alias file "/usr/pbi/sarg-i386/etc/sarg/hostalias"
    SARG: List of host names to alias:
    SARG: Parameters:
    SARG:           Hostname or IP address (-a) = 
    SARG:                    Useragent log (-b) = 
    SARG:                     Exclude file (-c) = /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf
    SARG:                  Date from-until (-d) = 
    SARG:    Email address to send reports (-e) = 
    SARG:                      Config file (-f) = /usr/local/etc/sarg/sarg.conf
    SARG:                      Date format (-g) = USA (mm/dd/yyyy)
    SARG:                        IP report (-i) = No
    SARG:             Keep temporary files (-k) = No
    SARG:                        Input log (-l) = /var/squid/logs/access.log
    SARG:               Resolve IP Address (-n) = No
    SARG:                       Output dir (-o) = /usr/local/sarg-reports/
    SARG: Use Ip Address instead of userid (-p) = No
    SARG:                    Accessed site (-s) = 
    SARG:                             Time (-t) = 
    SARG:                             User (-u) = 
    SARG:                    Temporary dir (-w) = /tmp/sarg
    SARG:                   Debug messages (-x) = Yes
    SARG:                 Process messages (-z) = No
    SARG:  Previous reports to keep (--lastlog) = 0
    SARG: 
    SARG: sarg version: 2.3.9 Sep-21-2014
    SARG: Reading access log file: /var/squid/logs/access.log
    SARG: Records in file: 221, reading: 0.00%
    SARG:    Records read: 221, written: 221, excluded: 0
    SARG: Squid log format
    SARG: Period: 2015 Mar 24
    SARG: File /usr/local/sarg-reports/2015Mar24-2015Mar24 already exists, moved to /usr/local/sarg-reports/2015Mar24-2015Mar24.10
    SARG: Sorting log /tmp/sarg/192_168_2_106.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_106
    SARG: Sorting log /tmp/sarg/192_168_2_113.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_113
    SARG: Sorting log /tmp/sarg/192_168_21_112.user_unsort
    SARG: Making file: /tmp/sarg/192_168_21_112
    SARG: Sorting log /tmp/sarg/192_168_2_20.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_20
    SARG: Sorting log /tmp/sarg/192_168_21_245.user_unsort
    SARG: Making file: /tmp/sarg/192_168_21_245
    SARG: Sorting log /tmp/sarg/192_168_2_30.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_30
    SARG: Sorting log /tmp/sarg/192_168_21_103.user_unsort
    SARG: Making file: /tmp/sarg/192_168_21_103
    SARG: Sorting log /tmp/sarg/192_168_2_116.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_116
    SARG: Sorting log /tmp/sarg/192_168_2_187.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_187
    SARG: Sorting log /tmp/sarg/192_168_2_10.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_10
    SARG: Sorting log /tmp/sarg/192_168_2_114.user_unsort
    SARG: Making file: /tmp/sarg/192_168_2_114
    SARG: Sorting file: /tmp/sarg/192_168_2_106.utmp
    SARG: Making report: 192.168.2.106
    SARG: Sorting file: /tmp/sarg/192_168_2_113.utmp
    SARG: Making report: 192.168.2.113
    SARG: Sorting file: /tmp/sarg/192_168_21_112.utmp
    SARG: Making report: 192.168.21.112
    SARG: Sorting file: /tmp/sarg/192_168_2_20.utmp
    SARG: Making report: 192.168.2.20
    SARG: Sorting file: /tmp/sarg/192_168_21_245.utmp
    SARG: Making report: 192.168.21.245
    SARG: Sorting file: /tmp/sarg/192_168_2_30.utmp
    SARG: Making report: 192.168.2.30
    SARG: Sorting file: /tmp/sarg/192_168_21_103.utmp
    SARG: Making report: 192.168.21.103
    SARG: Sorting file: /tmp/sarg/192_168_2_116.utmp
    SARG: Making report: 192.168.2.116
    SARG: Sorting file: /tmp/sarg/192_168_2_187.utmp
    SARG: Making report: 192.168.2.187
    SARG: Sorting file: /tmp/sarg/192_168_2_10.utmp
    SARG: Making report: 192.168.2.10
    SARG: Sorting file: /tmp/sarg/192_168_2_114.utmp
    SARG: Making report: 192.168.2.114
    SARG: Making index.html
    SARG: Successful report generated on /usr/local/sarg-reports/2015Mar24-2015Mar24
    SARG: Purging temporary file sarg-general
    SARG: End
    SARG: Records in file: 221, reading: 100.00%
    

    So, it IS creating the reports… And even more strangely, it's even seeing past reports (judging by the line "SARG: File /usr/local/sarg-reports/2015Mar24-2015Mar24 already exists, moved to /usr/local/sarg-reports/2015Mar24-2015Mar24.10"... The last number ("10" in this case) even increments every time I run it). However, when I browse to /usr/local/sarg-reports it shows it as empty. And, when I got to the "View Report" tab in Sarg, it shows it as empty.

    Traffic is passing through Squid, and is being logged in /var/squid/logs/access.log just fine.

    Any thoughts? I've tried setting

    Thanks!
    ElectroPulse



  • Sarg is picky about the reports you select and the options you use.

    Here is what I use and it seems to work for me:




  • @KOM:

    Sarg is picky about the reports you select and the options you use.

    Here is what I use and it seems to work for me:

    Thank you for the reply!

    Tried those settings, didn't work unfortunately… I have Sarg set up EXACTLY how I have it on another pfSense server, and it still doesn't work. I've compared all the settings side-by-side, and it's not wanting to work.

    The thing that's strange to me is that according to the above posted diagnostic messages, it is indicating that reports are indeed being generated and being seen by Sarg when it generates new reports (thus why it is incrementing the report number), but the reports folder is blank.

    Any ideas?



  • Are you running 2.1.x or 2.2?  Sarg under 2.1.x had an issue with a quick fix:

    rm -r /usr/local/sarg-reports
    ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports
    

    Substitute sarg-i386 for sarg-amd64 if you have the 32-bit build.

    If you're running 2.2 then I don't know.



  • @KOM:

    Are you running 2.1.x or 2.2?  Sarg under 2.1.x had an issue with a quick fix:

    rm -r /usr/local/sarg-reports
    ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports
    

    Substitute sarg-i386 for sarg-amd64 if you have the 32-bit build.

    If you're running 2.2 then I don't know.

    Ah, I neglected to give that info.

    No, we're running 2.2… Any idea whether that might work on 2.2? I'll give it a try in just a little bit.

    EDIT: Hey! That worked! I didn't realize that the folder it looks in is a softlink to another location... I browsed to where the files are actually located, and there they were. I ran the commands you gave me to re-create the softlink, and voila, it worked! Thanks a bunch :)



  • From what I understand, this fix shouldn't have worked under 2.2 since the package was corrected weeks ago.  Perhaps it's broken again



  • @KOM:

    From what I understand, this fix shouldn't have worked under 2.2 since the package was corrected weeks ago.  Perhaps it's broken again

    Hmm… It's been a little while, so I don't remember whether the upgrade to 2.2 was an upgrade or a clean install with a restore from backup on this campus. If it was an upgrade, I wonder if it could have brought that over from the previous version. I don't know whether Sarg re-creates all folders and softlinks on package reinstall. I just know something wonky was going on with that softlink (the report-generating part of Sarg could see the files that had been created previously, but the report-showing part couldn't see them, nor could I when browsing to it), until I used those commands to delete and re-create it.



  • There were warnings from ESF people about using these manual hacks and how they could potentially cause problems down the line.  Perhaps this is one of those instances.



  • Just ran into this exact problem once again… But this time, it was on a completely clean 2.2.2 install (except for restoring Captive Portal settings from a backup).

    The only thing I can think of that I did non-standard, was installing Sarg via the CLI (using "pfSsh.php playback installpkg Sarg"). After running into the problem and immediately recognizing it, I uninstalled it and re-installed it through the gui... Still had to use the manual workaround.

    EDIT 05/25/15: Just ran into the issue again, when restoring the config and letting pfSense automatically re-install the packages, so doesn't look like it's related to the package install method.



  • Had the same issue today on a fresh install of 2.2.3 running Sarg 0.6.4.  Fix above corrected this problem.



  • @KOM:

    Are you running 2.1.x or 2.2?  Sarg under 2.1.x had an issue with a quick fix:

    rm -r /usr/local/sarg-reports
    ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports
    

    Substitute sarg-i386 for sarg-amd64 if you have the 32-bit build.

    If you're running 2.2 then I don't know.

    Had problems running Sarg 0.6.4 on 2.2.3-RELEASE (amd64).  Workaround above worked a treat.



  • Hello all,

    I have implemented the link and Sarg can see almost everything.  But, when I get to the final level (the actual reports) I get the same message about not finding the index file.

    In the 'month' directory I have a heap of directories with names like 30-31.1 30-31.2 all the way to 30-31.24.

    It looks to me like I have a directory for each hour or so for every day.  So when Sarg looks for a directory for the day (30-31), it can't find it.

    Have I set something wrong with the limit settings? Or logging in Squid? ::)

    To put it another way,  if I use my browser to look in the 30-31.1 directory, I get reports.  So it is working fine. It is just that I go to Status>Sarg Reports>ViewReport>year 2015>month August and I get 24 buttons each for 2015 August 30-31 and they all point to x.x.x.x/sarg_frame.php?prevent=179902248&file=/2015/08/30-31/index.html

    It should be file=/2015/08/30-31.1/index.html or I should have less directories for day 30-31.

    Forgot to say.  I am running 2.2.4-release(i386) and Sarg 0.6.4



  • My only guess is if you're seeing decimalized / incremental daily folders it's probably due to an hourly schedule?

    Maybe if you have at least 1 hourly schedule you must also have a daily schedule for any schedules based on higher timeframes to function so it also has whole-number day folders to work with.

    Or just don't use hourly schedules ever and avoid the issue.

    Just guessing.



  • Hi,

    I'm new using pfSense and i want to get reports, so I installed Sarg but I have troubles.

    I can't get any report, neither with schedule or realtime.
    When I try to force the report on schedule tab I get this warning message. Warning: symlink(): No such file or directory in /usr/local/pkg/sarg.inc on line 97

    Then I checked the files on the console. In  /usr/local/ there are bin, captiveportal, etc, include, info, lib, libdata, libexec, man, openssi, phg, sbin, share, tests and www, in pkg there isn't any file from sarg. Also I checked /usr/pbi/ and I got .hashdir, share, squidguard-squid3-i386, ect, and squid-i386, in etc there isn't anything from sarg.

    I need help to get the reports please.

    Sarg: 2.3.6_2 pkg v0.6.9
    squid: 2.7.9 pkg v.4.3.4



  • "Warning: symlink(): No such file or directory in /usr/local/pkg/sarg.inc on line 97 "

    Your symlink is pointing to the wrong location. Delete it and remake it.



  • When I installed SARG a few weeks ago I had a problem with the reports that didn`t show up.

    The following provided instructions of KOM:

    rm -r /usr/local/sarg-reports
        ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports

    helped and everything was working as expected afterwards.

    Unfortunately a couple of days ago a new package update of SARG was available and I reinstalled the package with the update.
    Since then the problem with the SARG reports is back and it says:

    "Error: Could not find report index file. Check and save Sarg settings and try to force Sarg schedule."

    I checked the file structure and the link "/usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports" still exists.

    Is there a solution without deleting existing reports in the folder??



  • Doktornotor may have fixed that package to remove the need for the manual symlink.  I would completely uninstall the package, remove the symlink and then install it again.  You may have to manually clean up old traces of Sarg.


Log in to reply