Sarg Not Showing Reports
-
Hello, all!
I have run into a bit of a problem getting Sarg running… Squid is installed and running properly, including logging. Sarg is installed and set to check Squid's logs.
I tried running:
export LC_ALL=C && sarg -x…and the following is the output:
SARG: Init SARG: Loading configuration from /usr/local/etc/sarg/sarg.conf SARG: Loading exclude host file from: /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf SARG: Loading exclude file from: /usr/pbi/sarg-i386/etc/sarg/exclude_users.conf SARG: Reading host alias file "/usr/pbi/sarg-i386/etc/sarg/hostalias" SARG: List of host names to alias: SARG: Parameters: SARG: Hostname or IP address (-a) = SARG: Useragent log (-b) = SARG: Exclude file (-c) = /usr/pbi/sarg-i386/etc/sarg/exclude_hosts.conf SARG: Date from-until (-d) = SARG: Email address to send reports (-e) = SARG: Config file (-f) = /usr/local/etc/sarg/sarg.conf SARG: Date format (-g) = USA (mm/dd/yyyy) SARG: IP report (-i) = No SARG: Keep temporary files (-k) = No SARG: Input log (-l) = /var/squid/logs/access.log SARG: Resolve IP Address (-n) = No SARG: Output dir (-o) = /usr/local/sarg-reports/ SARG: Use Ip Address instead of userid (-p) = No SARG: Accessed site (-s) = SARG: Time (-t) = SARG: User (-u) = SARG: Temporary dir (-w) = /tmp/sarg SARG: Debug messages (-x) = Yes SARG: Process messages (-z) = No SARG: Previous reports to keep (--lastlog) = 0 SARG: SARG: sarg version: 2.3.9 Sep-21-2014 SARG: Reading access log file: /var/squid/logs/access.log SARG: Records in file: 221, reading: 0.00% SARG: Records read: 221, written: 221, excluded: 0 SARG: Squid log format SARG: Period: 2015 Mar 24 SARG: File /usr/local/sarg-reports/2015Mar24-2015Mar24 already exists, moved to /usr/local/sarg-reports/2015Mar24-2015Mar24.10 SARG: Sorting log /tmp/sarg/192_168_2_106.user_unsort SARG: Making file: /tmp/sarg/192_168_2_106 SARG: Sorting log /tmp/sarg/192_168_2_113.user_unsort SARG: Making file: /tmp/sarg/192_168_2_113 SARG: Sorting log /tmp/sarg/192_168_21_112.user_unsort SARG: Making file: /tmp/sarg/192_168_21_112 SARG: Sorting log /tmp/sarg/192_168_2_20.user_unsort SARG: Making file: /tmp/sarg/192_168_2_20 SARG: Sorting log /tmp/sarg/192_168_21_245.user_unsort SARG: Making file: /tmp/sarg/192_168_21_245 SARG: Sorting log /tmp/sarg/192_168_2_30.user_unsort SARG: Making file: /tmp/sarg/192_168_2_30 SARG: Sorting log /tmp/sarg/192_168_21_103.user_unsort SARG: Making file: /tmp/sarg/192_168_21_103 SARG: Sorting log /tmp/sarg/192_168_2_116.user_unsort SARG: Making file: /tmp/sarg/192_168_2_116 SARG: Sorting log /tmp/sarg/192_168_2_187.user_unsort SARG: Making file: /tmp/sarg/192_168_2_187 SARG: Sorting log /tmp/sarg/192_168_2_10.user_unsort SARG: Making file: /tmp/sarg/192_168_2_10 SARG: Sorting log /tmp/sarg/192_168_2_114.user_unsort SARG: Making file: /tmp/sarg/192_168_2_114 SARG: Sorting file: /tmp/sarg/192_168_2_106.utmp SARG: Making report: 192.168.2.106 SARG: Sorting file: /tmp/sarg/192_168_2_113.utmp SARG: Making report: 192.168.2.113 SARG: Sorting file: /tmp/sarg/192_168_21_112.utmp SARG: Making report: 192.168.21.112 SARG: Sorting file: /tmp/sarg/192_168_2_20.utmp SARG: Making report: 192.168.2.20 SARG: Sorting file: /tmp/sarg/192_168_21_245.utmp SARG: Making report: 192.168.21.245 SARG: Sorting file: /tmp/sarg/192_168_2_30.utmp SARG: Making report: 192.168.2.30 SARG: Sorting file: /tmp/sarg/192_168_21_103.utmp SARG: Making report: 192.168.21.103 SARG: Sorting file: /tmp/sarg/192_168_2_116.utmp SARG: Making report: 192.168.2.116 SARG: Sorting file: /tmp/sarg/192_168_2_187.utmp SARG: Making report: 192.168.2.187 SARG: Sorting file: /tmp/sarg/192_168_2_10.utmp SARG: Making report: 192.168.2.10 SARG: Sorting file: /tmp/sarg/192_168_2_114.utmp SARG: Making report: 192.168.2.114 SARG: Making index.html SARG: Successful report generated on /usr/local/sarg-reports/2015Mar24-2015Mar24 SARG: Purging temporary file sarg-general SARG: End SARG: Records in file: 221, reading: 100.00%So, it IS creating the reports… And even more strangely, it's even seeing past reports (judging by the line "SARG: File /usr/local/sarg-reports/2015Mar24-2015Mar24 already exists, moved to /usr/local/sarg-reports/2015Mar24-2015Mar24.10"... The last number ("10" in this case) even increments every time I run it). However, when I browse to /usr/local/sarg-reports it shows it as empty. And, when I got to the "View Report" tab in Sarg, it shows it as empty.
Traffic is passing through Squid, and is being logged in /var/squid/logs/access.log just fine.
Any thoughts? I've tried setting
Thanks!
ElectroPulse
-
Sarg is picky about the reports you select and the options you use.
Here is what I use and it seems to work for me:
-
@KOM:
Sarg is picky about the reports you select and the options you use.
Here is what I use and it seems to work for me:
Thank you for the reply!
Tried those settings, didn't work unfortunately… I have Sarg set up EXACTLY how I have it on another pfSense server, and it still doesn't work. I've compared all the settings side-by-side, and it's not wanting to work.
The thing that's strange to me is that according to the above posted diagnostic messages, it is indicating that reports are indeed being generated and being seen by Sarg when it generates new reports (thus why it is incrementing the report number), but the reports folder is blank.
Any ideas?
-
Are you running 2.1.x or 2.2? Sarg under 2.1.x had an issue with a quick fix:
rm -r /usr/local/sarg-reports ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reportsSubstitute sarg-i386 for sarg-amd64 if you have the 32-bit build.
If you're running 2.2 then I don't know.
-
@KOM:
Are you running 2.1.x or 2.2? Sarg under 2.1.x had an issue with a quick fix:
rm -r /usr/local/sarg-reports ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reportsSubstitute sarg-i386 for sarg-amd64 if you have the 32-bit build.
If you're running 2.2 then I don't know.
Ah, I neglected to give that info.
No, we're running 2.2… Any idea whether that might work on 2.2? I'll give it a try in just a little bit.
EDIT: Hey! That worked! I didn't realize that the folder it looks in is a softlink to another location... I browsed to where the files are actually located, and there they were. I ran the commands you gave me to re-create the softlink, and voila, it worked! Thanks a bunch :)
-
From what I understand, this fix shouldn't have worked under 2.2 since the package was corrected weeks ago. Perhaps it's broken again
-
@KOM:
From what I understand, this fix shouldn't have worked under 2.2 since the package was corrected weeks ago. Perhaps it's broken again
Hmm… It's been a little while, so I don't remember whether the upgrade to 2.2 was an upgrade or a clean install with a restore from backup on this campus. If it was an upgrade, I wonder if it could have brought that over from the previous version. I don't know whether Sarg re-creates all folders and softlinks on package reinstall. I just know something wonky was going on with that softlink (the report-generating part of Sarg could see the files that had been created previously, but the report-showing part couldn't see them, nor could I when browsing to it), until I used those commands to delete and re-create it.
-
There were warnings from ESF people about using these manual hacks and how they could potentially cause problems down the line. Perhaps this is one of those instances.
-
Just ran into this exact problem once again… But this time, it was on a completely clean 2.2.2 install (except for restoring Captive Portal settings from a backup).
The only thing I can think of that I did non-standard, was installing Sarg via the CLI (using "pfSsh.php playback installpkg Sarg"). After running into the problem and immediately recognizing it, I uninstalled it and re-installed it through the gui... Still had to use the manual workaround.
EDIT 05/25/15: Just ran into the issue again, when restoring the config and letting pfSense automatically re-install the packages, so doesn't look like it's related to the package install method.
-
Had the same issue today on a fresh install of 2.2.3 running Sarg 0.6.4. Fix above corrected this problem.
-
@KOM:
Are you running 2.1.x or 2.2? Sarg under 2.1.x had an issue with a quick fix:
rm -r /usr/local/sarg-reports ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reportsSubstitute sarg-i386 for sarg-amd64 if you have the 32-bit build.
If you're running 2.2 then I don't know.
Had problems running Sarg 0.6.4 on 2.2.3-RELEASE (amd64). Workaround above worked a treat.
-
Hello all,
I have implemented the link and Sarg can see almost everything. But, when I get to the final level (the actual reports) I get the same message about not finding the index file.
In the 'month' directory I have a heap of directories with names like 30-31.1 30-31.2 all the way to 30-31.24.
It looks to me like I have a directory for each hour or so for every day. So when Sarg looks for a directory for the day (30-31), it can't find it.
Have I set something wrong with the limit settings? Or logging in Squid? ::)
To put it another way, if I use my browser to look in the 30-31.1 directory, I get reports. So it is working fine. It is just that I go to Status>Sarg Reports>ViewReport>year 2015>month August and I get 24 buttons each for 2015 August 30-31 and they all point to x.x.x.x/sarg_frame.php?prevent=179902248&file=/2015/08/30-31/index.html
It should be file=/2015/08/30-31.1/index.html or I should have less directories for day 30-31.
Forgot to say. I am running 2.2.4-release(i386) and Sarg 0.6.4
-
My only guess is if you're seeing decimalized / incremental daily folders it's probably due to an hourly schedule?
Maybe if you have at least 1 hourly schedule you must also have a daily schedule for any schedules based on higher timeframes to function so it also has whole-number day folders to work with.
Or just don't use hourly schedules ever and avoid the issue.
Just guessing.
-
Hi,
I'm new using pfSense and i want to get reports, so I installed Sarg but I have troubles.
I can't get any report, neither with schedule or realtime.
When I try to force the report on schedule tab I get this warning message. Warning: symlink(): No such file or directory in /usr/local/pkg/sarg.inc on line 97Then I checked the files on the console. In /usr/local/ there are bin, captiveportal, etc, include, info, lib, libdata, libexec, man, openssi, phg, sbin, share, tests and www, in pkg there isn't any file from sarg. Also I checked /usr/pbi/ and I got .hashdir, share, squidguard-squid3-i386, ect, and squid-i386, in etc there isn't anything from sarg.
I need help to get the reports please.
Sarg: 2.3.6_2 pkg v0.6.9
squid: 2.7.9 pkg v.4.3.4
-
"Warning: symlink(): No such file or directory in /usr/local/pkg/sarg.inc on line 97 "
Your symlink is pointing to the wrong location. Delete it and remake it.
-
When I installed SARG a few weeks ago I had a problem with the reports that didn`t show up.
The following provided instructions of KOM:
rm -r /usr/local/sarg-reports
ln -s /usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reportshelped and everything was working as expected afterwards.
Unfortunately a couple of days ago a new package update of SARG was available and I reinstalled the package with the update.
Since then the problem with the SARG reports is back and it says:"Error: Could not find report index file. Check and save Sarg settings and try to force Sarg schedule."
I checked the file structure and the link "/usr/pbi/sarg-amd64/local/sarg-reports /usr/local/sarg-reports" still exists.
Is there a solution without deleting existing reports in the folder??
-
Doktornotor may have fixed that package to remove the need for the manual symlink. I would completely uninstall the package, remove the symlink and then install it again. You may have to manually clean up old traces of Sarg.
