Sarg Reports Showing up Blank

[tacfit]

Hi,

We are attempting to run sarg reports using squid on pfsense 2.2.4-RELEASE (i386) and get completely blank reports.

The squid package we have installed is 2.7.9 pkg v.4.3.6 and the sarg package is 0.6.4 which we installed using the gui package manager.

The install and configuration went without errors but clicking on the View Report tab initially yielded "Error: Could not find report index file."

Applying this fix http://rob-the.geek.nz/archives/howto/pfsense-sarg-reports-not-showing
took care of that allowing reports to be generated on schedule. We can now see the list of reports (generated hourly) along with a summary with number of users and data usage for each report on the main page.  The only problem now is that the reports are completely empty. (see screenshots) Clicking on a reports generates a table with headings and absolutely nothing under it.

Real Time data is showing up perfectly.

Squid is setup as a transparent proxy and appears to be working perfectly. Logs are being generated as expected and where specified.

In Sarg:
Proxy server is set to squid
"Report settings" are set to default values
Limit values are all set to unlimited except "Reports days limits" which is set to 14 days
"Exclude" settings are all left blank
"Users" settings are left to default values
A schedule is setup and enabled to run every hour

Is there something obvious I've missed?

Thanks in advance!

[alear]

Are you running Dansguardian? If so then you need to set the proxy server in sarg reports to Dansguardian. Sarg pulls the reports from here using the fix you listed above. This is my config and it runs without any errors. If you are using squidgaurd then set it to squidgaurd. After you configure it force a report update and you should see the info you seek.

[tacfit]

No, we aren't using Dansguardian or Squidguard.  Just Squid. Sorry, I'm not sure based on your wording what you mean to say. Does the fix I listed only apply to Dansguardian?

[alear]

No that fix applies to Sarg finding the right directory to generate and fetch reports correctly from what I have read. The only reason I asked about Dansguardian is because if you are using it there is some additional configuration. Could you take a look at this file and tell me what you see? Specifically where it asks where the access log is.

/usr/pbi/sarg-amd64/local/etc/sarg/sarg.conf

You should see /var/squid/logs/access.log if so then you should be pulling the info. Can you navigate to the directory and view the file from the command line?

If all of this is configured like so then try running without transparent proxy.

My config is using Dansgaurdian. Squid is transparent with NAT redirecting all proxy requests to Dansgaurdian. That is how Sarg pulls my reports. I tried a quick setup to run your config on my machine without success but I have not tried without transparent proxy. If all else fails review your squid and sarg config files. Also be sure your are on the latest version of PF.

[dwarus]

I was able to get the reports running using the following procedure.

1. Start a console/terminal session as root. (I used the shell selection from the serial port.)

2. rm -Rf /usr/pbi/sarg-amd64/local/sarg-reports/

3. Edit: /usr/local/www/sarg_frame.php

3a. Find: $dir="/usr/local/sarg-reports"

3b. Change to:  $dir="/usr/pbi/sarg-amd64/local/sarg-reports"

4. From the web interface, go to Status, sarg Reports, Schedule tab, a report, and click on Force Update Now. After this, I am able to see all of the report information. (It would be a nice option to state whether the access on the report were accepted of denied.)

*  *  *

It appears that the 64-bit version of sarg has some of it's directories mixed up with the 32-bit version. Here are two places where the 64-bit installation appears to be referencing 32-bit directories.

1. /usr/pbi/sarg-amd64/local/etc/sarg/sarg.conf has "output_dir" set to "/usr/local/sarg-reports/" while the reports are actually generated to /usr/pbi/sarg-amd64/local/sarg-reports/. Changing the output_dir does not appear to have an effect. If it is changed, it appears to be reset if you change configuration information from the web interface.

2. The /usr/local/www/sarg_frame.php has the html reports directory hard coded incorrectly as $dir="/usr/local/sarg-reports"

*  *  *

I don't think this has anything to do with the report problems, but I have squid set with the Custom Option "cache deny all" from the web interface Services, Proxy Server, General tab. The test system has only the squid and sarg optional packages installed.

*  *  *

Can anyone tell me whether these issues should be directed to pfSense or the Sarg sourceforge page?

Dale W.