pfSense Support Subscription

Author Topic: Sarg package for pfsense  (Read 82559 times)

0 Members and 1 Guest are viewing this topic.

Offline Fesoj

  • Full Member
  • ***
  • Posts: 207
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #210 on: July 26, 2012, 04:37:11 pm »
Quote
Did you selected "Generate the main index.html" option on gui?

No, I didn't. Now that I did it, it is working.

Thanx.

Offline AudiAddict

  • Full Member
  • ***
  • Posts: 195
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #211 on: July 30, 2012, 08:34:03 am »
Can somebody explain if I need to set up log rotation in the schedule or not? And how this works?

I have it set to default ( do nothing) in SAR and have my squid settings set to 186 days log rotation (aprox 6 months).

Do I need to use the log rotation of SARG as wel? What does it do exactly? Clean up my old logs?


« Last Edit: July 30, 2012, 08:52:00 am by AudiAddict »

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9983
  • Karma: +1/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #212 on: July 30, 2012, 10:22:01 am »
Do I need to use the log rotation of SARG as wel?
No, just one log rotate is fine.


What does it do exactly? Clean up my old logs?
Rotate logs and keep last 10 rotated files.(access.log.0 access.log.1 access.log.2...)


att,
Marcello Coutinho

Offline AudiAddict

  • Full Member
  • ***
  • Posts: 195
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #213 on: July 30, 2012, 11:01:34 am »
Thanks for your reply.

Does it mean that it reads through the whole file everytime? So If I have it set to rotate in squid settings every 6 months will this cause it to be slow at generating the report?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9983
  • Karma: +1/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #214 on: July 30, 2012, 12:43:45 pm »
Thanks for your reply.

Does it mean that it reads through the whole file everytime? So If I have it set to rotate in squid settings every 6 months will this cause it to be slow at generating the report?

Yes, you can use date arg in schedules, but sarg will read all file the same way looking for logs on that date range.

Offline AudiAddict

  • Full Member
  • ***
  • Posts: 195
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #215 on: July 30, 2012, 12:51:35 pm »
If I change the rotation to 1 month in squid settings? Will it "save" my old logs in SARG? So I can view the internet logs older than one month?

So.. if I set squid to rotate every 30 days, does SARG delete the old data? Or does it display the old logs (from the last months) even though they have been rotated? (renamed?)

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9983
  • Karma: +1/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #216 on: July 30, 2012, 01:09:56 pm »
If I change the rotation to 1 month in squid settings? Will it "save" my old logs in SARG? So I can view the internet logs older than one month?
yes

So.. if I set squid to rotate every 30 days, does SARG delete the old data? Or does it display the old logs (from the last months) even though they have been rotated? (renamed?)
no

Offline AudiAddict

  • Full Member
  • ***
  • Posts: 195
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #217 on: July 30, 2012, 01:29:40 pm »
Maybe a language barrier here.. but do you mean yes I can still view the older internet proxy logs (older than 30 days) in SARG even though I set it to rotate every 30 days in Squid?


Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9983
  • Karma: +1/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #218 on: July 30, 2012, 01:33:12 pm »
Maybe a language barrier here.. but do you mean yes I can still view the older internet proxy logs (older than 30 days) in SARG even though I set it to rotate every 30 days in Squid?

yes, you can. Sarg create html static reports on /usr/local/sarg-reports.

If you delete your squid logs, reports will be there.
if you run sarg after rotating logs, old reports will not be deleted.

Offline Lectrician

  • Full Member
  • ***
  • Posts: 125
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #219 on: August 04, 2012, 02:48:29 am »
Hi.

I am struggling to get Sarg to work for me with Squid.

I initially created some reports, and they showed many users, everything seemed fine.

Now, if I click to create logs on the schedule (force), using a wide date range, I get just one user in the report?  I know there is more activity than that!

I tried to delete sarg (and used file manager to delete sarg folders I could see), reinstalled (it seemed to still remember my settings), but now I just get:

Error: Could not find report index file.
Check and save sarg settings and try to force sarg schedule.

when I try to view reports (after trying to force them again).  There are loads of log files in the squid log folder.

I set the schedule to 1d, rotate and restart, but it never seemed to create a report when I looked, only when I forced it?

What am I doing wrong?

Thanks  :)

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9983
  • Karma: +1/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #220 on: August 04, 2012, 08:48:40 pm »

Offline Lectrician

  • Full Member
  • ***
  • Posts: 125
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #221 on: August 07, 2012, 01:03:08 am »
Thanks.

My setup is similar to your screen shot, except I turn userid into IP address.  I have changed the config and resaved, but it still will not work correctly.

I managed to get it to create a single report, but the report shows 0 users and has nothing in it.

I then left it a few days and tried to create a new report in the same way but nothing appears on the report page?

Is it possible to remove the package completely and re-install?  When I tried that, when reinstalling, it knew all my settings from the last time, so obviously did not fully uninstall?  What files would I need to delete to have a completely clean re-install?

When you select "restart proxy" on the schedule, does this clear the squid logs?

Should the schedule run every day if I enter 1d?  When during the day would it?

Really struggling to get this going!

Cheers.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9983
  • Karma: +1/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #222 on: August 07, 2012, 09:57:52 am »
Is it possible to remove the package completely and re-install?  When I tried that, when reinstalling, it knew all my settings from the last time, so obviously did not fully uninstall?  What files would I need to delete to have a completely clean re-install?
There is no file to delete, all sarg settings stays on pfsense xml file.

When you select "restart proxy" on the schedule, does this clear the squid logs?
No, just a restart.

Should the schedule run every day if I enter 1d?  When during the day would it?
It runs at 00:00 via cron job. You can install cron package to see it.

Offline Lectrician

  • Full Member
  • ***
  • Posts: 125
  • Karma: +0/-0
    • View Profile
Re: Sarg package for pfsense
« Reply #223 on: August 09, 2012, 08:19:16 am »
Thanks.

I can see it in Cron.

I am able to run the schedule fanualy (force button) and the reports do now create for the day, but the schedule is not working?

I have it set to do a report for the day each day.

Where do I look to see why it wont run on the schedule?

Thanks.






Offline chowtamah

  • Jr. Member
  • **
  • Posts: 54
  • Karma: +0/-0
    • View Profile
    • my Information
Re: Sarg package for pfsense
« Reply #224 on: August 09, 2012, 10:41:36 pm »
Hi,

My Sarg settings also same. Schedule is 1d, but was not working. Then installed the Cron package and edited the cron job,

59     23     *     *     *     root     /usr/local/bin/php /usr/local/www/sarg.php 0

Now, I am getting the report.
2.0.2-RELEASE (amd64)
built on Fri Dec 7 22:39:43 EST 2012

Always trying to learn!!