Topic: SARG for SME 7 how to!

[janben]

Need some HELP, getting SARG to work! have all ready installed smeserver-sarg-1.4.1-3.i386.rpm. the sarg function apears in console, but can not view daily, weekly templates! Need some help from new guy to linux.

[byte]

Have you logged into the server-manager and looked for the SARG Report panel?

[psoren]

Have you logged into the server-manager and looked for the SARG Report panel?

And did you wait for it to actually generate a report........

Per

[cool34000]

I have the same problem...
SARG panel is there but when I try to get some report, it says pages not found. All links send me to the 404 error...

[byte]

Did you wait for it to report as per psoren post?

[cool34000]

Yes, i waited... Not longer than a 'one install shot' should wait... Trying different package and so i have to reinstall very frequently ! Hoppefully i've got mondo  

I think DansGuardian may be faulty...
I explain : my sme server is running in server-only mode and DansGuardian rpms are installed (not in transparent mode).
Parameters of the proxy are forced by local policies (w2k3 domain controller) to all workstations. So, i don't have to force the proxy to be transparent cause my parameters are unchangable...
Maybe DansGuardian don't permit the 1st proxy (the one on port 3128) to cache when it passes through...

[raem]

cool34000

Your workstations must access squid via port 8080 for Dansguardian filtering to work. If they access port 3128 then there will be no filtering.
You should set the
squid TransparentPort 8080
setting on your sme server, and then configure your workstations to either auto detect or use port 8080, which will be enforced by your local policies.

[cool34000]

Thx for replynig RayMitchell...

My workstations actually contact proxy on port 8080 (not 3128, it could be done, but why should i ? I will not have content filtering, just web cache !

Proxy can't be auto discovered because my SME Server is not my gateway... It can't intercept traffic and workstations just connect with no proxy at all...

The big advantage of setting proxy by policy is that anyone who is registered on my w2k3 server cannot even try to bypass the proxy (on disabling proxy or setting it to 3128 to bypass content filtering) : settings cannot be modified !

i did everything in this topic exept forcing it to be transparent because i was issuing some mistakes with the cache (not refreshing sometimes, a reboot is the only way to get internet back...)

I had the same issue with Endian Firewall, witch has by the way a wonderful interface to set dansguardian parameters
Maybe that's because my test server is old (P2Pro 433MHz + 256Mo SDRAM ECC) Maybe i need more power ?

[raem]

cool34000

> I think DansGuardian may be faulty...

You don't really say what your problem is, specifically.

[cool34000]

My problem is to make SARG working !!!
The web panel is working fine, the graphs inside don't work (i get a 'page not found' when trying to)

I've tested all links in the panel, none of them works :
ONE-SHOT => 404 error page
daily  => 404 error page
weekly => 404 error page
monthly => 404 error page
generated by sarg => even this link causes a 404 error page !!!


My proxy is now transparent on port 8080 and still, after 30min I don't have any graphs... Only the 404 error page => not found  

I feel that dansguardian could be responsible because he's using squid... And SARG reports squid ? So it could have a link...
I don't have any better idea of the source of my problem, so i'm thinking at loud... Trying to get my ass out of this problem !

What else should help you ?


[EDIT]
If i use firefox rather than ie, i get this error when trying ONESHOT :
Not Found
The requested URL /squid/ONE-SHOT/index.html was not found on this server.

[Tib]

I have Sarg as well as Danguardian loaded and all works no probs ... and my test server is server only mode.

I also have Sarg as well as Dansguardian loaded at home on a server/gateway and all works fine as well.

Regards,

Tib

[mmccarn]

Quick sarg configuration check, to make sure you have the right files in the right places:

Make sure sarg is pointed to /var/www/sarg, not /var/www/html/sarg
# grep sarg /etc/httpd/conf/httpd.conf
Alias /squid /var/www/sarg
<Directory /var/www/sarg>

Make sure your daily, weekly & monthly scripts exist
# du -a /etc/cron.* | grep sarg
4       /etc/cron.daily/sarg
4       /etc/cron.monthly/sarg
4       /etc/cron.weekly/sarg

Do a reality check on one of the scripts - where does it get "sarg"? where does the output go?
# cat /etc/cron.daily/sarg
#!/bin/bash

#Generate Access.log for correct weekly reports
gunzip -c /var/log/squid/access.log.1.gz > /var/log/squid/access.log.daily > /dev/null 2>&1
cat /var/log/squid/access.log >> /var/log/squid/access.log.daily

/usr/bin/sarg -l /var/log/squid/access.log.daily -o /var/www/sarg/daily -d "$(date --date "1 day ago" +%d/%m/%Y)" > /dev/null 2>&1

exit 0

Check that sarg is in /usr/bin, and find out what version it is
# /usr/bin/sarg -h
/usr/bin/sarg: Usage [options...]
     -a Hostname or IP address
     -b Useragent log
     -c Exclude file
     -d Date from-until dd/mm/yyyy-dd/mm/yyyy
     -e Email address to send reports (stdout for console)
     -f Config file (/etc/sarg/sarg.conf)
     -g Date format [e=Europe -> dd/mm/yy, u=USA -> mm/dd/yy]
     -h Help (this...)
     -i Reports by user and IP address
     -l Input log
     -n Resolve IP Address
     -o Output dir
     -p Use Ip Address instead of userid (reports)
     -s Accessed site [Eg. www.microsoft.com, www.netscape.com]
     -t Time [HH, HH:MM, HH:MM:SS]
     -u User
     -w Temporary dir
     -x Process messages
     -z Debug messages
     -convert Convert the access.log file to a legible date
     -split Split the log file by date in -d parameter

        sarg-1.4.1 25Apr2003 by Pedro Lineu Orso - orso@brturbo.com
        http://web.onda.com.br/orso/index.html

Check your sarg output folder structure
# du /var/www/sarg
2548    /var/www/sarg/daily/2006Aug21-2006Aug21
2556    /var/www/sarg/daily
4       /var/www/sarg/monthly
4       /var/www/sarg/ONE-SHOT
4       /var/www/sarg/weekly
2576    /var/www/sarg

Run the daily script.  You should get NO output on the screen
# /etc/cron.daily/sarg
#

[cool34000]

Thanks trying to help me... I really need more pratice on the shell...

# du /var/www/sarg

4       /var/www/sarg/weekly
4       /var/www/sarg/ONE-SHOT
4       /var/www/sarg/monthly
4       /var/www/sarg/daily
24      /var/www/sarg
=> Some stuffs missing !!! Of course...

cat /etc/cron.daily/sarg

=> sme as yours : sarg-1.4.1 25Apr2003

# cat /etc/cron.daily/sarg

#!/bin/bash

#Generate Access.log for correct weekly reports
gunzip -c /var/log/squid/access.log.1.gz > /var/log/squid/access.log.daily > /dev/null 2>&1
cat /var/log/squid/access.log >> /var/log/squid/access.log.daily

/usr/bin/sarg -l /var/log/squid/access.log.daily -o /var/www/sarg/daily -d "$(date --date "1 day ago" +%d/%m/%Y)" > /dev/null 2>&1

exit 0
=> Seems to be ok

# du -a /etc/cron.* | grep sarg

=> The 3 files are here, no pb here.

# grep sarg /etc/httpd/conf/httpd.conf

=> return nothing to me... Here's the trouble !
How can I fix this ? Do I have to create a template myself ? Or get file somewhere ?


I also manually started the script, nothing changed...



By the way, how do you guys search for files in Linux ?
In m$, i used to do  c:\>dir m*.* /s to search for all files beginning by "m" in the whole hard drive... Saw that the dir or ls command can't do recursive search of files in subdirectories... There must be a way !
I hate being noob

[Tib]

cool34000

To look for files in linux I just use "locate" in putty.

Just type ... locate "then file name"

There are probably other comands as well.

Regards,

Tib

[cool34000]

Don't know if there are other way to shearch for files, but this one works very well for me... Thank you so much Tib !


For the missing lines in httpd.conf, how do I fix it ? Someone ?