Install and Configure SARG for Dansguardian on CentOS
Install and Configure SARG to report against Dansguardian log files on CentOS
Go back to the main project page
By this point, you should already have DansGuardian and Squid cache installed, configured, and tested. If not, please visit the Open Source Web Content Filtering Project page to finish that part of the setup.
There is other settings I’m looking into with regards to DansGuardian. This is just a rough way to get SARG up and reporting.
Install Apache
* yum install httpd – install Apache if not already installed
Add ports to firewall
* You may need to add a firewall rule to allow port 80
* vi /etc/sysconfig/iptables – add the following lines, if they don’t already exist
* -A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPTInstall SARG
* cd /usr/src – optional, this is just where I like to keep the source archives
* wget http://dag.wieers.com/rpm/packages/sarg/sarg-2.2.1-1.el4.rf.i386.rpm – download the SARG rpm to your /usr/src folder
* yum install gd gd-devel
* rpm -i /usr/src/sarg-2.2.1-1.el4.rf.i386.rpm – install SARG using the Red Hat Package manager
* vi /etc/httpd/conf.d/sarg.conf* add an additional Allow from line for each computer you want to be able to see the reports, or comment out the Deny from all, and Allow from lines to give access to all.
Configure DansGuardian and SARG to work with each other
* vi /etc/dansguardian/dansguardian.conf
* change the setting logfileformat to equal 3 – sets DansGuardian to log in squid log file format
* :wq – save the changes to the file and quit* vi /etc/sarg/sarg.conf
* change the setting access_log to point to your dansguardian logs. Under default settings, it should be /var/log/dansguardian/access.log
* change any other settings you want to change
* :wq – save the changes to the file and quit* Check the sarg scripts in the cron folders. You will need to make some changes to point to the DansGuardian log files
* vi /etc/cron.daily/sarg – really no changes here
* vi /etc/cron.weekly/sarg – change the log file paths to the path of your DansGuardian log files
* vi /etc/cron.monthly/sarg – change the log file paths to the path of your DansGuardian log files* /usr/bin/sarg – run sarg to create a ONE-SHOT report
Start Apache
* /etc/init.d/httpd start – Start Apache
Test Configuration
* browse to your DansGuardian machine using your favorite internet browser. You will have to add /sarg to the end of the url. (ex. http://192.168.0.1/sarg Check to make sure the ONE-SHOT report was generated.
* wait for the cron jobs to run and generate the rest of the reports
Done
I ain't that super..... 
i followed your config but i got this error
[root@localhost /]# /usr/bin/sarg
SARG: Records in file: 0, reading: 100.00%
SARG: No records found
SARG: End
[root@localhost /]#
i went to localhost/sarg and i manage to see the html page but when i click on the one-short report it says
Not Found
The requested URL /sarg/ONE-SHOT/index.html was not found on this server.
Apache/2.2.3 (Red Hat) Server at localhost Port 80.
how do i fix this. i man running dansguardian + squid at the same time. i realize that other people is putting their access_log as access_log /var/log/squid/access.log/ but anyway do i need to point the apache to listen to port 8080 instead? i redirect port 80 to 8080.
i went to localhost/sarg and i manage to see the html page but when i click on the one-short and daily report it says
Not Found
The requested URL /sarg/ONE-SHOT/index.html was not found on this server.
Apache/2.2.3 (Red Hat) Server at localhost Port 80.
but when i click weekly and monthly its working properly
Please kindly repeat the tutorial once, i had problem that too…now it’s working well
it’s not working for me either, but i get a different error.
i am running squid / dansguardian / sarg / webmin on ubuntu, and I have the sarg webmin module–i want to monitor my logs from webmin using sarg. each one of the four programs is working fine by itself. going through the proxy, squid is working, dansguardian is working. webmin works too.
but… i had a couple problems following the above tutorial. first off, obviously i’m on debian so it’s a little different. i used apt-get to install everything except the webmin module which i did through the webmin module configuration page. i pointed to the dansguardian log file, and i changed the dansguardian log file format to squid form. I pointed sarg to the dansguardian log file, but in the weekly.cron and monthly.cron there is no mention of a specific log file so i didn’t make any changes.
when i run sarg through webmin, i click on “generate report now” and i get the following error:
Now generating Sarg report from Squid log file /var/log/dansguardian/access.log and all rotated versions ..
sarg -l /var/log/dansguardian/access.log.1
.. Sarg failed! See the output above for details.
previously, i had sarg pointed at the squid access.log instead of the dansguardian log and it worked fine but the problem is that, with dansguardian working, every user ip address was localhost (127.0.0.1), so i couldn’t keep track of who was looking at what. i want the web history to be categorized by user’s ip. before dansguardian was working i also analyzed with sarg and it would categorize all of the users by ip address which was very useful.
another question i have is how do you analyze the logs of people who got rejected for attempting to visit sites they’re not allowed to visit? apparently even when you get “access denied” your visit gets logged by dansguardian and squid–i was testing squid using sex.com and porn.com and i saw those visits logged.
Dear
i am getting this error
‘SARG: Cannot open config file: /etc/sarg.conf – No such file or directory’
whenever i try to run command to generate report ” /usr/bin/sarg’
have you installed it correctly, it supposed to be there, repeat the step or maybe you may try “lightsquid”, it’s lighter and easier to configure :)