{"id":11696,"date":"2019-03-15T22:35:15","date_gmt":"2019-03-15T22:35:15","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=11696"},"modified":"2019-03-15T22:35:15","modified_gmt":"2019-03-15T22:35:15","slug":"sarg-squid-analysis-report-generator-and-internet-bandwidth-monitoring-tool","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/03\/15\/sarg-squid-analysis-report-generator-and-internet-bandwidth-monitoring-tool\/","title":{"rendered":"SARG \u2013 Squid Analysis Report Generator and Internet Bandwidth Monitoring Tool"},"content":{"rendered":"

SARG<\/strong>\u00a0is an open source tool that allows you to analyse the squid log files and generates beautiful reports in\u00a0HTML<\/strong>\u00a0format with informations about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and monthly reports.<\/p>\n

The\u00a0SARG<\/strong>\u00a0is very handy tool to view how much internet bandwidth is utilized by individual machines on the network and can watch on which websites the network\u2019s users are accessing.<\/p>\n

\n

\"Install<\/a><\/p>\n

Install Sarg Squid Log Analyzer in Linux<\/p>\n<\/div>\n

In this article I will guide you on how to install and configure\u00a0SARG<\/strong>\u00a0\u2013\u00a0Squid Analysis Report Generator<\/strong>\u00a0on\u00a0RHEL<\/strong>\/CentOS<\/strong>\/Fedora<\/strong>\u00a0and\u00a0Debian<\/strong>\/Ubuntu<\/strong>\/Linux Mint<\/strong>\u00a0systems.<\/p>\n

Installing Sarg \u2013 Squid Log Analyzer in Linux<\/h3>\n

I assume that you already installed, configured and tested\u00a0Squid<\/strong>\u00a0server as a transparent proxy and\u00a0DNS<\/strong>\u00a0for the name resolution in caching mode. If not, please install and configure them first before moving further installation of\u00a0Sarg<\/strong>.<\/p>\n

Important:<\/strong>\u00a0Please remember without the\u00a0Squid<\/strong>\u00a0and\u00a0DNS<\/strong>\u00a0setup, no use of installing sarg on the system it will won\u2019t work at all. So, it\u2019s a request to install them first before proceeding further to\u00a0Sarg<\/strong>\u00a0installation.<\/p>\n

Follow these guides to install DNS and Squid in your Linux systems:<\/p>\n

Install Cache-Only DNS Server<\/h5>\n
    \n
  1. Install Cache Only DSN Server in RHEL\/CentOS 7<\/a><\/li>\n
  2. Install Cache Only DSN Server in RHEL\/CentOS 6<\/a><\/li>\n
  3. Install Cache Only DSN Server in Ubuntu and Debian<\/a><\/li>\n<\/ol>\n
    Install Squid as Transparent Proxy<\/h5>\n
      \n
    1. Setting Up Squid Transparent Proxy in Ubuntu and Debian<\/a><\/li>\n
    2. Install Squid Cache Server on RHEL and CentOS<\/a><\/li>\n<\/ol>\n

      Step 1: Installing Sarg from Source<\/h4>\n

      The \u2018sarg<\/strong>\u2018 package by default not included in\u00a0RedHat<\/strong>\u00a0based distributions, so we need to manually compile and install it from source tarball. For this, we need some additional pre-requisites packages to be installed on the system before compiling it from source.<\/p>\n

      On RedHat\/CentOS\/Fedora<\/h5>\n
      # yum install \u2013y gcc gd gd-devel make perl-GD wget httpd<\/pre>\n
      Once you\u2019ve installed all the required packages, download the latest\u00a0sarg source tarball<\/a>\u00a0or you may use the following\u00a0wget<\/strong>\u00a0command to download and install it as shown below.<\/p>\n
      # wget http:\/\/liquidtelecom.dl.sourceforge.net\/project\/sarg\/sarg\/sarg-2.3.10\/sarg-2.3.10.tar.gz\r\n# tar -xvzf sarg-2.3.10.tar.gz\r\n# cd sarg-2.3.10\r\n# .\/configure\r\n# make\r\n# make install<\/pre>\n
      On Debian\/Ubuntu\/Linux Mint<\/h5>\n
      On\u00a0Debian<\/strong>\u00a0based distributions,\u00a0sarg<\/strong>\u00a0package can be easily install from the default repositories using\u00a0apt-get<\/strong>package manager.<\/p>\n
      $ sudo apt-get install sarg<\/pre>\n
      Step 2: Configuring Sarg<\/h4>\n
      Now it\u2019s time to edit some parameters in\u00a0SARG<\/strong>\u00a0main configuration file. The file contains lots of options to edit, but we will only edit required parameters like:<\/p>\n
        \n
      1. Access logs path<\/li>\n
      2. Output directory<\/li>\n
      3. Date Format<\/li>\n
      4. Overwrite report for the same date.<\/li>\n<\/ol>\n
        Open\u00a0sarg.conf<\/strong>\u00a0file with your choice of editor and make changes as shown below.<\/p>\n
        # vi \/usr\/local\/etc\/sarg.conf        [On RedHat<\/strong> based systems]<\/pre>\n
        $ sudo nano \/etc\/sarg\/sarg.conf        [On Debian<\/strong> based systems]<\/pre>\n
        Now Uncomment and add the original path to your\u00a0squid access log<\/strong>\u00a0file.<\/p>\n
        # sarg.conf\r\n#\r\n# TAG:  access_log file\r\n#       Where is the access.log file\r\n#       sarg -l file\r\n#\r\naccess_log \/var\/log\/squid\/access.log<\/strong><\/pre>\n
        Next, add the correct\u00a0Output directory<\/strong>\u00a0path to save the generate squid reports in that directory. Please note, under\u00a0Debian<\/strong>\u00a0based distributions the\u00a0Apache<\/strong>\u00a0web root directory is \u2018\/var\/www<\/strong>\u2018. So, please be careful while adding correct web root paths under your Linux distributions.<\/p>\n
        # TAG:  output_dir\r\n#       The reports will be saved in that directory\r\n#       sarg -o dir\r\n#\r\noutput_dir \/var\/www\/html\/squid-reports<\/strong><\/pre>\n
        Set the correct\u00a0date format<\/strong>\u00a0for reports. For example, \u2018date_format e<\/strong>\u2018 will display reports in\u00a0\u2018dd\/mm\/yy<\/strong>\u2018 format.<\/p>\n
        # TAG:  date_format\r\n#       Date format in reports: e (European=dd\/mm\/yy), u (American=mm\/dd\/yy), w (Weekly=yy.ww)\r\n#\r\ndate_format e<\/strong><\/pre>\n
        Next, uncomment and set Overwrite report to \u2018Yes\u2019<\/strong>.<\/p>\n
        # TAG: overwrite_report yes|no\r\n#      yes - if report date already exist then will be overwritten.\r\n#       no - if report date already exist then will be renamed to filename.n, filename.n+1\r\n#\r\noverwrite_report yes<\/strong><\/pre>\n
        That\u2019s it! Save and close the file.<\/p>\n
        Step 3: Generating Sarg Report<\/h4>\n
        Once, you\u2019ve done with the configuration part, it\u2019s time to generate the squid log report using the following command.<\/p>\n
        # sarg -x        [On RedHat<\/strong> based systems]<\/pre>\n
        # sudo sarg -x        [On Debian<\/strong> based systems]<\/pre>\n
        Sample Output<\/h5>\n
        [root@localhost squid]# sarg -x\r\n\r\nSARG: Init\r\nSARG: Loading configuration from \/usr\/local\/etc\/sarg.conf\r\nSARG: Deleting temporary directory \"\/tmp\/sarg\"\r\nSARG: Parameters:\r\nSARG:           Hostname or IP address (-a) =\r\nSARG:                    Useragent log (-b) =\r\nSARG:                     Exclude file (-c) =\r\nSARG:                  Date from-until (-d) =\r\nSARG:    Email address to send reports (-e) =\r\nSARG:                      Config file (-f) = \/usr\/local\/etc\/sarg.conf\r\nSARG:                      Date format (-g) = USA (mm\/dd\/yyyy)\r\nSARG:                        IP report (-i) = No\r\nSARG:             Keep temporary files (-k) = No\r\nSARG:                        Input log (-l) = \/var\/log\/squid\/access.log\r\nSARG:               Resolve IP Address (-n) = No\r\nSARG:                       Output dir (-o) = \/var\/www\/html\/squid-reports\/\r\nSARG: Use Ip Address instead of userid (-p) = No\r\nSARG:                    Accessed site (-s) =\r\nSARG:                             Time (-t) =\r\nSARG:                             User (-u) =\r\nSARG:                    Temporary dir (-w) = \/tmp\/sarg\r\nSARG:                   Debug messages (-x) = Yes\r\nSARG:                 Process messages (-z) = No\r\nSARG:  Previous reports to keep (--lastlog) = 0\r\nSARG:\r\nSARG: sarg version: 2.3.7 May-30-2013\r\nSARG: Reading access log file: \/var\/log\/squid\/access.log\r\nSARG: Records in file: 355859, reading: 100.00%\r\nSARG:    Records read: 355859, written: 355859, excluded: 0\r\nSARG: Squid log format\r\nSARG: Period: 2014 Jan 21\r\nSARG: Sorting log \/tmp\/sarg\/172_16_16_55.user_unsort\r\n......<\/pre>\n
        Note<\/strong>: The \u2018sarg -x\u2019<\/strong>\u00a0command will read the \u2018sarg.conf<\/strong>\u2018 configuration file and takes the squid \u2018access.log<\/strong>\u2018 path and generates a report in html format.<\/p>\n
        Step 4: Assessing Sarg Report<\/h4>\n
        The generated reports placed under \u2018\/var\/www\/html\/squid-reports\/<\/strong>\u2018 or \u2018\/var\/www\/squid-reports\/<\/strong>\u2018 which can be accessed from the web browser using the address.<\/p>\n
        http:\/\/localhost\/squid-reports\r\nOR\r\nhttp:\/\/ip-address\/squid-reports<\/pre>\n
        Sarg Main Window<\/h5>\n
        \n
        \"Squid<\/a><\/p>\n
        Sarg Main Window<\/p>\n<\/div>\n
        Specific Date<\/h5>\n
        \n
        \"Date<\/a><\/p>\n
        Date Wise Report<\/p>\n<\/div>\n
        User Report<\/h5>\n
        \n
        \"User<\/a><\/p>\n
        User Bandwidth Report<\/p>\n<\/div>\n
        Top Accessed Sites<\/h5>\n
        \n
        \"Squid<\/a><\/p>\n
        Top Accessed Sites<\/p>\n<\/div>\n
        Top Sites and Users<\/h5>\n
        \n
        \"Squid<\/a><\/p>\n
        Top Accessed Sites and Users<\/p>\n<\/div>\n
        Top Downloads<\/h5>\n
        \n
        \"Squid<\/a><\/p>\n
        Top Downloads<\/p>\n<\/div>\n
        Denied Access<\/h5>\n
        \n
        \"Squid<\/a><\/p>\n
        Denied Access Sites<\/p>\n<\/div>\n
        Authentication Failures<\/h5>\n
        \n
        \"Squid<\/a><\/p>\n
        Proxy Authentication Failures<\/p>\n<\/div>\n
        Step 5: Automatic Generating Sarg Report<\/h4>\n
        To automate the process of generating\u00a0sarg<\/strong>\u00a0report in given span of time via\u00a0cron jobs<\/a>. For example, let\u2019s assume you want to generate reports on\u00a0hourly<\/strong>\u00a0basis automatically, to do this, you need to configure a\u00a0Cron<\/strong>\u00a0job.<\/p>\n
        # crontab -e<\/pre>\n
        Next, add the following line at the bottom of the file. Save and close it.<\/p>\n
        * *\/1 * * * \/usr\/local\/bin\/sarg -x<\/strong><\/pre>\n
        The above\u00a0Cron<\/strong>\u00a0rule will generate\u00a0SARG<\/strong>\u00a0report every\u00a01 hour<\/strong>.<\/p>\n
        Reference Links<\/h3>\n
        Sarg Homepage<\/a><\/p>\n
        That\u2019s it with\u00a0SARG<\/strong>! I will be coming up with few more interesting articles on\u00a0Linux<\/strong>, till then stay tuned to\u00a0TecMint.com<\/strong>\u00a0and don\u2019t forget to add your valuable comments.<\/p>\n
        Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
        SARG\u00a0is an open source tool that allows you to analyse the squid log files and generates beautiful reports in\u00a0HTML\u00a0format with informations about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and monthly reports. The\u00a0SARG\u00a0is very handy tool to view how much internet bandwidth is … <\/p>\n
        Continue reading “SARG \u2013 Squid Analysis Report Generator and Internet Bandwidth Monitoring Tool”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11696","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/11696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=11696"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/11696\/revisions"}],"predecessor-version":[{"id":11697,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/11696\/revisions\/11697"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=11696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=11696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=11696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}