Set Up Sarg on Ubuntu

The annoying thing about Ubuntu’s version of Sarg (the program that generates the usage reports from the Squid logs) is that the cronjobs used to generate the reports are buggy - the weekly and monthly jobs only show some of the days :( Here is how I set Sarg up on client’s Ubuntu servers. It’s not difficult at all, really, as you’re only modifying the contents of 4 files and removing a redundant one :)

What You’ll Need

1. A computer running Ubuntu, either desktop or server edition
2. Squid to be installed and configured

Step 1

First off, let’s configure the log rotation for Squid. Replace the contents of /etc/logrotate.d/squid with the following:

#
# Logrotate fragment for squid.
#
/var/log/squid/*.log {
weekly
compress
delaycompress
rotate 5
missingok
nocreate
sharedscripts
prerotate
test ! -x /usr/sbin/sarg-maint || /usr/sbin/sarg-maint
endscript
postrotate
test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
endscript
}


Step 2

With the log rotation configured correctly, let’s alter the crontab file, which controls the execution of the cron jobs. My crontab file normally looks like this:


SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
00 08-18/1 * * * root /usr/sbin/sarg-reports today
00 00 * * * root /usr/sbin/sarg-reports daily
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#


The /usr/sbin/sarg-reports today line is optional, but can be useful. What it does is update the current daily log every hour between 8am and 6pm. If your proxy server is under high load, I’d advise you comment this line out (by placing a # at the start of the line) or delete it. As there is a line in the file that generates the daily report, you can remove the sarg file in /etc/cron.daily/. If you’re wondering why you don’t just leave it, well I’ve run into problems once or twice where the daily stats aren’t generated, so as I know this method works I tend to stick to it.

Step 3

Let’s fix the cronjob files for the weekly and monthly reports. First of all, replace the contents of /etc/cron.weekly/sarg with the following:


#!/bin/bash
LOG_FILES=
if [ -s /var/log/squid/access.log.1 ]; then
LOG_FILES="$LOG_FILES -l /var/log/squid/access.log.1"
fi
if [ -s /var/log/squid/access.log ]; then
LOG_FILES="$LOG_FILES -l /var/log/squid/access.log"
fi
# Get yesterday's date
YESTERDAY=$(date --date "1 days ago" +%d/%m/%Y)
# Get one week ago date
WEEKAGO=$(date --date "7 days ago" +%d/%m/%Y)
exec /usr/bin/sarg \
$LOG_FILES \
-o /var/www/squid-reports/Weekly \
-d $WEEKAGO-$YESTERDAY &>/dev/null
exit 0


Next, replace the contents of /etc/cron.monthly/sarg with the following:


#!/bin/bash
LOG_FILES=
if [ -s /var/log/squid/access.log.4.gz ]; then
LOG_FILES="$LOG_FILES -l /var/log/squid/access.log.4.gz"
fi
if [ -s /var/log/squid/access.log.3.gz ]; then
LOG_FILES="$LOG_FILES -l /var/log/squid/access.log.3.gz"
fi
if [ -s /var/log/squid/access.log.2.gz ]; then
LOG_FILES="$LOG_FILES -l /var/log/squid/access.log.2.gz"
fi
if [ -s /var/log/squid/access.log.1 ]; then
LOG_FILES="$LOG_FILES -l /var/log/squid/access.log.1"
fi
if [ -s /var/log/squid/access.log ]; then
LOG_FILES="$LOG_FILES -l /var/log/squid/access.log"
fi
# Get yesterday's date
YESTERDAY=$(date --date "1 day ago" +%d/%m/%Y)
# Get 1 month ago date
MONTHAGO=$(date --date "1 month ago" +%d/%m/%Y)
exec /usr/bin/sarg \
$LOG_FILES \
-o /var/www/squid-reports/Monthly \
-d $MONTHAGO-$YESTERDAY &>/dev/null
exit 0


Once this is done, you will have working Sarg reports! It’s a highly annoying bug in an otherwise very good distro, however it’s one of those nice ones that’s easy to solve.