Home
Sarg — Squid Analysis Report Generator is a tool that allows you to view "where" your users are going to on the Internet. Sarg generates HTML reports, with information about users, IP Addresses, bytes, sites and times.
The material reported in the HTML reports comes from log files generated by your proxy server or appliance. Sarg must be ran periodically to read the proxy log files and to generate the HTML reports.
Currently, Sarg can process log files in the standard Squid log format and in the extended log format.
Due to a lack of sample log files, the extended log format is not tested and may not work. If you are interested in that feature, please send some sample files to the developers (a few hundred lines should be enough).
At some point in the past, Sarg was also able to process tags inserted by McAfee's SmartFilter but that feature is very likely broken as we don't have any log file containing those tags to test the code. Here again, if you have log files, please send a sample to the developers.
Reports spanning one day, one week or one month are easily produced thanks to dedicated command line flags but reports encompassing any date range can also be produced.
HTML reports are static. Once generated, they are immutable and only display the selected date range. All you can do is navigate through the links to view the various pages and sort the tables content. It has two advantages: Sarg requires no database at all and the reports are displayed as fast as can be without any further processing.
Although the report look cannot be customized, what is included in the report is configurable. You can exclude users or visited web sites from appearing in the report. Columns can be left out to hide unnecessary information. Visited web sites can be grouped using various rules (handy with clusters). Pages can be disabled to trim down the global report size.
Several options allow you to produce anonymous reports should your policy require it.
Should you need to build Sarg from sources, consult the [Build on Linux] page in this wiki.