Sarg is a Squid Report Generator that scans your Squid logs and generates html reports that are available via a web page.

I have used sarg for years on Redhatian boxes with no troubles. My issues started when I moved to Ubuntu as my Squid Proxy. No Daily, Weekly or Monthly Sarg reports are generated with a default Sarg install.

Using this link pointed me in the right direction and a comment on the post helped further.

So here is what I did to configure a working Sarg+Squid setup.

1. Edit /etc/logrotate.d/squid and change the daily option to monthly and change the command line for prerotate to actually do something

#
#       Logrotate fragment for squid.
#
/var/log/squid/*.log {
        # comment out daily and add monthly
        # this means squid will rotate the logs on a monthly basis
        # daily
        monthly
        compress
        delaycompress
        rotate 2
        missingok
        nocreate
        sharedscripts
        prerotate
                # The default command does nothing but return a usage message
                # test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports

                # change the command so prior to the logs being rotated it does a monthly report
                # the first part (before the ||) checks for the executeable sarg-reports 
                # and the second part is the actual command
                test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports monthly
        endscript
        postrotate
                test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
        endscript
}

2. I also commented out the contents of /etc/cron.monthly because it will be run by the logrotate prerotate command. I don’t remove the cron file because I want to be able to revert just in case.

 
#!/bin/sh

# Skipping Monthly log rotate because it is done in the squid logrotate prerotate command

# if [ -x /usr/sbin/sarg-reports ]; then
#  /usr/sbin/sarg-reports monthly
# fi

3. Finally I have moved the /etc/cron.daily/sarg /etc/cron.weekly/sarg files so they run before any possible logrotate command by renaming them with a prefix of 0

mv /etc/cron.daily/sarg /etc/cron.daily/0sarg
mv /etc/cron.weekly/sarg /etc/cron.weekly/0sarg