1

My first question in this community, hope it's gonna be awesome around here!

To the topic: I have this very simple log file constructed in the following manner

192.168.178.21 [21/07/2015] "GET /path/to/somewhere HTTP/1.1" "/path/to/somewhere" "Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0"

and the following config file for goaccess

date-format %d/%m%Y
log-format %h %^[%d%^] "%r" "%U" %^

Side question:

  • I could find several different ways to write the config file. In the docs one can find variable declarations of date_format and log_format which confuses me. Which is the correct one?

Since I looked through all related questions to this topic, i couldn't find a reason why I get the error 

GoAccess - version 0.8.5 - Dec  5 2014 06:28:46
Fatal error has occurred
Error occurred at: goaccess.c - main - 832
Nothing valid to process.

The documentation also states, that only %h, "%r" and %d are required for correct parsing. What am I missing?

add. info

  • CentOS 7 64bit
  • GoAccess 0.8.5

I know the newest version as of this day is 0.9.2. Out of "reasons", I cannot build the newest version by my own. So maybe it is a version depending problem (?).

Daniel A. White
  • 187,200
  • 47
  • 362
  • 445
whatTheHack
  • 33
  • 5

1 Answers1

1

It looks like your date format posted is not right. Try the following, it works for me:

goaccess -f log --log-format='%h [%d] "%r" "%^" "%u"' --date-format='%d/%m/%Y' --time-format="%T"

You have to use both, date_format and log_format, and I think time_format as well (at least in the latest version).

The variable date_format specifies the date format, while log_format contains the tokens that goaccess uses to parse each line from your access log.

Sijia Din
  • 1,343
  • 9
  • 13
  • That did the trick. thank you! Mistakes were (as you pointed out): unnecessary "%^" in front of the date declaration in the brackets "[ ]" and apparently the "%U" placeholder, which is described as "The URL path requested (including any query string)." in the docs, is responsible for this error aswell. Any idea why the "%U" isn't working? – whatTheHack Aug 24 '15 at 11:21
  • the [doc](http://goaccess.io/man#custom-log) says that `%r` needs some sort of delimiter, otherwise, `%m` `%U` `%H` need to be used. Since your request contains three of them, `%r` works just fine. I guess you could do this too: `--log-format='%h [%d] "%m %^ %H" "%U" "%u"'`. – Sijia Din Aug 24 '15 at 13:18
  • You are right of course. Should have read that more carefully. Consider this question to be closed. Ty. – whatTheHack Aug 24 '15 at 21:05