How to filter properly my access logs with GoAccess?

Question

I want to generate a report with only the POST /xmlrpc.php requests, so I run the following command :

zcat access.log.*.gz | grep 'POST /xmlrpc.php' | goaccess -a -o report-xmlrpc.html

The results of the report are not all displayed (in the graph I see only 9 days, but I checked on the others logs and I have POST /xmlrpc.php requests almost every days (30 in total) ).

Am I using zat / grep / goaccess wrong ?

score 0 · Accepted Answer · answered Jun 01 '17 at 02:58

0

You are parsing only *.gz logs, I assume you want to parse all of them (compressed and not compressed), try this instead:

zgrep -h 'POST /xmlrpc.php' access.log* | goaccess -a -o report-xmlrpc.html

answered Jun 01 '17 at 02:58

Kayla

899
2
6
16

But I tried your command, and... wow it works! :) Why my command didn't work? `zgrep` is more or less the same as `zcat` + `grep` , isn't it ? – Jun 01 '17 at 19:40
Please can i know why this does not work ? ` zcat -f /var/log/nginx/access.* | sed -n '/30\/Jun\/2020/,/30\/Jun\/2020/ p' | goaccess -a --log-format=COMBINED ` – ayotycoon Jul 01 '20 at 12:47

How to filter properly my access logs with GoAccess?

1 Answers1