Search code examples
parsingloggingfatal-errorlog-analysisgoaccess

goaccess log parsing of very simple log not working

My first question in this community, hope it's gonna be awesome around here!

To the topic: I have this very simple log file constructed in the following manner

192.168.178.21 [21/07/2015] "GET /path/to/somewhere HTTP/1.1" "/path/to/somewhere" "Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0"

and the following config file for goaccess

date-format %d/%m%Y
log-format %h %^[%d%^] "%r" "%U" %^

Side question:

  • I could find several different ways to write the config file. In the docs one can find variable declarations of date_format and log_format which confuses me. Which is the correct one?

Since I looked through all related questions to this topic, i couldn't find a reason why I get the error 

GoAccess - version 0.8.5 - Dec  5 2014 06:28:46
Fatal error has occurred
Error occurred at: goaccess.c - main - 832
Nothing valid to process.

The documentation also states, that only %h, "%r" and %d are required for correct parsing. What am I missing?

add. info

  • CentOS 7 64bit
  • GoAccess 0.8.5

I know the newest version as of this day is 0.9.2. Out of "reasons", I cannot build the newest version by my own. So maybe it is a version depending problem (?).

Solution

  • It looks like your date format posted is not right. Try the following, it works for me:

    goaccess -f log --log-format='%h [%d] "%r" "%^" "%u"' --date-format='%d/%m/%Y' --time-format="%T"

    You have to use both, date_format and log_format, and I think time_format as well (at least in the latest version).

    The variable date_format specifies the date format, while log_format contains the tokens that goaccess uses to parse each line from your access log.