nginx log analysis with goaccess

Question

I want to parse and analyze the nginx logs with goaccess and take a report from the analyzed logs. But, when I run the zcat -f access.log.*.gz | goaccess -a -c command, it gives me the following error :

GoAccess - version 0.5 - Jun 26 2012 04:30:08
An error has occurred
Error occured at: parser.c - process_log - 584
Message: No date format was found on your conf file.

I tried to add the line date_format %D %T to .goaccessrc file but I got another error which is:

GoAccess - version 0.5 - Jun 26 2012 04:30:08
An error has occurred
Error occured at: parser.c - process_log - 588
Message: No log format was found on your conf file.

I think it asks for the date and log formats that nginx uses. but I have no any date or log format in my nginx configuration.

Additionally, I've tried to use a previous version of goaccess(0.4.2 version) and the zcat -f access.log.*.gz | goaccess -a -c command works fine. it doesn't asks for any date or log format and i can view the goaccess menu and i can view any data that want.

But when I try to get a html report with zcat -f access.log.*.gz | goaccess -a -c > report.html command, it does nothing. it just waits and waits.(without giving any warning or error)

Note: i've checked this webpages and if you want to take a look too.

can you post a sample line from your access.log? – Kayla Sep 21 '12 at 22:46 — Kayla, Sep 21 '12 at 22:46

score 26 · Accepted Answer · answered May 19 '13 at 12:24

26

Got it working with the following ~/.goaccessrc:

date_format %d/%b/%Y:%T %z
log_format %h - - [%d] "%r" %s %b "%R" "%u"

I installed GoAccess as a binary package from wheezy repository (no source recompilation).

answered May 19 '13 at 12:24

Ilya I

1,282
1
12
19

5

and executing with goaccess -f [log_file] -p ~/.goaccessrc – drosanda Jul 17 '14 at 03:06
3

this worked for me, but i also had to add --no-global-config at the command line. – Daren Sep 02 '14 at 20:51

score 16 · Answer 2 · edited Jun 20 '20 at 09:12

16

Assuming you are using the CLF format string, I would run goaccess with -c and then choose NCSA Combined Log Format from the config menu.

enter image description here

"$time_local" in nginx is replaced with "23/Aug/2010:03:50:59 +0000" so adding date_format %d/%b/%Y to your ~/.goaccessrc should do it.

Update 1:

Installing v0.5 from source

Download the latest version
tar -xzvf goaccess-0.5.tar.gz
cd goaccess-0.5/
./configure --enable-utf8
make
sudo make install
goaccess -a -c /var/log/apache2/access.log

Note: If you have it installed already, then you may only need to do step 7 prior to using zcat

edited Jun 20 '20 at 09:12

Community

1
1

answered Sep 23 '12 at 20:48

Kayla

899
2
6
16

`188.3.88.98 - - [17/Sep/2012:07:13:08 +0000] "GET / HTTP/1.1" 200 2909 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1"` – husnu Sep 24 '12 at 12:26
@husnu see my answer, that should do it. – Kayla Sep 24 '12 at 12:32
the format string is CLF. but when i run goaccess with `-c` i can't see a screen like you were send. i'm using version 0.5, please check the goaccess version. Additionally, i was installed goaccess with `sudo apt-get install goaccess` command after updating the /etc/apt/sources.list. Can you post your installation and run commands like me? – husnu Sep 24 '12 at 12:39
thanks for your answer. your last update not working for me. but, I think I found the root cause, when I ran the `configure`, it gave me this error: `configure: error:*** glib2 not found!`. I think, an update or installing glib2 will resolve my problems. – husnu Sep 25 '12 at 10:44

score 6 · Answer 3 · edited Jun 11 '14 at 14:22

6

If you don't want to use the global options use --no-global-config option with goaccess. I am using this to process my log files on a day by day basis:

grep --color=auto `date +"%d/%b"` /var/log/nginx/sitename.access.log | goaccess --no-global-config > report.html

goaccess version: 0.8

edited Jun 11 '14 at 14:22

Teun Zengerink

4,277
5
30
32

answered May 23 '14 at 10:23

Dhiraj Thakur

716
10
25

score 3 · Answer 4 · answered Mar 14 '16 at 08:05

I met the same problem with you! Configuration file path is correct " /etc/goaccess.conf " try to do this

    echo "date_format %d/%b/%Y
> log_format %h %^[%d:%^] “%r” %s %b “%R” “%u” %T
> time_format %H:%M:%S" >> /etc/goaccess.conf

and try again,I wish you success

nginx log analysis with goaccess

4 Answers4