使用goaccess进行nginx日志分析

Question

I want to parse and analyze the nginx logs with goaccess and take a report from the analyzed logs. But, when I run the zcat -f access.log.*.gz | goaccess -a -c zcat -f access.log.*.gz | goaccess -a -c command, it gives me the following error :

GoAccess - version 0.5 - Jun 26 2012 04:30:08
An error has occurred
Error occured at: parser.c - process_log - 584
Message: No date format was found on your conf file.

I tried to add the line date_format %D %T to .goaccessrc file but I got another error which is:

GoAccess - version 0.5 - Jun 26 2012 04:30:08
An error has occurred
Error occured at: parser.c - process_log - 588
Message: No log format was found on your conf file.

I think it asks for the date and log formats that nginx uses. but I have no any date or log format in my nginx configuration.

Additionally, I've tried to use a previous version of goaccess(0.4.2 version) and the zcat -f access.log.*.gz | goaccess -a -c zcat -f access.log.*.gz | goaccess -a -c command works fine. it doesn't asks for any date or log format and i can view the goaccess menu and i can view any data that want.

But when I try to get a html report with zcat -f access.log.*.gz | goaccess -a -c > report.html zcat -f access.log.*.gz | goaccess -a -c > report.html command, it does nothing. it just waits and waits.(without giving any warning or error)

Note: i've checked this webpages and if you want to take a look too.

1. http://goaccess.prosoftcorp.com/faq
2. http://wiki.nginx.org/HttpLogModule

Answer 1

Got it working with the following ~/.goaccessrc :

date_format %d/%b/%Y:%T %z
log_format %h - - [%d] "%r" %s %b "%R" "%u"

I installed GoAccess as a binary package from wheezy repository (no source recompilation).

Answer 2

Assuming you are using the CLF format string, I would run goaccess with -c and then choose NCSA Combined Log Format from the config menu.

"$time_local" in nginx is replaced with "23/Aug/2010:03:50:59 +0000" so adding date_format %d/%b/%Y to your ~/.goaccessrc should do it.

Update 1 :

Installing v0.5 from source

1. Download the latest version
2. tar -xzvf goaccess-0.5.tar.gz
3. cd goaccess-0.5/
4. ./configure --enable-utf8
5. make
6. sudo make install

7. goaccess -a -c /var/log/apache2/access.log

   Note: If you have it installed already, then you may only need to do step 7 prior to using zcat

Answer 3

If you don't want to use the global options use --no-global-config option with goaccess. I am using this to process my log files on a day by day basis:

grep --color=auto `date +"%d/%b"` /var/log/nginx/sitename.access.log | goaccess --no-global-config > report.html

goaccess version: 0.8

Answer 4

I met the same problem with you! Configuration file path is correct " /etc/goaccess.conf " try to do this

    echo "date_format %d/%b/%Y
> log_format %h %^[%d:%^] “%r” %s %b “%R” “%u” %T
> time_format %H:%M:%S" >> /etc/goaccess.conf

and try again,I wish you success