Goaccess: No time format was found on your conf file.

Created on 27 Oct 2015 · 34Comments · Source: allinurl/goaccess

Hi,

I am currently running on GoAccess v0.9.6 and installed on Centos 6.5 (Final) server.

whenever i try to run my log using "goaccess -f logfile" (without .log)

I get the error as below:-

Fatal error has occurred
Error occured at: src/parser.c - verify_formats - 1938
No time format was found on your conf file.

I have change the date-format and log-format respectively:-

date-format %d/%b/%Y
log-format %h %^[%d:%^] "%r" %s %b "%R" "%u"

No luck and keeps getting the same error....Need your kind advice on this.

Here is my config file settings:-

######################################
# Time Format Options (required)
######################################
#time-format %H:%M:%S
#time-format %T
#   
#   
#time-format %f

######################################
# Date Format Options (required)
######################################
# Apache log date format. The following date format works with any 
# of the Apache's log formats below.
#   
date-format %d/%b/%Y
#   
#date-format %Y-%m-%d
#   
#   
#date-format %f

######################################
# Log Format Options (required)
######################################
#   
#   
# NCSA Combined Log Format
#   
#log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
log-format %h %^[%d:%^] "%r" %s %b "%R" "%u"

Thanks.

question

Source

coverguy

Most helpful comment

As the error message says, it couldn't find the time-format. You need to uncomment the following line:

time-format %H:%M:%S

allinurl on 27 Oct 2015

👍2

All 34 comments

My Log pattern are as below, just in case you might need it:-

192.168.x.x - anonymous [27/Oct/2015:17:49:16 +0800]

coverguy on 27 Oct 2015

As the error message says, it couldn't find the time-format. You need to uncomment the following line:

time-format %H:%M:%S

allinurl on 27 Oct 2015

👍2

I tried but the error still persists..

coverguy on 27 Oct 2015

You may need to specify the config file using -p /path/goaccess.conf. It might be picking ~/.goaccessrc. You can also run goaccess --dcf and that will tell you which config file will use if no -p is passed.

allinurl on 27 Oct 2015

🎉1

BTW, above the Fatal error has occurred message, it should also display the config file being used.

allinurl on 27 Oct 2015

So you mean just type "goaccess -p /path/goaccess.conf only?

coverguy on 27 Oct 2015

You will need to specify the log file with -f and the path of your config file with -p

goaccess -f /path/logfile -p /path/goaccess.conf

If there's no time/log/date formats, goaccess should prompt a dialog asking for these formats, unless you are piping a log to it, i.e., cat logfile | goaccess

allinurl on 27 Oct 2015

Here is my diagnostics as below:

[root@xxxx home]# goaccess --dcf
/usr/local/etc/goaccess.conf

goaccess -p /usr/local/etc/goaccess.conf

GoAccess - version 0.9.6 - Oct 27 2015 17:46:33
Config file: /usr/local/etc/goaccess.conf

Fatal error has occurred
Error occured at: src/parser.c - verify_formats - 1938 
No time format was found on your conf file.

[root@xxxxx home]# goaccess -f /home/syslogaccess_log -p goaccess -p /usr/local/etc/goaccess.conf

GoAccess - version 0.9.6 - Oct 27 2015 17:46:33
Config file: /usr/local/etc/goaccess.conf

Fatal error has occurred
Error occured at: src/parser.c - verify_formats - 1938
No time format was found on your conf file.

Any idea?

coverguy on 28 Oct 2015

Interesting... I'm assuming you have uncommented the time/log/date variables in this file /usr/local/etc/goaccess.conf?

Also, running goaccess -f /home/syslogaccess_log -p /usr/local/etc/goaccess.conf should prompt you for a dialog if no time format was specified. Can you please try adding -c to it and select your log format from the given options or enter a custom one. Thanks

allinurl on 28 Oct 2015

Hi,

Based on the options table if you notice it, [%d:%t %^] its still showing regardless that i have comment it out and replace another new line with [%d:%^] as per your advise before.

+--------------------------------------------------+
| Log Format Configuration                         |   
| [SPACE] to toggle - [ENTER] to proceed           |   
|                                                  |   
| [x] NCSA Combined Log Format                     |   
| [ ] NCSA Combined Log Format with Virtual Host   |   
| [ ] Common Log Format (CLF)                      |   
| [ ] Common Log Format (CLF) with Virtual Host    |   
| [ ] W3C                                          |   
| [ ] CloudFront (Download Distribution)           |   
|                                                  |   
| Log Format - [c] to add/edit format              |   
| %h %^[%d:%t %^] "%r" %s %b "%R" "%u"" "%u"       |   
|                                                  |   
| Date Format - [d] to add/edit format             |   
| %d/%b/%Y                                         |   
|                                                  |   
| Time Format - [t] to add/edit format             |   
| %H:%M:%S                                         |   
+--------------------------------------------------+

+--------------------------------------------------+
| Log Format Configuration                         |   
| [SPACE] to toggle - [ENTER] to proceed           |   
|                                                  |   
| [ ] NCSA Combined Log Format                     |   
| [x] NCSA Combined Log Format with Virtual Host   |   
| [ ] Common Log Format (CLF)                      |   
| [ ] Common Log Format (CLF) with Virtual Host    |   
| [ ] W3C                                          |   
| [ ] CloudFront (Download Distribution)           |   
|                                                  |   
| Log Format - [c] to add/edit format              |   
| %v:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u"       |   
|                                                  |   
| Date Format - [d] to add/edit format             |   
| %d/%b/%Y                                         |   
|                                                  |   
| Time Format - [t] to add/edit format             |   
| %H:%M:%S                                         |   
+--------------------------------------------------+

coverguy on 28 Oct 2015

I think the issue is your log format, you actually need %t. For instance,

log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"

Can you post a full sample line from your access log.

allinurl on 28 Oct 2015

xxxxxx 192.168.x.x - anony [27/Oct/2015:17:49:22 +0800] "GET /mrtg/rtr/guu-SH2-RTR/mrtg-m.png HTTP/1.1" 304 - "http://xxxxx/mrtg/rtr/guu-SH2-RTR/index.html" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0" "SQDATA=d4a2851915464cb9a0514e23f3ba1307" "x.x.x.x" "x.x.x.x" 0

coverguy on 28 Oct 2015

Should i add back the log-format with the %t?

coverguy on 28 Oct 2015

The following works with the log line you posted. Please use this in your config file /usr/local/etc/goaccess.conf (make sure to remove the other formats)

log-format %^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %^
date-format %d/%b/%Y
time-format %H:%M:%S

allinurl on 28 Oct 2015

Finally! Its working! hah thanks for your kind assistance and prompt support mate. Aprreciated

coverguy on 28 Oct 2015

Glad that worked :)

Closing this, feel free to reopen this if needed.

allinurl on 28 Oct 2015

You can pipe data into goaccess which gives you a lot of flexibility in terms of what you want to display, so for page views, i.e., html, htm, php, etc.. you can do something like this:

awk '$8~/\.html|\.htm|\.php/' /var/log/apache2/access.log | goaccess

Note, $8 is the request field for your log format above (including NCSA Combined Log Format with Virtual Host), for the common log format, you probably want to use $7 instead. You can always check which field you are shooting for:

tail -10 /var/log/apache2/access.log | awk '{print $8}'

allinurl on 28 Oct 2015

awk '$7~/\.html|\.htm|\.php/' /home/syslogaccess_log | goaccess

coverguy on 28 Oct 2015

From the sample log line above, $7 will give you "GET and not the request /mrtg/rtr/guu-SH2-RTR/mrtg-m.png.

You can check this with awk '{print $7}' or awk '{print $8}'

allinurl on 28 Oct 2015

Its print $8 that shows correct output but it doesn't show which IP address visited for each link and i am able to get a unique count using sort but if can grab the IP address would be better :)

coverguy on 28 Oct 2015

From what I understand, issue #117 should address this. It hasn't been implemented yet, though. Stay tuned for this change!

allinurl on 28 Oct 2015

Haha, alrighty. Thanks again mate for your kind reply.

coverguy on 28 Oct 2015

when i am trying to run access log nothing is displayed , Can someone pls help me on this

GoAccess - 0.9.8.
For more details visit: http://goaccess.io
Copyright (C) 2009-2015 GNU GPL'd, by Gerardo Orellana

access_log:

10.171.33.111 - - [14/Apr/2016:05:00:00 -0700] "GET /procurement/adfAuthenticationPreload.gif?r=S6Gb%2F3LGY81EDeuG HTTP/1.1" 302 830 5188 - "-"
10.171.33.111 - - [14/Apr/2016:05:00:00 -0700] "GET /crmCommon/adfAuthenticationPreload.gif?r=S6Gb%2F3LGY81EDeuG HTTP/1.1" 302 848 5024 - "-"
10.177.222.177 - - [14/Apr/2016:05:00:00 -0700] "GET /payables/images/configure_ena.png HTTP/1.1" 200 857 18927 005C72YFjuAAtHQ6ubn3EH0005NG0010tZ "[email protected]"
10.177.222.177 - - [14/Apr/2016:05:00:00 -0700] "GET /payables/images/openbook_ena.png HTTP/1.1" 200 570 24350 005C72YFjtzAtHQ6ubn3EH0005NG002aUh "[email protected]"

reddykiran449 on 14 Apr 2016

@reddykiran449 could you please explain the fields that you are using on this log?

allinurl on 14 Apr 2016

After using below parameters in goacess.conf it is working fine

log-format %^ %h %^ %^ %^[%d:%t %^] "%r" %s %b %^ "%R" %^ "%u"
date-format %d/%b/%Y
time-format %H:%M:%S

reddykiran449 on 15 Apr 2016

santosh@laptop:~$ goaccess -f access.log >report.html
Segmentation fault (core dumped)
santosh@santosh-laptop:~$ cat /etc/goaccess.conf
log_format %^ %^ %h %^[%d:%^] "%r" %s %b "%R" "%u"
date_format %d/%b/%Y

Still not working. Anything wrong with the conf. also
santosh@laptop:~$ goaccess --dcf
Unknown option `--'.

santoshdj123 on 9 May 2016

@santoshdj123 It looks like you may be using an old version of goaccess. Which version are you using?

allinurl on 9 May 2016

goaccess version

GoAccess - 0.6

santoshdj123 on 9 May 2016

# sudo apt-get upgrade goaccess
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
goaccess is already the newest version.

already newer version.

santoshdj123 on 9 May 2016

@santoshdj123 Unfortunately the debian/ubuntu repo does not have the latest version of it.

Please use the official deb repo to get the latest stable version.

allinurl on 9 May 2016

./goaccess --log-format="%h %^[%d:%^] \"%r\" %s %b \"%R\" \"%u\"" --date-format=%d/%b/%Y -f /var/log/access.log  >reports.html

GoAccess - version 0.9.8 - May  9 2016 22:10:14
Config file: /usr/local/etc/goaccess.conf

Fatal error has occurred
Error occured at: src/parser.c - verify_formats - 2215
No time format was found on your conf file.

i have latest version but looks like something wrong with log-format . Please suggest

santoshdj123 on 9 May 2016

Conf. file.

grep -v "^#" /usr/local/etc/goaccess.conf  | sed '/^$/d' 
log-format %^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %^
date-format %d/%b/%Y
time-format %H:%M:%S
config-dialog false
color-scheme 1
hl-header true
no-color false
no-column-names false
no-progress false
with-mouse false
no-csv-summary false
all-static-files false
static-file .css
static-file .js
static-file .jpg
static-file .png
static-file .gif
static-file .ico
static-file .jpeg
static-file .pdf
static-file .txt
static-file .csv
static-file .zip
static-file .mp3
static-file .mp4
static-file .mpeg
static-file .mpg
static-file .exe
static-file .swf
static-file .woff
static-file .woff2
static-file .xls
static-file .xlsx
static-file .doc
static-file .docx
static-file .ppt
static-file .pptx
static-file .iso
static-file .gz
static-file .rar
static-file .svg
static-file .bmp
static-file .tar
static-file .tgz
static-file .tiff
static-file .tif
static-file .ttf
static-file .flv
agent-list false
http-method true
http-protocol true
no-query-string false
no-term-resolver false
real-os true
with-output-resolver false
444-as-404 false
4xx-to-unique-count false
double-decode false
ignore-crawlers false
ignore-panel REFERRERS
ignore-panel KEYPHRASES

santoshdj123 on 9 May 2016

@santoshdj123 As the message says, you need to add the time-format variable. For instance,

goaccess --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u"' --date-format='%d/%b/%Y' --time-format='%T' -f /var/log/access.log > reports.html

OR uncomment time-format, date-format and log-format under /usr/local/etc/goaccess.conf

allinurl on 9 May 2016

🎉1

It worked.... thanks a lot.

santoshdj123 on 9 May 2016

Was this page helpful?

0 / 5 - 0 ratings

Related issues

crash while parsing multiple access.log files

eroldru · 3Comments

Error while running make command and building from Github

deosha · 3Comments

goaccess conf for fail2ban logs ?

securixhk · 3Comments

Token '23/Nov/2019' doesn't match specifier '%d'

DestinyWang · 3Comments

Get only general into my json

LoanDEV · 3Comments