Goaccess: The parse of time-frame is not working

[jpelaez01]

When I try this:

# sed -n '/01\/May\/2016/,/31\/May\/2016/ p' access.log | goaccess -a

I got the correct start date, but not the correct end date, it shows the info of June:

[allinurl]

Could you please confirm sed is actually outputting the specified range?

sed -n '/01\/May\/2016/,/31\/May\/2016/ p' access.log > test.log

Thanks

[jpelaez01]

Yes, it does!

Thanks!

[allinurl]

So it looks like it's working now, correct?

BTW, from your previous screenshot, it appears that have several failed requests, make sure you have the right log/date/time format. Also, if the majority of your log lines are longer than 4096, then you could build goaccess passing --with-getline to parse the whole line.

[allinurl]

Closing this. Feel free to reopen it if needed.

[jpelaez01]

Hi, thanks for your answer.

You were right, I didn´t have the correct log format, this format worked for me:

log_format %^ %^ %^ [%d:%t] "%m %r %H" %s %b "%R" "%u" "%h"
time_format %H:%M:%S %z
date_format %d/%b/%Y

Now I can see the report with the real values:

Thanks!

[allinurl]

@jpelaez01 actually you should remove %m and %H, and just leave "%r".

Feel free to post a few sample lines and I can take a look at the format.

[jpelaez01]

Hi @allinurl, these are the sample lines:

10.6.70.46 - - [31/May/2016:00:00:32 -0500] "POST /API/Seguridad/Sesion/IniciarSesionSA HTTP/1.0" 201 1028 "https://zz.com/index.html" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0" "181.49.200.225"
10.6.70.46 - - [31/May/2016:00:00:33 -0500] "GET /API/General/Personas/ObtenerAvatarUsuario HTTP/1.0" 200 82 "https://zz.com/index.html" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0" "181.49.200.225"
10.6.70.46 - - [31/May/2016:00:00:33 -0500] "GET /API/Seguridad/Sesion/ObtenerTareasAutorizadas/7 HTTP/1.0" 200 34039 "zz.com/index.html" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0" "181.49.200.225"

And this is the nginx log format:

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for"';

Thanks.

[allinurl]

Try this:

goaccess -f access.log --log-format='%^[%d:%t %^] "%r" %s %b "%R" "%u" "%h"' --time-format=%T --date-format=%d/%b/%Y

or

log-format %^[%d:%t %^] "%r" %s %b "%R" "%u" "%h"
time_format %T
date_format %d/%b/%Y

[jpelaez01]

The graph does not change when I modified this format log:

log_format %^ %^ %^ [%d:%t] "%m %r %H" %s %b "%R" "%u" "%h"
time_format %H:%M:%S %z
date_format %d/%b/%Y

for this:

log-format %^[%d:%t %^] "%r" %s %b "%R" "%u" "%h"
time_format %T
date_format %d/%b/%Y

Thank you very much for your help.

[allinurl]

It probably won't change since yours look fine, but %r already covers %m and %H so no need for them. Also, it's safer to use %^[ before the date since there _could_ be data on those fields.