Goaccess: Blank real-time-html page

[tomasliumparas]

Hi,

I am using v.1
Trying to check out the real-time-html feature, however can't get it working.

Command output:

[root@sphere ~]# goaccess -f /var/log/httpd/access_log -o report.html --real-time-html --port=8000 --addr=10.22.0.254
Parsing... [3495] [0/s]

Does it supposed to be like that? Or should there be additional output?
Socket seems to be opened after that:

[root@sphere ~]# netstat -tuplen
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       User       Inode      PID/Program name   
tcp        0      0 0.0.0.0:445                 0.0.0.0:*                   LISTEN      0          1517011260 929/smbd            
tcp        0      0 0.0.0.0:9022                0.0.0.0:*                   LISTEN      0          1517009667 594/sshd            
tcp        0      0 10.22.0.254:8000            0.0.0.0:*                   LISTEN      0          1517584169 1584/goaccess 

Starting Nmap 7.12 ( https://nmap.org ) at 2016-06-14 05:33 EEST
Nmap scan report for 10.22.0.254
Host is up (0.040s latency).
Not shown: 993 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
8000/tcp  open  http-alt
10000/tcp open  snet-sensor-mgmt

Nmap done: 1 IP address (1 host up) scanned in 0.46 seconds

I can access the page, but it appears completely blank. Any ideas?
The urls I am using for access:

http://10.22.0.254:8000
http://10.22.0.254:8000/report.html

[allinurl]

What you posted above looks right. Have you tried outputting only the report?, e.g.,

goaccess -f /var/log/httpd/access_log -o report.html

[tomasliumparas]

Yep, it works just fine.

[allinurl]

Also, if goaccess is running on a different machine than your browser, you probably want to use --ws-url=server.addr otherwise, it will attempt to connect to localhost. You can also try getting rid of --addr.

One more thing, check the browser console or dev tools, it may be outputting something.

[tomasliumparas]

Just to clarify, should I place report.html in web servers root, or it can be anywhere and the report is accessible via socket?

[allinurl]

The report can be anywhere, goaccess will send the data via socket. So once the report has been generated, it will attempt to establish a connection to whatever address was given on --ws-url=<addr>.

[tomasliumparas]

Ok, so:
10.22.0.254 is simply a server where goaccess is installed. It is accessible via vpn, 10.22.0.254 is its VPN ip.

So I made a report with:
goaccess -f /var/log/httpd/access_log -o report.html --real-time-html --port=8000 --ws-url=10.22.0.254 --addr=10.22.0.254

And downloaded it to my pc. It works, but the report information does not update. The green led near the settings icon in the dashboard is on. If I cancel the command on the server, it goes off :)

Attached is also the screenshot from Firebug. The request to goaccess gets a response, but the info does not update.

Any ideas?

[tomasliumparas]

My bad again..Everything works fine!
I did not realise, that the info is refreshed only on new log entry.

The "Last updated field" confused me, so I was refreshing the page and wondering why it is not working.

Wonderfull peace of software. You can close this ! :)

[allinurl]

Great to hear that :)

Actually I'm working on an issue similar to what you described above, where in some cases, it is possible for a client not get the data from the server, and therefore, the buffer not being flushed. So I expect having a new minor release soon. Stay tuned!

[zt1983811]

Sorry I have the exactly the same issue
I did this

goaccess -f /var/log/nginx/access.log -a -o report.html --real-time-html --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u"' --date-format='%d/%b/%Y' --time-format='%T' --ws-url=xxx.xxx.xx.x --addr=xxx.xxx.xx.x --port=7700

I keep get blank page
check in dev tool
Request URL:http://xxx.xxx.xx.x:7700/
Request Method:GET
Status Code:400 Invalid Request
Remote Address:xxx.xxx.xx.x:7700

Any ideas?

[allinurl]

@zt1983811 The "Request URL" in your dev tools should look like ws://example.com:9870/.

It's a WebSocket connection and it shouldn't contain HTTP on it. The requested url is set by --ws-url=example.com --port=9870

[zt1983811]

@allinurl I am sorry I try to access ws://example.com:9870/ from dev tool or browser I can not .
Could you explain me how it suppose to work?
Do I need to create client to consume this ws://example.com:9870/ ? or it can be directly access by http and show the report page like you did?

Thanks in advance!

[allinurl]

Upon opening the generated report in your browser, it tries to establish a WebSocket connection to the address specified by --ws-url=<address>. Note that the address part should point to the location where GoAccess is running and parsing logs.

If you don't use --ws-url, it will attempt to establish the WebSocket connection to localhost, which means that GoAccess should be running on your local machine (the same machine with the browser)

By default, the WebSocket server listens on port 7890, so the server running GoAccess should have the port open. Optionally, if you need to use a different port you can specify it by using --port=<port_number>

So the following example, assumes that GoAccess is running and parsing logs on a remote server, the port 7890 is opened, and your browser is on your local machine.

goaccess -f access_log -o report.html --real-time-html --ws-url=host.myserver.com

Please note that the address/host that you use in --ws-url should not be of the type http://. If it makes things easier, you can try using the server IP instead.

[zt1983811]

Hi @allinurl

I think I follow exactly your instructions, however I got 404 for some reason.

goaccess -f /var/log/nginx/access.log -a -o report.html --real-time-html --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u"' --date-format='%d/%b/%Y' --time-format='%T' --ws-url=xxx.xxx.xx.x --addr=xxx.xxx.xx.x --port=7700

the xxx.xxx.xx.x is ip address of remote server, and the log is also in this remote server, the command above is running in that remote server too. And I try use my local computer to access http://xxx.xxx.xx.x
I got 404

I try to access ws://xxx.xxx.xx.x page can not even load from browser

If you want I can provide you the real ip in private we can test together!

Appreciated your help.

[allinurl]

One more thing to note, GoAccess does not have a webserver, only a WebSocket server.

So your report should be behind an Apache or Nginx in order to open it from a remote location. However, since the report is just a plain html file, you can download the generated report to your local machine and open it there. i.e., file:///home/user/report.html.

[zt1983811]

@allinurl

Could you show us how you did it in your website to make it always updating http://rt.goaccess.io/?20160616115152
I want to do exactly the same , I have nginx server installed here

[allinurl]

First, I run goaccess to parse the access log and place the one-time-only generated report under the web server www public folder. Here's how is done:

goaccess -f access.log -o /usr/share/nginx/www/rt.goaccess.io/index.html --real-time-html --ws-url=ws.goaccess.io

Then, when you or anybody else access http://rt.goaccess.io/, your browser will establish a WebSocket connection to ws.goaccess.io.

That's all.

If that doesn't work, shoot me an email to hello [at] goaccess . io and I'll take a look at it.

[bilalba]

Please write this ^ in the README. Took me some time to get here and understand this.

[allinurl]

@bilalba Thanks, I've added some details to the README.

[bilalba]

@allinurl As a feature suggestion: It would be better if a default HTTP request to the server sent the HTML report and you could use a relative url to form a WS connection with the server.

[allinurl]

@bilalba what do you mean with the server should send the HTML report? Currently a JSON object with the latest data is fetched as soon as the connection is opened.

[bilalba]

@allinurl Something like detecting if an HTTP request has been made to the server and responding with the report.html. Because currently, if an HTTP request using curl or a browser is made, it responds empty with a 400 error code.

HTTP/1.1 400 Invalid Request
no chunk, no close, no size. Assume close to signal end

Perhaps this should help. http://stackoverflow.com/questions/13791050/is-it-possible-to-enable-tcp-http-and-websocket-all-using-the-same-port

[allinurl]

@bilalba I'm not sure I follow. What would be the use case for sending a request to get the HTML report? wouldn't you be able to just open it after it has been generated?

[bilalba]

@allinurl This is in case goaccess is running on a remote server; it's more convenient to open(and share) an HTML page through a URL rather than through the file. Right now, sharing the report is only possible by hosting it separately somewhere.

[allinurl]

@bilalba Got it. I'll check on this.

[bitcrackcyber]

I think the confusion comes in, i know it did with me - in that I thought the web server is serving the HTML page and you visit it and get the report. Which gives me a blank page.

Whereas the web server is just populating data for the HTML file it creates, which you download and open on your browser and it auto-updates via the web service.