Goaccess: Error parsing log (wrong hostname)

[pawelrosada]

Hello.
I have a problem with the goaccess. While parsing, I get the message:

GoAccess - version 1.0.2 - Jul 11 2016 10:36:18
Config file: /usr/local/etc/goaccess.conf

Fatal error has occurred
Error occured at: src/goaccess.c - main - 1230
Nothing valid to process. Verify your date/time/log format.

I determined that the problem is this entry
ec2-54-206-80-6.ap-southeast-2.compute.amazonaws.com - - [11/Jul/2016:20:36:22 +0200] "GET / HTTP/1.1" 200 2282 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"

When ec2-54-206-80-6.ap-southeast-2.compute.amazonaws.com change to a different host address GoAccess working properly.
Any ideas?

[allinurl]

Hello,

GoAccess requires a valid IPv4/6 for the %h specifier. If you are resolving the ip upon logging the request, then you would need to leave the IP as it is and set goaccess to resolve it instead.

[pawelrosada]

I do not understand what I must do to parse this log :/ Such options should I use ?
-a? Or I think bad?

[allinurl]

If your log doesn't have a valid IPv4/6, then you can't parse it with goaccess.

If you want to parse it with goaccess, you will need to disable hostname lookups in your web server config options (assuming that's the case).

[pawelrosada]

Ok, now I understand. Thanks for help ;)

[cmaas]

@allinurl

If you want to parse it with goaccess, you will need to disable hostname lookups in your web server config options (assuming that's the case).

That is extremely unfortunate for German users. By privacy law, most German hosters disable logging of the IP address and just log a hostname given by the ISP, for example p5XDA2268.dip0.t-ipconnect.de. It might be silly, but a German webhoster is basically not allowed to log the actual IP address of website visitors.

Any chance to make GoAccess' %h match a non-IP hostname in the future?

[allinurl]

@cmaas Interesting. Before I make some changes, do you know what's displayed in the log when unable to resolve the IP? I'm curious about this so goaccess can associate somehow the client with a date/time and the user agent.

[cmaas]

@allinurl From what I see in my logs: It seems to default to IPv4 addresses apparently, if there's no hostname. I also looked into this a bit more. It's not at easy as I thought it was. Logging the hostname instead of the IP is one way to semi-anonymize visitors. But apparently, many services just set parts of the IP to 0, like so 46.124.0.0. This makes identification of unique visitors probably difficult or almost impossible.

The question would be: Say, there's only a hostname, why does GoAccess require an actual IP address instead of just a string?

[allinurl]

Was looking at this, and I think it would be safe to have some option such as --permissive-clientswhich would allow a string as client instead of a valid IP.

There's no reason as to why goaccess uses an IP other than to identify unique visitors. Though, if we add this --permissive-clients option, then it's possible that some of the unique counts won't be as accurate since two clients can be on the same range, e.g., 46.124.0.0 = 46.124.12.12, 46.124.10.3.