Goaccess: Token '/Sep/2018' doesn't match specifier '%d'

Created on 26 Sep 2018  路  5Comments  路  Source: allinurl/goaccess

I can't figure out why goaccess is bombing out with this error. What's wrong with my formats?

time-format %T
date-format %d/%b/%Y
log-format %^ - [%h] - %^ - [%d:%t %^] "%r" %s %b "%R" "%u" %^ %T [%^] %^ %^ %^ %^

access.log

218.211.168.178 - [218.211.168.178] - - [26/Sep/2018:15:43:09 +0000] "GET / HTTP/1.1" 400 271 "-" "Mozilla/5.0" 104 0.000 [] - - - -
184.105.247.195 - [184.105.247.195] - - [26/Sep/2018:13:47:00 +0000] "GET / HTTP/1.1" 404 21 "-" "-" 39 0.003 [upstream-default-backend] 10.244.0.6:8080 21 0.003 404
77.72.83.28 - [77.72.83.28] - - [26/Sep/2018:12:35:08 +0000] "\\x03\\x00\\x00/*\\xE0\\x00\\x00\\x00\\x00\\x00Cookie: mstshash=Administr" 400 173 "-" "-" 0 0.116 [] - - - -
137.74.30.68 - [137.74.30.68] - - [26/Sep/2018:11:36:42 +0000] "GET / HTTP/1.1" 404 21 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 174 0.001 [upstream-default-backend] 10.244.0.6:8080 21 0.001 404
125.165.51.173 - [125.165.51.173] - - [26/Sep/2018:10:42:48 +0000] "GET / HTTP/1.1" 404 21 "-" "Mozilla/5.0 (Windows NT 6.1  WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" 185 0.002 [upstream-default-backend] 10.244.0.16:8080 21 0.002 404
77.239.6.35 - [77.239.6.35] - - [26/Sep/2018:10:18:44 +0000] "GET / HTTP/1.1" 404 21 "-" "-" 39 0.165 [upstream-default-backend] 10.244.0.6:8080 21 0.002 404
79.212.162.159 - [79.212.162.159] - - [26/Sep/2018:10:16:58 +0000] "GET / HTTP/1.1" 404 21 "-" "curl/7.43.0" 78 0.001 [upstream-default-backend] 10.244.0.16:8080 21 0.001 404
142.93.128.43 - [142.93.128.43] - - [26/Sep/2018:09:53:17 +0000] "\\xE4\\xFEZGCRG\\x03\\x00\\x00\\x00\\x02\\x00\\xD8*\\xC5\\xAA\\xA3\\x9A`\\x9A\\xDAW'D\\x94\\xBD\\xA4EK\\x808\\xE4\\xC6.\\xF5\\x9A\\x90\\xB2\\xA0\\xC4=\\x03f_\\x8F\\x83\\xB2\\xE61b\\xD7g\\xAB<B\\x8Eh\\xD2c\\x1E)A\\x1D\\xBC" 400 173 "-" "-" 0 0.113 [] - - - -
1.6.232.4 - [71.6.232.4] - - [26/Sep/2018:09:37:14 +0000] "GET / HTTP/1.1" 404 21 "-" "Mozilla/5.0 (Windows NT 10.0  Win64  x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36" 204 0.002 [upstream-default-backend] 10.244.0.6:8080 21 0.002 404
107.170.210.107 - [107.170.210.107] - - [26/Sep/2018:09:17:53 +0000] "GET / HTTP/1.1" 404 21 "-" "Mozilla/5.0 zgrab/0.x" 111 0.002 [upstream-default-backend] 10.244.0.16:8080 21 0.002 404
60.191.38.77 - [60.191.38.77] - - [26/Sep/2018:08:43:38 +0000] "GET / HTTP/1.1" 404 21 "-" "Mozilla/5.0 (Macintosh  Intel Mac OS X 10.11  rv:47.0) Gecko/20100101 Firefox/47.0" 176 0.002 [upstream-default-backend] 10.244.0.6:8080 21 0.002 404
lodattime format question

Most helpful comment

@zauker Looks like a different locale vs date-format in your log. Please try running goaccess as

LANG="en_US.UTF-8" bash -c 'goaccess access.log --log-format=COMBINED'

All 5 comments

This should do it:

goaccess access.log --log-format='%^ %^[%h] %^[%d:%t %^] "%r" %s %b "%R" "%u" %^ %T %^' --date-format='%d/%b/%Y' --time-format=%T

That worked. Thank you. I guess the lesson here is that I shouldn't put the dashes in the format; it weeds them out automatically.

I have installed goaccess 1.3 via homebrew.

I have a log like this:

194.118.207.23 - - [01/Jan/2020:00:04:47 +0100] "GET /logo-top.png HTTP/1.1" 200 6292 "https://www.mysite.it/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"
194.118.207.23 - - [01/Jan/2020:00:04:57 +0100] "GET /logo-top.png HTTP/1.1" 304 - "https://www.mysite.it/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"

Using the dialog I select NCSA Combined Log Format but receive this error message:

Token '01/Jan/2020' doesn't match specifier '%d'

Can you help me to solve this issue?

@zauker Looks like a different locale vs date-format in your log. Please try running goaccess as

LANG="en_US.UTF-8" bash -c 'goaccess access.log --log-format=COMBINED'

@allinurl thank you very much, the command that you suggested works fine!

Was this page helpful?
0 / 5 - 0 ratings

Related issues

tbarbette picture tbarbette  路  3Comments

domainoverflow picture domainoverflow  路  3Comments

vivekkrish picture vivekkrish  路  3Comments

Gill-Bates picture Gill-Bates  路  3Comments

olimpo88 picture olimpo88  路  3Comments