Goaccess: Blank Geo Location Panel

[jdotdarko]

I can't get GoAccess to read locations from the Nginx access.log although the server is already outputting locations in the log

175.143.42.162 - - [31/Mar/2020:15:32:55 +0200] "GET / HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" "-" MY Kuala Lumpur

I tried GeoIP Legacy first before this. Geo Location panel wasn't blank but the data was unknown for the location. Then I moved to GeoIP2, upgraded Nginx, added ngx_http_geoip2_module and it's all well on the Nginx side. It's just, I can't figure it out on the GoAccess side to read geo locations from Nginx's logs. It's just a blank the Geo Location panel.

[allinurl]

It can't read it from the log, it has to parse it through the IP. libmaxminddb. From the config file:

# For GeoIP2 City database:
# wget -N http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz
# gunzip GeoLite2-City.mmdb.gz
#
# For GeoIP2 Country database:
# wget -N http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz
# gunzip GeoLite2-Country.mmdb.gz
#
#geoip-database /usr/local/share/GeoIP/GeoLiteCity.dat

[allinurl]

If GeoIP is needed, you will need to download the City/Country database from MaxMind and use the option --geoip-database to specify the database.

[jdotdarko]

Thanks! The param --geoip-database works but how can I use 2 databases (one for city, one for country) and then output them as country code and city name respectively?

[allinurl]

Unfortunately it's not possible right now. #594 should address this.

[jdotdarko]

Oh that's okay. One last thing to ask, what's the proper log format for this Nginx setup?

 log_format  '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    '$geoip2_data_country_code $geoip2_data_country_name';

It's also because I can't get the time and date of hits to appear as shown here:

[allinurl]

Please post a few lines from your access log

[jdotdarko]

83.219.146.44 - - [01/Apr/2020:11:30:38 +0200] "GET / HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" "-" RU Kaliningrad

201.145.108.58 - - [01/Apr/2020:11:48:47 +0200] "GET / HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" "-" MX Ecatepec

187.189.237.59 - - [01/Apr/2020:12:11:22 +0200] "POST /cgi-bin/mainfunction.cgi HTTP/1.1" 404 153 "-" "XTC" "-" MX Puebla City

192.241.239.9 - - [01/Apr/2020:12:29:26 +0200] "GET / HTTP/1.1" 404 153 "-" "Mozilla/5.0 zgrab/0.x" "-" US San Francisco

171.67.70.85 - - [01/Apr/2020:12:33:41 +0200] "GET / HTTP/1.1" 404 153 "-" "Mozilla/5.0 zgrab/0.x" "-" US Stanford

[allinurl]

Please note that I added your location from the log to an unused panel called VirtualHost.

goaccess access.log --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u" %^ %v\n' --date-format=%d/%b/%Y --time-format=%T

[jdotdarko]

It all looks good now. Thank you! Time to explore the config for more customization.

Oh and btw, I have to include the parameter -p /usr/local/etc/goaccess/goaccess.conf every time because for some unknown reason, goaccess can't locate the default global config.

[jdotdarko]

Hi again! Is there any way to add the IP address and location of a request in the Unique Visitors panel so I can track where it comes from along with the time and date?

[allinurl]

@jdotdarko you will need to do some preprocessing, e.g., awk, grep, sed. #117 will address this.

Closing this as it appears to b working for you. Feel free to reopen it if needed. v1.4 is coming out next week. Stay tuned!