Control Web Panel
WebPanel => Information => Topic started by: Namaste on April 02, 2025, 12:44:58 PM
-
For the past 2 days goaccess has not parsed any reports. Any ideas?
Also, current version is 1.2 on my server. Is it possible to update?
-
Have you checked to see if your log files haven't ballooned in size to be too large to process? Are you using logrotate to keep them a manageable size?
I posted update instructions in another thread, but here it is again:
Also, can goaccess be updated? server version is 1.2 from 2017. Latest is 1.9
Nothing prevents you from updating if you so desire. Remove CWP's GoAccess and install prerequisite (MaxMind GeoIP library):
yum -y remove goaccess
yum install libmaxminddb-devel.x86_64Download and compile GoAccess, install to replace the current 1.2 version:
cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=mmdb --with-getline --with-openssl
make
make install
-
I was thinking file was too large also. 25MBfor the access log. 780MB for the error log
-
How can you remember all of the posts you have made?
-
I couldnt find any necessary requisites for installing goaccess. Im on C7 with php 8 something.
On an unrelated subject. I want to add my ip to whitelist on modsec. I seem to remember a filed dedicated to whitelist and a file for blacklist. I cant find them now. What file do I add the ip whitelist to. Not the rules file is it?
-
fwiw I am reading on line that if one log file is empty then goaccess will not generate a report. Not sure what they are talking about. access file is never zero. And what other log files are they talking about.
-
Have you checked to see if your log files haven't ballooned in size to be too large to process? Are you using logrotate to keep them a manageable size?
I posted update instructions in another thread, but here it is again:
Also, can goaccess be updated? server version is 1.2 from 2017. Latest is 1.9
Nothing prevents you from updating if you so desire. Remove CWP's GoAccess and install prerequisite (MaxMind GeoIP library):
yum -y remove goaccess
yum install libmaxminddb-devel.x86_64Download and compile GoAccess, install to replace the current 1.2 version:
cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=mmdb --with-getline --with-openssl
make
make install
make threw an error -->threw an error no target found ;D
-
Something weird happened when I downloaded the source file to usr/local/src......ownership:group was user:opendkim I tried user fix permissions but nothing changed.
-
After uninstall and install of 1.94 of goaccess, this morning there is still no statistics data since march 30. Ugg.
-
I tried running a report manually and I am getting this time error:
Fatal error has occurred
Error occurred at: src/parser.c - parse_log - 2431
No time format was found on your conf file.
This is the line # 2431 referenced above:
/* verify that we have the required formats */
if ((err_log = verify_formats ()))
FATAL ("%s", err_log);
And this is the goaccess.conf file pertaining to time:
#
time-format %H:%M:%S
#
# Google Cloud Storage or
# The time in microseconds since the Unix epoch.
#
#time-format %f
# Squid native log format
#
#time-format %s
######################################
# Date Format Options (required)
######################################
#
# The date-format variable followed by a space, specifies
# the log format date containing any combination of regular
# characters and special format specifiers. They all begin with a
# percentage (%) sign. See `man strftime`
#
# The following date format works with any of the
# Apache/NGINX's log formats below.
#
date-format %d/%b/%Y
#
# AWS | Amazon CloudFront (Download Distribution)
# AWS | Elastic Load Balancing
# W3C (IIS)
#
#date-format %Y-%m-%d
-
FWIW goaccess 1.9.4 uses access.log as the source file to parse and not access_log
-
How do I remember all my threads? I authored them, so I maintain a basic familiarity with them. Plus, if you test your methods and author an instructional post, sometimes it takes 15 min+ to test it ahead of publication. So I'm apt to remember a post that took some doing!
25MB is not overly large for an access log. Your error log, on the other hand, is rather large if it's >500MB. Do you have logrotate enabled to process all your domlogs?
Not sure what you're encountering, because I tested both methods when I posted to the other thread. Maybe something particular with your installation? Try the other method using the legacy geoip -- same as what the current GoAccess uses:
yum -y install geoip-devel
cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=legacy --with-getline --with-openssl
make
make install
-
How do I remember all my threads? I authored them, so I maintain a basic familiarity with them. Plus, if you test your methods and author an instructional post, sometimes it takes 15 min+ to test it ahead of publication. So I'm apt to remember a post that took some doing!
25MB is not overly large for an access log. Your error log, on the other hand, is rather large if it's >500MB. Do you have logrotate enabled to process all your domlogs?
Error log is big, I delete if from time to time. Is the error log relevant to goaccess Problem or was that just an observation?
Default logrotate does not include domlogs. What do you suggest.?
-
Filemanagement > Logrotate Manager
create /etc/logrotate.d/httpd
/usr/local/apache/domlogs/*.log {
missingok
notifempty
sharedscripts
daily
rotate 7
postrotate
/sbin/service httpd reload > /var/log/httpd-rotate.log 2>&1 || true
endscript
compress
}
-
Filemanagement > Logrotate Manager
create /etc/logrotate.d/httpd
/usr/local/apache/domlogs/*.log {
missingok
notifempty
sharedscripts
daily
rotate 7
postrotate
/sbin/service httpd reload > /var/log/httpd-rotate.log 2>&1 || true
endscript
compress
}
I got basically the same from chatgpt. The only difference was this: /sbin/service httpd reload > /var/log/httpd-rotate.log 2>&1 || true.
What does that do?
-
/usr/local/apache/domlogs/*.log { <<< Tells logrotate all files ending in .log in the domlog directory
missingok <<< continue log rotation without reporting any error if any of the specified log files are missing.
notifempty <<< ensures that log files are not rotated if they are empty. If a log file is empty, it won't trigger rotation.
sharedscripts <<< ensures that the commands or scripts specified in the prerotate or postrotate directive are executed only once, regardless of the number of log files being rotated.
daily <<< Run every day
rotate 7 <<< Keep 7 days of logs
postrotate <<<< reload httpd once the logs are rotated
/sbin/service httpd reload > /var/log/httpd-rotate.log 2>&1 || true
endscript
compress <<<< GZIP the log files to save space
}
-
Thanks. Now a followup question mr. president.
Would that screw up goaccess monthly reports. Or is go access only using the access_log file which would not be trimmed by the log rotation.
-
The beauty of customizability -- my domlogs look like this. I got away from _log a long time ago in favor of .log, which is more easily read in external log reader & stats programs:
-rw-r--r-- 1 nobody root 0 Apr 11 14:23 domain.com.error.log
-rw-r--r-- 1 nobody root 0 Apr 11 14:23 domain.com.log
-rw-r--r-- 1 nobody root 0 Apr 10 14:23 domain.bytes
-rw-r--r-- 1 nobody root 202 Mar 31 02:51 domain.com.error.log-20250331.gz
-rw-r--r-- 1 nobody root 286 Apr 1 01:37 domain.com.error.log-20250401.gz
-rw-r--r-- 1 nobody root 294 Apr 3 01:42 domain.com.error.log-20250403.gz
-rw-r--r-- 1 nobody root 4129 Apr 5 02:33 domain.com.error.log-20250405.gz
-rw-r--r-- 1 nobody root 856 Apr 6 20:20 domain.com.error.log-20250407.gz
-rw-r--r-- 1 nobody root 767 Apr 8 00:20 domain.com.error.log-20250408.gz
-rw-r--r-- 1 nobody root 432 Apr 9 19:06 domain.com.error.log-20250410.gz
-rw-r--r-- 1 nobody root 121 Mar 31 02:51 domain.com.log-20250331.gz
-rw-r--r-- 1 nobody root 196 Apr 1 01:37 domain.com.log-20250401.gz
-rw-r--r-- 1 nobody root 262 Apr 3 01:42 domain.com.log-20250403.gz
-rw-r--r-- 1 nobody root 11656 Apr 5 02:33 domain.com.log-20250405.gz
-rw-r--r-- 1 nobody root 6594 Apr 6 20:20 domain.com.log-20250407.gz
-rw-r--r-- 1 nobody root 6507 Apr 8 00:20 domain.com.log-20250408.gz
-rw-r--r-- 1 nobody root 5983 Apr 9 19:06 domain.com.log-20250410.gz
-
The beauty of customizability -- my domlogs look like this. I got away from _log a long time ago in favor of .log, which is more easily read in external log reader & stats programs:
-rw-r--r-- 1 nobody root 0 Apr 11 14:23 domain.com.error.log
-rw-r--r-- 1 nobody root 0 Apr 11 14:23 domain.com.log
-rw-r--r-- 1 nobody root 0 Apr 10 14:23 domain.bytes
-rw-r--r-- 1 nobody root 202 Mar 31 02:51 domain.com.error.log-20250331.gz
-rw-r--r-- 1 nobody root 286 Apr 1 01:37 domain.com.error.log-20250401.gz
-rw-r--r-- 1 nobody root 294 Apr 3 01:42 domain.com.error.log-20250403.gz
-rw-r--r-- 1 nobody root 4129 Apr 5 02:33 domain.com.error.log-20250405.gz
-rw-r--r-- 1 nobody root 856 Apr 6 20:20 domain.com.error.log-20250407.gz
-rw-r--r-- 1 nobody root 767 Apr 8 00:20 domain.com.error.log-20250408.gz
-rw-r--r-- 1 nobody root 432 Apr 9 19:06 domain.com.error.log-20250410.gz
-rw-r--r-- 1 nobody root 121 Mar 31 02:51 domain.com.log-20250331.gz
-rw-r--r-- 1 nobody root 196 Apr 1 01:37 domain.com.log-20250401.gz
-rw-r--r-- 1 nobody root 262 Apr 3 01:42 domain.com.log-20250403.gz
-rw-r--r-- 1 nobody root 11656 Apr 5 02:33 domain.com.log-20250405.gz
-rw-r--r-- 1 nobody root 6594 Apr 6 20:20 domain.com.log-20250407.gz
-rw-r--r-- 1 nobody root 6507 Apr 8 00:20 domain.com.log-20250408.gz
-rw-r--r-- 1 nobody root 5983 Apr 9 19:06 domain.com.log-20250410.gz
I agree! That does look might handsome! But how did you do it?
-
With the logrotate conf I posted earlier. Does your default (or other) Apache vhost conf look like this under the log section:
CustomLog /usr/local/apache/domlogs/%domain%.bytes bytes
CustomLog /usr/local/apache/domlogs/%domain%.log combined
ErrorLog /usr/local/apache/domlogs/%domain%.error.log
-
FYI
AL9 has:
goaccess x86_64 1.9.3-2.el9 @epel 1.4 M
Just created the http conf, will let you know how it goes.
-
Well it did something weird on AL9, says it ran, but the report for 2025-04-13 is missing, and all the logs have been reset that are in /usr/local/apache/domlogs/
Do have:
domain.com.error.log
domain.com.log
domain.bytes
But nothing showing a date afterwards showing it rotated.
-
logrotate or GoAccess?
-
@overseer
Look like it is working, but it's doing filenames like:
elrepo.nl.ssimn.org.log.1.gz
elrepo.nl.ssimn.org.log.2.gz
What am I missing that it not assigning the date?
Thanks
-
/etc/logrotate.conf
# use date as a suffix of the rotated file
dateext
-
Already in there, here is our logrotate.conf, which is the default one created by CWP.
# see "man logrotate" for details
# global options do not affect preceding include directives
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# use date as a suffix of the rotated file
dateext
# uncomment this if you want your log files compressed
#compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
# system-specific logs may be also be configured here.
Just noticed the rotate didn't run last night like it should have either, but did the previous night.
-
What do your /etc/goaccess/goaccess.conf look like?
Just looked at the before and all the lines aren't active (have # in front)
-
Have you checked to see if your log files haven't ballooned in size to be too large to process? Are you using logrotate to keep them a manageable size?
I posted update instructions in another thread, but here it is again:
Also, can goaccess be updated? server version is 1.2 from 2017. Latest is 1.9
Nothing prevents you from updating if you so desire. Remove CWP's GoAccess and install prerequisite (MaxMind GeoIP library):
yum -y remove goaccess
yum install libmaxminddb-devel.x86_64Download and compile GoAccess, install to replace the current 1.2 version:
cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=mmdb --with-getline --with-openssl
make
make install
Just tried this on AL9, they must have GoAccess somewhere else.
Removed the package that was from EPEL.
And then installed GoAccess 1.9.4, but the graphs are still showing 1.9.3.
Weird.
But that is besides the logrotate issue.
-
Well the update to 1.9.4 took a day, now is showing correctly:
by GoAccess v1.9.4 and GWSocket