Goaccess stopped working

For the past 2 days goaccess has not parsed any reports.  Any ideas?

Also, current version is 1.2 on my server.  Is it possible to update?

Have you checked to see if your log files haven't ballooned in size to be too large to process? Are you using logrotate to keep them a manageable size?

I posted update instructions in another thread, but here it is again:

Also, can goaccess be updated?  server version is 1.2 from 2017.  Latest is 1.9

Nothing prevents you from updating if you so desire. Remove CWP's GoAccess and install prerequisite (MaxMind GeoIP library):

Code: [Select]

yum -y remove goaccess
yum install libmaxminddb-devel.x86_64Download and compile GoAccess, install to replace the current 1.2 version:

Code: [Select]

cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=mmdb --with-getline --with-openssl
make
make install

I was thinking file was too large also.  25MBfor the access log.   780MB for the error log

How can you remember all of the posts you have made?

I couldnt find any necessary requisites for installing goaccess.  Im on C7 with php 8 something.

On an unrelated subject.  I want to add my ip to whitelist on modsec.  I seem to remember a filed dedicated to whitelist and a file for blacklist.  I cant find them now.  What file do I add the ip whitelist to.  Not the rules file is it?

fwiw  I am reading on line that if one log file is empty then goaccess will not generate a report.  Not sure what they are talking about.  access file is never zero.  And what other log files are they talking about.

Have you checked to see if your log files haven't ballooned in size to be too large to process? Are you using logrotate to keep them a manageable size?

I posted update instructions in another thread, but here it is again:

Also, can goaccess be updated?  server version is 1.2 from 2017.  Latest is 1.9

Nothing prevents you from updating if you so desire. Remove CWP's GoAccess and install prerequisite (MaxMind GeoIP library):

Code: [Select]

yum -y remove goaccess
yum install libmaxminddb-devel.x86_64Download and compile GoAccess, install to replace the current 1.2 version:

Code: [Select]

cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=mmdb --with-getline --with-openssl
make
make install

make threw an error  -->threw an error no target found

Something weird happened when I downloaded the source file to usr/local/src......ownership:group  was user:opendkim  I tried user fix permissions but nothing changed.

After uninstall and install of 1.94 of goaccess, this morning there is still no statistics data since march 30. Ugg.

I tried running a report manually and I am getting this time error:

Code: [Select]

Fatal error has occurred
Error occurred at: src/parser.c - parse_log - 2431
No time format was found on your conf file.
This is the line # 2431 referenced above:

Code: [Select]

/* verify that we have the required formats */
  if ((err_log = verify_formats ()))
    FATAL ("%s", err_log);
And this is the goaccess.conf file pertaining to time:

Code: [Select]

#
time-format %H:%M:%S
#
# Google Cloud Storage or
# The time in microseconds since the Unix epoch.
#
#time-format %f

# Squid native log format
#
#time-format %s

######################################
# Date Format Options (required)
######################################
#
# The date-format variable followed by a space, specifies
# the log format date containing any combination of regular
# characters and special format specifiers. They all begin with a
# percentage (%) sign. See `man strftime`
#
# The following date format works with any of the
# Apache/NGINX's log formats below.
#
date-format %d/%b/%Y
#
# AWS | Amazon CloudFront (Download Distribution)
# AWS | Elastic Load Balancing
# W3C (IIS)
#
#date-format %Y-%m-%d

FWIW  goaccess 1.9.4 uses access.log as the source file to parse and not access_log

How do I remember all my threads? I authored them, so I maintain a basic familiarity with them. Plus, if you test your methods and author an instructional post, sometimes it takes 15 min+ to test it ahead of publication. So I'm apt to remember a post that took some doing!

25MB is not overly large for an access log. Your error log, on the other hand, is rather large if it's >500MB. Do you have logrotate enabled to process all your domlogs?

Not sure what you're encountering, because I tested both methods when I posted to the other thread. Maybe something particular with your installation? Try the other method using the legacy geoip -- same as what the current GoAccess uses:

Code: [Select]

yum -y install geoip-devel
cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=legacy --with-getline --with-openssl
make
make install

How do I remember all my threads? I authored them, so I maintain a basic familiarity with them. Plus, if you test your methods and author an instructional post, sometimes it takes 15 min+ to test it ahead of publication. So I'm apt to remember a post that took some doing!

25MB is not overly large for an access log. Your error log, on the other hand, is rather large if it's >500MB. Do you have logrotate enabled to process all your domlogs?

Error log is big,  I delete if from time to time.  Is the error log relevant to goaccess Problem or was that just an observation?
Default logrotate does not include domlogs.  What do you suggest.?

Filemanagement > Logrotate Manager
create /etc/logrotate.d/httpd

Code: [Select]

/usr/local/apache/domlogs/*.log {
    missingok
    notifempty
    sharedscripts
    daily
    rotate 7
    postrotate
        /sbin/service httpd reload > /var/log/httpd-rotate.log 2>&1 || true
    endscript
    compress
}

Filemanagement > Logrotate Manager
create /etc/logrotate.d/httpd

Code: [Select]

/usr/local/apache/domlogs/*.log {
    missingok
    notifempty
    sharedscripts
    daily
    rotate 7
    postrotate
        /sbin/service httpd reload > /var/log/httpd-rotate.log 2>&1 || true
    endscript
    compress
}

I got basically the same from chatgpt.  The only difference was this:  /sbin/service httpd reload > /var/log/httpd-rotate.log 2>&1 || true.
What does that do?