How to Upload a Gif to Teamspeak Description

Transmission Page

Proper name

goaccess - Fast weblog analyzer and interactive viewer.

SYNOPSIS

          goaccess [filename] [ options ... ] [-c][-1000][-H][-q][-d][...]        

DESCRIPTION

goaccess is a free (MIT Licensed) and open up source real-time blog analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.

It provides fast and valuable HTTP statistics for organisation administrators that crave a visual server report on the wing. GoAccess parses the specified spider web log file and outputs the information to the Ten final. Features include:

• General Statistics: This panel gives a summary of several metrics, some of them are: number of valid and invalid requests, time taken to analyze the data set, unique visitors, requested files, static files (CSS, ICO, JPG, etc) HTTP referrers, 404s, size of the parsed log file and bandwidth con‐ sumption.
• Unique visitors: This panel shows metrics such as hits, unique visitors and cumulative bandwidth per date. HTTP requests containing the aforementioned IP, the same appointment, and the same user amanuensis are considered a unique visitor. Past default, it includes spider web crawlers/spiders.
  Optionally, engagement specificity can be set to the hour level using --appointment-spec=hr which will display dates such as 05/Jun/2016:16, or to the minute level producing 05/Jun/2016:16:59. This is great if you want to rail your daily traffic at the hour or minute level.
• Requested files: This console displays the most highly requested (non-static) files on your web server. It shows hits, unique visitors, and percentage, along with the cumulative bandwidth, protocol, and the asking method used.
• Requested static files: Lists the near frequently static files such as: JPG, CSS, SWF, JS, GIF, and PNG file types, along with the same metrics equally the last panel. Additional static files tin can be added to the configuration file.
• 404 or Not Found: Displays the same metrics equally the previous request panels, nonetheless, its data contains all pages that were not found on the server, or commonly known as 404 status code.
• Hosts: This panel has detailed information on the hosts themselves. This is cracking for spotting aggressive crawlers and identifying who's eating your bandwidth.
  Expanding the console can display more data such equally host's reverse DNS lookup issue, country of origin and city. If the -a argument is enabled, a list of user agents can exist displayed by selecting the desired IP address, and so pressing ENTER.
• Operating Systems: This panel volition study which operating system the host used when information technology striking the server. It attempts to provide the well-nigh specific version of each operating organization.
• Browsers: This panel will study which browser the host used when it hit the server. It attempts to provide the virtually specific version of each browser.
• Visit Times: This panel will brandish an hourly report. This option displays 24 data points, ane for each hr of the day.
  Optionally, 60 minutes specificity tin can be prepare to the tenth of a infinitesimal level using --hour-spec=min which will display hours as 16:4 This is great if you want to spot peaks of traffic on your server.
• Virtual Hosts: This console volition display all the different virtual hosts parsed from the access log. This panel is displayed if %v is used within the log-format cord.
• Referrers URLs: If the host in question accessed the site via some other resources, or was linked/diverted to you from another host, the URL they were referred from volition be provided in this panel. Run into `--ignore-panel` in your configuration file to enable information technology. (disabled by default)
• Referring Sites: This panel volition display merely the host part but not the whole URL. The URL where the request came from.
• Keyphrases: It reports keyphrases used on Google search, Google cache, and Google translate that have led to your web server. At present, it only supports Google search queries via HTTP. Encounter `--ignore-panel` in your configuration file to enable it. (disabled by default)
• Geo Location: Determines where an IP address is geographically located. Statistics are broken downwardly by continent and country. It needs to be compiled with GeoLocation support.
• HTTP Status Codes: The values of the numeric status code to HTTP requests.
• Remote User (HTTP hallmark) This is the userid of the person requesting the document as determined by HTTP authentication. If the document is non password protected, this part will exist "-" but similar the previous i. This panel is not enabled unless %e is given inside the log-format variable.
• Cache Condition If you are using caching on your server, you may exist at the point where you desire to know if your request is being cached and served from the cache. This console shows the enshroud status of the object the server served. This panel is not enabled unless %C is given within the log-format variable. The status can be either MISS, Bypass, EXPIRED, STALE, UPDATING, REVALIDATED or Hitting
• MIME Types This console specifies Media Types (formerly known every bit MIME types) and Media Subtypes which will be assigned and listed underneath. This panel is not enabled unless %M is given within the log-format variable. Run across MIME types for more than details.
• Encryption Settings This panel shows the SSL/TLS protocol used along the Cipher Suites. This panel is not enabled unless %G is given within the log-format variable.

NOTE: Optionally and if configured, all panels can display the average time taken to serve the request.

STORAGE

At that place are three storage options that can exist used with GoAccess. Choosing one will depend on your environs and needs.

Default Hash Tables

In-memory storage provides meliorate performance at the cost of limiting the dataset size to the amount of bachelor concrete memory. GoAccess uses in-retentivity hash tables. It has very good memory usage and pretty good functioning. This storage has support for on-disk persistence.

CONFIGURATION

Multiple options tin can exist used to configure GoAccess. For a consummate up-to-engagement list of configure options, run ./configure --help

--enable-debug

Compile with debugging symbols and plow off compiler optimizations.

--enable-utf8

Compile with wide character support. Ncursesw is required.

--enable-geoip=<legacy|mmdb>

Compile with GeoLocation support. MaxMind'southward GeoIP is required. legacy will employ the original GeoIP databases. mmdb will utilize the enhanced GeoIP2 databases.

--with-getline

Dynamically expands line buffer in order to parse total line requests instead of using a fixed size buffer of 4096.

--with-openssl

Compile GoAccess with OpenSSL support for its WebSocket server.

OPTIONS

The following options can exist supplied via the command line or long options through the configuration file.

LOG/DATE/Time FORMAT

• --time-format <timeformat>

  The time-format variable followed past a space, specifies the log format time containing whatsoever combination of regular characters and special format specifiers. They all begin with a pct (%) sign. Meet `man strftime`. %T or %H:%M:%S.

  Note: If a timestamp is given in microseconds, %f must be used equally fourth dimension-format. If the timestamp is given in milliseconds %* must be used as time-format.

• --date-format <dateformat>

  The date-format variable followed by a space, specifies the log format date containing any combination of regular characters and special format specifiers.They all begin with a percentage (%) sign. See `man strftime`.

  Notation: If your access log contains English language dates/months such every bit 12/Jan/2021 but your machine locale is not set up to English, then you volition demand to set your LC_TIME, e.g.,

  LC_TIME="en_US.UTF-8" fustigate -c 'goaccess admission.log --log-format=COMBINED'            

  Also, if a timestamp is given in microseconds, %f must be used every bit date-format. If the timestamp is given in milliseconds %* must be used equally date-format.

• --log-format <logformat>

  The log-format variable followed past a infinite or \t for tab-delimited, specifies the log format string.

  In addition to specifying the raw log/date/fourth dimension formats, for simplicity, any of the post-obit predefined log format names can be supplied to the log/date/time-format variables. GoAccess can also handle 1 predefined name in one variable and another predefined name in another variable.

  COMBINED     | Combined Log Format VCOMBINED    | Combined Log Format with Virtual Host COMMON       | Common Log Format VCOMMON      | Mutual Log Format with Virtual Host W3C          | W3C Extended Log File Format SQUID        | Native Squid Log Format CLOUDFRONT   | Amazon CloudFront Web Distribution CLOUDSTORAGE | Google Cloud Storage AWSELB       | Amazon Elastic Load Balancing AWSS3        | Amazon Simple Storage Service (S3) AWSALB       | Amazon Awarding Load Balancer CADDY        | Caddy'southward JSON Structured format            

  Note: Mostly, you need quotes around values that include white spaces, commas, pipes, quotes, and/or brackets. Inner quotes must exist escaped.

  Note: Piping data into GoAccess won't prompt a log/engagement/fourth dimension configuration dialog, you will need to previously ascertain information technology in your configuration file or in the command line.

USER INTERFACE OPTIONS

• -c --config-dialog

  Prompt log/date configuration window on program start.

• -i --hl-header

  Color highlight active panel.

• -g --with-mouse

  Enable mouse support on main dashboard.

• --color=<fg:bg[attrs, Console>

  Specify custom colors for the concluding output.

  Color Syntax:

  DEFINITION space/tab colorFG#:colorBG# [attributes,Panel]

                FG# = foreground color [-1...255] (-ane = default term colour) 							BG# = groundwork color [-i...255] (-ane = default term color)            

  Optionally, it is possible to apply color attributes (multiple attributes are comma separated), such as: bold,underline,normal,reverse,blink

  If desired, it is possible to apply custom colors per panel, that is, a metric in the REQUESTS panel can be of color A, while the same metric in the BROWSERS panel can be of color B.

  • COLOR_MTRC_HITS
  • COLOR_MTRC_VISITORS
  • COLOR_MTRC_DATA
  • COLOR_MTRC_BW
  • COLOR_MTRC_AVGTS
  • COLOR_MTRC_CUMTS
  • COLOR_MTRC_MAXTS
  • COLOR_MTRC_PROT
  • COLOR_MTRC_MTHD
  • COLOR_MTRC_HITS_PERC
  • COLOR_MTRC_HITS_PERC_MAX
  • COLOR_MTRC_VISITORS_PERC
  • COLOR_MTRC_VISITORS_PERC_MAX
  • COLOR_PANEL_COLS
  • COLOR_BARS
  • COLOR_ERROR
  • COLOR_SELECTED
  • COLOR_PANEL_ACTIVE
  • COLOR_PANEL_HEADER
  • COLOR_PANEL_DESC
  • COLOR_OVERALL_LBLS
  • COLOR_OVERALL_VALS
  • COLOR_OVERALL_PATH
  • COLOR_ACTIVE_LABEL
  • COLOR_BG
  • COLOR_DEFAULT
  • COLOR_PROGRESS

Run across configuration file for a sample color scheme.

• --color-scheme <1|ii|3>

  Choose among concluding color schemes. ane for the monochrome scheme. ii for the greenish scheme and 3 for the Monokai scheme (shown only if last supports 256 colors).

• --crawlers-but

  Parse and display simply crawlers (bots).

• --html-custom-css=<path.css>

  Specifies a custom CSS file path to load in the HTML written report.

• --html-custom-js=<path.js>

  Specifies a custom JS file path to load in the HTML report.

• --html-report-title=<title>

  Set HTML report page title and header.

• --html-refresh=<seconds>

  Refresh the HTML report every X seconds. The value has to be between 1 and 60 seconds. The default is set to refresh the HTML report every 1 second.

• --html-prefs=<JSON>

  Fix HTML study default preferences. Supply a valid JSON object containing the HTML preferences. It allows the ability to customize each panel plot. See example below.

                --html-prefs='{"theme":"bright","perPage":v,"layout":"horizontal","showTables":true,"visitors":{"plot":{"chartType":"bar"}}}'            

  Note: Notation: The JSON object passed needs to be a i line JSON cord. For case,
• --json-pretty-print

  Format JSON output using tabs and newlines.

• --max-items=<num>

  The maximum number of items to display per panel. The maximum tin be a number between i and n.
  Annotation: Only a static HTML, CSV and JSON output let a maximum number greater than the default value of 366 (or 50 in the real-time HTML output) items per panel.

• --no-color

  Plough off colored output. This is the default output on terminals that do not support colors.

• --no-column-names

  Don't write column names in the terminal output. Past default, it displays column names for each available metric in every panel.

• --no-csv-summary

  Disable summary metrics on the CSV output.

• --no-progress

  Disable progress metrics [total requests/requests per 2d] when parsing a log.

• --no-tab-ringlet

  Disable scrolling through panels when TAB is pressed or when a panel is selected using a numeric central.

• --no-html-last-updated

  Practice not prove the concluding updated field displayed in the HTML generated report.

• --no-parsing-spinner

  Do now show the progress metrics and parsing spinner.

SERVER OPTIONS

• --addr=<address>

  Specify IP address to bind the server to. Otherwise it binds to 0.0.0.0.

  Usually there is no demand to specify the address, unless you lot intentionally would like to demark the server to a unlike address within your server.

• --daemonize

  Run GoAccess as daemon (only if --real-time-html enabled).

• --user-name=<username>

  Run GoAccess as the specified user.

  Annotation: Note: It's important to ensure the user or the users' group can admission the input and output files every bit well as any other files needed. Other groups the user belongs to will exist ignored. As such information technology'south advised to run GoAccess behind a SSL proxy as it's unlikely this user can access the SSL certificates.

• --origin=<url>

  Ensure clients ship the specified origin header upon the WebSocket handshake. The specified origin should expect exactly to the origin header field sent by the browser. e.g., --origin=http://goaccess.io

• --pid-file=<path/goaccess.pid>

  Write the daemon PID to a file when used along the --daemonize option.

• --port=<port>

  Specify the port to use. Past default GoAccess listens on port 7890 for the WebSocket server. Ensure this port is opened.

• --existent-time-html

  Enable existent-time HTML output.

• --ws-url=<[scheme://]url[:port]>

  URL to which the WebSocket server responds. This is the URL supplied to the WebSocket constructor on the customer side.

  Optionally, it is possible to specify the WebSocket URI scheme, such as ws:// or wss:// for unencrypted and encrypted connections. east.g., wss://goaccess.io

  If GoAccess is running behind a proxy, you could prepare the client side to connect to a dissimilar port by specifying the host followed by a colon and the port. due east.g., goaccess.io:9999

  By default, it will effort to connect to the generated study'due south hostname. If GoAccess is running on a remote server, the host of the remote server should be specified here. Besides, brand sure information technology is a valid host and NOT an http address.

• --fifo-in=<path/file>

  Creates a named pipe (FIFO) that reads from on the given path/file.

• --fifo-out=<path/file>

  Creates a named pipe (FIFO) that writes to the given path/file.

• --ssl-cert=<path/cert.crt>

  Path to TLS/SSL certificate. In order to enable TLS/SSL back up, GoAccess requires that --ssl-cert and --ssl-primal are used.
  Only if configured using --with-openssl

• --ssl-key=<path/priv.key>

  Path to TLS/SSL individual key. In order to enable TLS/SSL back up, GoAccess requires that --ssl-cert and --ssl-key are used.
  Only if configured using --with-openssl

FILE OPTIONS

• -

  The log file to parse is read from stdin.

• -f --log-file=<logfile>

  Specify the path to the input log file. If prepare in the config file, it will accept priority over -f from the command line.

• -l --debug-file=<filename>

  Send all debug letters to the specified file. Needs to be configured with --enable-debug

• -p --config-file=<configfile>

  Specify a custom configuration file to use. If set, information technology will have priority over the global configuration file (if any).

• --invalid-requests=<filename>

  Log invalid requests to the specified file.

• --unknowns-log=<filename>

  Log unknown browsers and OSs to the specified file.

• --no-global-config

  Do non load the global configuration file. This directory should normally be /usr/etc/, /etc/ or /usr/local/etc/, unless specified with --sysconfdir=/dir at the time of running ./configure

PARSE OPTIONS

• -a --agent-listing

  Enable a list of user-agents by host. For faster parsing, practice not enable this flag.

• -d --with-output-resolver

  Enable IP resolver on the HTML or JSON output.

• -e --exclude-ip <IP|IP-range>

  Exclude an IPv4 or IPv6 from being counted. Ranges tin be included as well using a dash in between the IPs (first-stop).

  • exclude-ip 127.0.0.1
  • exclude-ip 192.168.0.1-192.168.0.100
  • exclude-ip ::1
  • exclude-ip 0:0:0:0:0:ffff:808:804-0:0:0:0:0:ffff:808:808
• -H --http-protocol=<yes|no>

  Set up/unset HTTP asking protocol. This will create a asking cardinal containing the request protocol + the actual request.

• -Yard --http-method=<yep|no>

  Set/unset HTTP request method. This volition create a request key containing the request method + the actual request.

• -o --output=<json|csv|html>

  Write output to stdout given 1 of the following files and the corresponding extension for the output format:
  

  • /path/file.csv - Comma-separated values (CSV)
  • /path/file.json - JSON (JavaScript Object Annotation)
  • /path/file.html - HTML
• -q --no-query-cord

  Ignore request'due south query cord. i.e., www.google.com/folio.htm?query => www.google.com/page.htm
  Note: Removing the query string can greatly decrease memory consumption, peculiarly on timestamped requests.

• -r --no-term-resolver

  Disable IP resolver on final output.

• --444-as-404

  Care for non-standard status code 444 as 404.

• --4xx-to-unique-count

  Add 4xx client errors to the unique visitors count.

• --anonymize-ip

  Anonymize the client IP accost. The IP anonymization option sets the last octet of IPv4 user IP addresses and the final 80 bits of IPv6 addresses to zeros. e.g.,

                192.168.xx.100 => 192.168.20.0 								2a03:2880:2110:df07:face up:b00c::1 => 2a03:2880:2110:df07::            

• --anonymize-level==<1|2|3>

  Specifies the anonymization levels: 1 => default, 2 => stiff, three => pedantic.

  ┌────────────┬─────────┬─────────┬─────────┐ │Bits-hidden │ Level 1 │ Level 2 │ Level 3 │ ├────────────┼─────────┼─────────┼─────────┤ │IPv4        │ eight       │ 16      │ 24      │ ├────────────┼─────────┼─────────┼─────────┤ │IPv6        │ 64      │ 80      │ 96      │ └────────────┴─────────┴─────────┴─────────┘            

• --all-static-files

  Include static files that contain a query string.

• --browsers-file=<path>

  By default GoAccess parses an "essential/basic" curated listing of browsers & crawlers. If you need to add together additional browsers, utilise this pick. Include an boosted tab delimited list of browsers/crawlers/feeds etc. See config/browsers.list.
  Note: The SIZE of the listing is proportional to the run time. Thus, the longer the listing, the more time GoAccess volition take to parse it.

• --date-spec=<appointment|hr|min>

  Set the engagement specificity to either date (default), 60 minutes to brandish hours or min to display minutes appended to the date.
  This is used in the visitors panel. Information technology's useful for tracking visitors at the hour level. For case, an hour specificity would yield to display traffic equally xviii/December/2010:nineteen or infinitesimal specificity 18/December/2010:19:59.

• --double-decode

  Decode double-encoded values. This includes, user-agent, asking, and referrer.

• --enable-panel=<PANEL>

  Enable parsing/displaying the given console. List of panels:

  • VISITORS
  • REQUESTS
  • REQUESTS_STATIC
  • NOT_FOUND
  • HOSTS
  • OS
  • BROWSERS
  • VISIT_TIMES
  • VIRTUAL_HOSTS
  • REFERRERS
  • REFERRING_SITES
  • KEYPHRASES
  • STATUS_CODES
  • REMOTE_USER
  • CACHE_STATUS
  • GEO_LOCATION
  • MIME_TYPE
  • TLS_TYPE
• --hide-referrer<NEEDLE>

  Hibernate a referrer just yet count information technology. Wild cards are allowed in the needle. i.e., *.bing.com.

• --hour-spec=<60 minutes|min>

  Gear up the time specificity to either hour (default) or min to display the tenth of an hour appended to the 60 minutes.
  This is used in the time distribution console. Information technology's useful for tracking peaks of traffic on your server at specific times.

• --ignore-crawlers

  Ignore crawlers.

• --ignore-panel=<Panel>

  Ignore parsing/displaying the given console. Listing of panels:

  • VISITORS
  • REQUESTS
  • REQUESTS_STATIC
  • NOT_FOUND
  • HOSTS
  • OS
  • BROWSERS
  • VISIT_TIMES
  • VIRTUAL_HOSTS
  • REFERRERS
  • REFERRING_SITES
  • KEYPHRASES
  • STATUS_CODES
  • REMOTE_USER
  • CACHE_STATUS
  • GEO_LOCATION
  • MIME_TYPE
  • TLS_TYPE
• --ignore-referrer=<referrer>

  Ignore referrers from beingness counted. Wildcards allowed. east.g., *.domain.com ww?.domain.*

• --ignore-referrer-written report

  Hide referrers from output report only.

• --ignore-statics=<req|console>

  Ignore static file requests.

  • req = Just ignore request from valid requests
  • panel = Ignore request from panels.
  Note: It will count them towards the total number of requests.
• --ignore-condition=<STATUS>

  Ignore parsing and displaying i or multiple condition code(s). For multiple condition codes, use this option multiple times.

• --keep-last=<ndays>

  Keep the terminal specified number of days in storage. This volition recycle the storage tables. e.yard., keep & evidence but the last 7 days.

• --no-ip-validation

  Disable client IP validation. Useful if IP addresses have been obfuscated earlier beingness logged.

  Notation: The log still needs to incorporate a placeholder for %h, normally information technology'southward a resolved IP. e.m. ord37s19-in-f14.1e100.internet.
• --no-strict-status

  Disable HTTP status lawmaking validation. Some servers would record this value only if a connection was established to the target and the target sent a response. Otherwise, information technology could be recorded every bit -.

• --num-tests=<number>

  Number of lines from the admission log to exam against the provided log/date/time format. By default, the parser is gear up to examination 10 lines. If prepare to 0, the parser won't examination any lines and will parse the whole access log. If a line matches the given log/engagement/time format before it reaches number, the parser will consider the log to be valid, otherwise GoAccess will return EXIT_FAILURE and display the relevant error letters.

• --procedure-and-exit

  Parse log and leave without outputting data. Useful if we are looking to merely add new data to the on-disk database without outputting to a file or a terminal.

• --real-os

  Display real OS names. e.g, Windows XP, Snow Leopard.

• --sort-panel=<Console,FIELD,Lodge>

  Sort panel on initial load. Sort options are separated by comma. Options are in the grade: Console,METRIC,ORDER
  Available Metrics

  • BY_HITS Sort by hits
  • BY_VISITORS Sort past unique visitors
  • BY_DATA Sort by information
  • BY_BW Sort past bandwidth
  • BY_AVGTS Sort by average time served
  • BY_CUMTS Sort by cumulative time served
  • BY_MAXTS Sort by maximum time served
  • BY_PROT Sort by http protocol
  • BY_MTHD Sort by http method
  Available orders
  • ASC
  • DESC
• --static-file=<extension>

  Add static file extension. due east.thou.: .mp3. Extensions are case sensitive.

GEOLOCATION OPTIONS

GeoIP Legacy

Legacy GeoIP has been discontinued. If your Linux distribution does not ship with the legacy databases, you may nevertheless be able to discover them through different sources. Make sure to download the .dat files.

Distributed with Creative Commons Attribution-ShareAlike 4.0 International License. https://mailfud.org/geoip-legacy/

          # IPv4 Land database:                     # Download the GeoIP.dat.gz                     # gunzip GeoIP.dat.gz                     #                     # IPv4 City database:                     # Download the GeoIPCity.dat.gz                     # gunzip GeoIPCity.dat.gz        

• -g --std-geoip

  Standard GeoIP database for less memory usage.

GeoIP2

For GeoIP2 databases, you can utilize DB-IP Lite databases.

DB-IP is licensed under a Creative Commons Attribution 4.0 International License. https://db-ip.com/db/calorie-free.php

Or y'all can download them from MaxMind https://dev.maxmind.com/geoip/geoip2/geolite2/

          # For GeoIP2 City database:                     # Download the GeoLite2-City.mmdb.gz                     # gunzip GeoLite2-Metropolis.mmdb.gz                     #                     # For GeoIP2 Land database:                     # Download the GeoLite2-Country.mmdb.gz                     # gunzip GeoLite2-Country.mmdb.gz        

• --geoip-database <geocityfile>

  Specify path to GeoIP database file. i.e., GeoLiteCity.dat. File needs to be downloaded from maxmind.com. IPv4 and IPv6 files are supported as well. Annotation: --geoip-city-information is an alias of --geoip-database.
  Note: If using GeoIP2, yous will need to download the City/Land database from MaxMind and use the pick --geoip-database to specify the database. Currently cities are only shown in the hosts panel (per host).

OTHER OPTIONS

• -h --aid

  The help.

• -V --version

  Display version data and exit.

• -due south --storage

  Display electric current storage method. i.e., B+ Tree, Hash.

• --dcf

  Display the path of the default config file when -p is not used.

PERSISTENCE STORAGE OPTIONS

• --persist

  Persist parsed data into disk. If database files be, files will exist overwritten. This should be set to the first dataset. Run across examples below.

• --restore

  Load previously stored data from disk. If reading persisted data simply, the database files need to exist. Come across --persist and examples beneath.

• --db-path <dir>

  Path where the on-deejay database files are stored. The default value is the /tmp directory.
  

CUSTOM LOG/DATE FORMAT

GoAccess can parse most whatever weblog format.

Predefined options include, Common Log Format (CLF), Combined Log Format (XLF/ELF), including virtual host, W3C format (IIS) and Amazon CloudFront (Download Distribution).

GoAccess allows whatever custom format string likewise.

There are two ways to configure the log format. The easiest is to run GoAccess with -c to prompt a configuration window. Nonetheless this won't make information technology permanent, for that you will need to specify the format in the configuration file.

The configuration file resides under: %sysconfdir%/goaccess.conf or ~/.goaccessrc

Note %sysconfdir% is either /etc/, /usr/etc/ or /usr/local/etc/

fourth dimension-format The time-format variable followed past a space, specifies the log-format fourth dimension containing whatever combination of regular characters and special format specifiers. They all brainstorm with a percentage (%) sign. See `homo strftime`. %T or %H:%M:%Due south.

Note: If a timestamp is given in microseconds, %f must be used as time-format. If the timestamp is given in milliseconds %* must be used as time-format.

date-format The engagement-format variable followed by a space, specifies the log-format date containing any combination of regular characters and special format specifiers. They all begin with a percentage (%) sign. Run into `human strftime`.

Note: If a timestamp is given in microseconds, %f must exist used as appointment-format. If the timestamp is given in milliseconds %* must be used as date-format.

log-format The log-format variable followed by a space or \t for tab-delimited, specifies the log format cord.

SPECIFIERS

• %ten A date and time field matching the fourth dimension-format and date-format variables. This is used when a timestamp is given instead of the date and time existence in ii carve up variables.
• %ttime field matching the time-format variable.
• %ddate field matching the date-format variable.
• %vThe server name according to the canonical name setting (Server Blocks or Virtual Host).
• %eThis is the userid of the person requesting the certificate as determined by HTTP authentication.
• %CThe enshroud status of the object the server served.
• %hhost (the client IP accost, either IPv4 or IPv6)
• %rThe asking line from the client. This requires specific delimiters around the request (single quotes, double quotes, etc) to exist parsable. Otherwise, utilise a combination of special format specifiers such as %yard, %U, %q and %H to parse private fields.
  • Notation: Utilise either %r to get the total request OR %m, %U, %q and %H to form your asking, do not employ both.
• %mThe request method.
• %UThe URL path requested.
  • Note: If the query string is in %U, at that place is no need to employ %q. Even so, if the URL path, does not include whatsoever query cord, you may use %q and the query string will exist appended to the request.
• %qThe query string.
• %HThe request protocol.
• %sThe status code that the server sends back to the customer.
• %bThe size of the object returned to the customer.
• %RThe "Referer" HTTP request header.
• %uThe user-amanuensis HTTP request header.
• %1000The TLS encryption settings chosen for the connexion. (In Apache LogFormat: %{SSL_PROTOCOL}10).
• %kThe TLS encryption settings chosen for the connection. (In Apache LogFormat: %{SSL_CIPHER}ten).
• %MThe MIME-blazon of the requested resource. (In Apache LogFormat: %{Content-Blazon}o)
• %DThe time taken to serve the request, in microseconds.
• %TThe fourth dimension taken to serve the request, in seconds with milliseconds resolution.
• %L The time taken to serve the asking, in milliseconds as a decimal number.
• %^Ignore this field.
• %~Motility forrard through the log string until a not-infinite (!isspace) char is plant.
• ~hThe host (the client IP address, either IPv4 or IPv6) in a X-Forwarded-For (XFF) field.

Note
For XFF, GoAccess uses a special specifier which consists of a tilde before the host specifier, followed by the grapheme(due south) that delimit the XFF field, which are enclosed past curly braces (i.e., ~h{,"}).
For example, ~h{," } is used in order to parse "11.25.11.53, 17.68.33.17" field which is delimited by a double quote, a comma, and a space.

Note
In order to get the average, cumulative and maximum time served in GoAccess, you volition need to start logging response times in your spider web server. In Nginx you tin can add together $request_time to your log format, or %D in Apache.

Important
If multiple fourth dimension served specifiers or hosts are used at the same fourth dimension, the starting time option specified in the format string volition take priority over the other specifiers.

GoAccess requires the following fields:

• a valid IPv4/6 %h
• a valid engagement %d
• the request %r

INTERACTIVE KEYS

• F1 or hMain help.
• F5Redraw main window.
• qQuit the program, current window or collapse active module
• o or ENTERAggrandize selected module or open window
• 0-nine and Shift + 0Prepare selected module to active
• jWhorl down within expanded module
• kScroll up inside expanded module
• cReady or modify scheme color
• ^ fScroll forrard one screen within agile module
• ^ bScroll backward i screen inside active module
• TABIterate modules (forward)
• SHIFT + TABIterate modules (astern)
• southwardSort options for agile module
• /Search across all modules (regex allowed)
• nObserve position of the next occurrence
• gMove to the starting time particular or top of screen
• Gmove to the concluding item or lesser of screen

EXAMPLES

DIFFERENT OUTPUTS

To output to a terminal and generate an interactive report:

          # goaccess access.log        

To generate an HTML report:

          # goaccess access.log -a -o report.html        

To generate a JSON report:

          # goaccess admission.log -a -d -o report.json        

To generate a CSV file:

          # goaccess admission.log --no-csv-summary -o report.csv        

GoAccess also allows great flexibility for real-time filtering and parsing. For instance, to apace diagnose problems by monitoring logs since goaccess was started:

          # tail -f access.log | goaccess -        

And even better, to filter while maintaining opened a pipe to preserve real-time analysis, we can make utilize of tail -f and a matching pattern tool such as grep, awk, sed, etc:

          # tail -f access.log | grep -i --line-buffered 'firefox' | goaccess --log-format=COMBINED -        

or to parse from the get-go of the file while maintaining the pipe opened and applying a filter

          # tail -f -n +0 access.log | grep --line-buffered 'Firefox' | goaccess -o out.html --real-time-html -        

MULTIPLE LOG FILES

At that place are several ways to parse multiple logs with GoAccess. The simplest is to pass multiple log files to the command line:

          # goaccess access.log admission.log.one        

It's even possible to parse files from a piping while reading regular files:

          # true cat access.log.2 | goaccess access.log access.log.ane -        

Note that the unmarried dash is appended to the control line to allow GoAccess know that it should read from the pipe.

Now if nosotros desire to add together more than flexibility to GoAccess, we can do a series of pipes. For case, if nosotros would like to process all compressed log files access.log.*.gz in addition to the electric current log file, nosotros can do:

          # zcat access.log.*.gz | goaccess access.log -        

Note: On Mac OS X, employ gunzip -c instead of zcat.

Existent Time HTML OUTPUT

GoAccess has the ability to output real-time data in the HTML written report. You can fifty-fifty email the HTML file since it is composed of a single file with no external file dependencies, how keen is that!

The procedure of generating a real-time HTML report is very similar to the process of creating a static study. Only --existent-time-html is needed to make it real-time.

          # goaccess admission.log -o /usr/share/nginx/html/site/report.html --real-fourth dimension-html        

By default, GoAccess will apply the host name of the generated report. Optionally, yous can specify the URL to which the customer's browser will connect to. See http://goaccess.io/faq for a more than detailed example.

          # goaccess access.log -o study.html --real-time-html --ws-url=goaccess.io        

By default, GoAccess listens on port 7890, to utilize a unlike port other than 7890, you lot can specify it as (make sure the port is opened):

          # goaccess access.log -o study.html --real-time-html --port=9870        

And to bind the WebSocket server to a different accost other than 0.0.0.0, you tin can specify it as:

          # goaccess admission.log -o written report.html --real-fourth dimension-html --addr=127.0.0.1        

Note: To output existent time data over a TLS/SSL connectedness, you need to use --ssl-cert=<cert.crt> and --ssl-central=<priv.fundamental>.

WORKING WITH DATES

Another useful pipe would exist filtering dates out of the web log

The following will become all HTTP requests starting on 05/Dec/2010 until the finish of the file.

          # sed -north '/05\/Dec\/2010/,$ p' access.log | goaccess -a -        

or using relative dates such as yesterdays or tomorrows day:

          # sed -n '/'$(date '+%d\/%b\/%Y' -d 'ane week ago')'/,$ p' access.log | goaccess -a -        

If we want to parse only a sure time-frame from Engagement a to DATE b, we can do:

          # sed -n '/5\/Nov\/2010/,/5\/Dec\/2010/ p' access.log | goaccess -a -        

If we want to preserve only sure amount of data and recycle storage, we tin can keep only a certain number of days. For case to keep & show the concluding v days:

          # goaccess access.log --keep-concluding=v        

VIRTUAL HOSTS

Bold your log contains the virtual host field. For case:

          vhost.com:80 ten.131.40.139 - - [02/Mar/2016:08:14:04 -0600] "Become /shop/bag-p-20 HTTP/ane.1" 200 6715 "-" "Apache (internal dummy connection)"        

And yous would similar to append the virtual host to the request in order to run into which virtual host the top urls belong to

          awk '$8=$1$8' admission.log | goaccess -a -        

To exclude a list of virtual hosts you tin can do the following:

          # grep -v "`cat exclude_vhost_list_file`" vhost_access.log | goaccess -        

FILES, Condition CODES & BOTS

To parse specific pages, eastward.1000., page views, html, htm, php, etc. within a request:

          # awk '$7~/\.html|\.htm|\.php/' access.log | goaccess -        

Or to parse folio views with out extesion, eastward.one thousand., /contact /profile/user

          # awk '$7!~/\..*$/' admission.log | goaccess -        

Notation, $7 is the request field for the common and combined log format, (without Virtual Host), if your log includes Virtual Host, so y'all probably want to use $8 instead. It'due south best to check which field you are shooting for, due east.yard.:

          # tail -10 access.log | awk '{print $eight}'        

Or to parse a specific status code, e.g., 500 (Internal Server Error):

          # awk '$9~/500/' admission.log | goaccess -        

Or multiple status codes:

          # tail -f -n +0 access.log | awk '$nine~/three[0-ix]{2}|5[0-9]{ii}/' | goaccess -o out.html -        

And to get an estimated overview of how many bots (crawlers) are hitting your server:

          # tail -F -n +0 access.log | grep -i --line-buffered 'bot' | goaccess -        

SERVER

Also, it is worth pointing out that if we want to run GoAccess at lower priority, we tin run information technology as:

          # nice -northward nineteen goaccess access.log -a        

and if yous don't want to install it on your server, you can still run it from your local auto:

          # ssh -due north root@server 'tail -f /var/log/apache2/access.log' | goaccess -        

Note: SSH requires -n and so GoAccess tin can read from stdin. Also, make sure to use SSH keys for authentication as information technology won't work if a passphrase is required.

PROCESSING LOGS INCREMENTALLY

GoAccess has the ability to process logs incrementally through its internal storage and dump its data to deejay. It works in the post-obit way:

• A dataset must exist persisted first with --persist, and then the aforementioned dataset can be loaded with
• --restore. If new information is passed (piped or through a log file), it will append it to the original dataset.

Note

GoAccess keeps rail of inodes of all the files processed (assuming files volition stay on the same sectionalization) along with the terminal line parsed of each file and the timestamp of the last line parsed. due east.1000., inode:29627417|line:20012|ts:20171231235059

If the inode does non friction match the current file, it parses all lines. If the current file matches the inode, it then reads the remaining lines and updates the count of lines parsed and the timestamp. As an extra precaution, information technology won't parse log lines with a timestamp ≤ than the i stored.

Piped data works based off the timestamp of the concluding line read. For instance, information technology will parse and discard all incoming entries until it finds a timestamp >= than the 1 stored.

Important
Since piped data works based on a timestamp and in that location's no way to determine the inode nor the last line parsed, some issues could arise. For example, a piped log could have multiple consecutive lines with the aforementioned timestamp (even at the second level), and then information technology's likely to end up with duplicates entries. However, as a all-time practice and a reasonable assumption is that in virtually cases, for incremental log processing, users will parse data direct with goaccess instead of piping it through.

Important
Previous Tokyo Cabinet database files are not compatible with the new database files. You volition need to parse your logs from scratch.

Examples

          // concluding month access log                     # goaccess access.log.one --persist        

so, load it with

          // suspend this month access log, and preserve new data                     # goaccess access.log --restore --persist        

To read persisted information only (without parsing new information)

          # goaccess --restore        

NOTES

Each active panel has a full of 366 items or 50 in the existent-fourth dimension HTML report. The number of items is customizable using max-items However, but the CSV and JSON output allow a maximum number greater than the default value of 366 items per panel.

A hit is a request (line in the access log), e.g., 10 requests = x hits. HTTP requests with the aforementioned IP, engagement, and user agent are considered a unique visit.

BUGS

If you think you have found a bug, please ship me an email to

Gerardo Orellana. For more details nigh it, or new releases, delight visit http://goaccess.io

willoughbyhadd2001.blogspot.com

Source: https://goaccess.io/man

Share this post