0

This is my log format:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy

Any ideas why I'm getting?

Parsed 10 lines producing the following errors:

Token '123.123.123.83,' doesn't match specifier '%h'
Token '123.123.123.183,' doesn't match specifier '%h'

I'm new to goaccess and still learning, please bear with me...

Here's an a few lines from the access_log, the formatting might not look very readible though:

123.13.123.83, 123.123.196.82 - - [10/Jun/2018:08:31:12 +0200] "GET /index.php/faqs/14-faqs/101-liquor-authority-faq HTTP/1.1" 200 39940 "http
s://www.google.com/search?hl=en-GB&q=liquor+licence+application+fees&sa=X&ved=0ahUKEwiB_ZzvusjbAhVFC8AKHSS6BB8Q1QIIPCgF" "Mozilla/5.0 (BB10; T
ouch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.13.123.83, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /cache/widgetkit/widgetkit-86051325.css HTTP/1.1" 304 - "http://www.abcdef
.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 M
obile Safari/537.35+"
123.13.1123.83, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /plugins/content/accordionfaq/css/css.php?id=accordion1&faq=blueaccordion
faq HTTP/1.1" 200 2369 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+
(KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /cache/widgetkit/widgetkit-41cccc93.js HTTP/1.1" 304 - "http://www.abcdef
.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 M
obile Safari/537.35+"
111.115.144.236, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /index.php/2013-07-09-21-44-18/2013-07-11-05-51-45 HTTP/1.1" 200 32536 "
-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0; ARM; Touch; WPDesktop)"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:14 +0200] "GET /media/widgetkit/widgets/mediaplayer/mediaelement/mediaelement-and-player
.js?_=1528612274054 HTTP/1.1" 200 63289 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) App
leWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:14 +0200] "GET /media/widgetkit/widgets/lightbox/js/lightbox.js?_=1528612274053 HTTP/1.1
" 200 17068 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, lik
e Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:14 +0200] "GET /media/widgetkit/widgets/spotlight/js/spotlight.js?_=1528612274055 HTTP/1
.1" 200 2462 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, li
ke Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
0

Although it would be great if you could post a few lines from your access log, I'd try this:

goaccess access.log --log-format='~h{, } %^[%d:%t %^] "%r" %s %b "%R" "%u"' --date-format=%d/%b/%Y --time-format=%T
  • Thank you very much Arwen. It seems to be working 100%! – J P Aug 27 '18 at 12:22
  • I've added a few lines of my access log to the original question. Thanx again for your help. – J P Aug 27 '18 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.