All Operating Systems and Browsers "Unknown" in GoAccess 1.9.1

[angryghandi]

I've tried a variety of things to get the Operating Systems and Browsers to parse properly but everything I've done has ended with the same result - both are 100% Unknown for every line in the log file.

Here is the most basic example of our log lines:

118.69.34.89 - - [19/Mar/2024:00:01:02 -0500] "GET / HTTP/1.1" 200 7911 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
118.69.34.89 - - [19/Mar/2024:00:01:31 -0500] "GET / HTTP/1.1" 200 6190 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"

Produced by an Apache configuration of:

LogFormat "%h %l %u %t "%r" %>s %O "%{Referer}i" "%{User-Agent}i"" combined

To make things easier I just run this through GoAccess using docker:

cat access.log | \
docker run --rm -i -e LANG=$LANG allinurl/goaccess -a -o html \
--log-format='%h %l %u %^[%d:%t %^] "%r" %s %b "%R" "%u"' - \
--time-format '%H:%M:%S' \
--date-format '%d/%b/%Y' \
> report.html

Any suggestions on what I'm missing would be appreciated.

[allinurl]

It seems to be a log-format problem. Have you experimented with using the COMBINED log format? For instance, --log-format=COMBINED.

[angryghandi]

--log-format=COMBINED got the Operating Systems and Browsers to display although I'm not exactly sure why given its not a perfect match of our log format.

I'll go verify the other results now and see if everything checks out.

Any idea why the COMBINED format is working and the custom log format does not?

[allinurl]

I'm glad that was helpful. GoAccess doesn't recognize %l, and the initial %u is likely trying to retrieve the user agent. You might want to consider using %e for the user instead. For example, you could use the format %h %^ %e [%d:%t %^] "%r" %s %b "%R" "%u".

[angryghandi]

That was exactly the issue - I updated log format to `--log-format='log-format %h %^ %e %^[%d:%t %^] "%r" %s %b "%R" "%u"' and that works as well but more accurately represents the contents of the log file.

Thanks for the quick and helpful feedback.