OVH CDN log file format

[gmarcon]

I am unable to parse log files provided by my CDN provider (OVH), I get the "No valid hits" error.

This is a sample line from the log file:
84.152.142.102 www.customerdomain.es - [04/Mar/2015:00:00:05 +0100] "GET /skin/frontend/customer/enterprise/images/flags/flag-poland.png HTTP/1.1 200 0" http://www.salewa.es/es/ropa/hombre/chaquetas.html Mozilla/5.0 (Linux; Android 4.4.2; Aquaris E4.5 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.109 Mobile Safari/537.36 "" ""

I tried this Log Format:
%h %^[%d:%^] "%r %s %b" %R %u "" ""
With this Date Format:
%d/%b/%Y

Do you have any hints on what am I doing wrong?

Thank you and regards,
Giulio

[allinurl]

Interesting format. Do you know how is the referer and the user agent delimited? Usually they are within double quotes

[Alexhha]

I have the same problem. My Apache LogFormat looks like the following

LogFormat "%V %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vhost-combined
CustomLog logs/access_log vhost-combined

kitchenstyle.example.net 109.86.xxx.xxx - user [05/Mar/2015:20:33:53 +0000] "GET /skin/adminhtml/default/default/images/cancel_btn_icon.gif HTTP/1.1" 200 648 "http://kitchenstyle.example.net/skin/adminhtml/default/default/boxes.css" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36"

I'm using GoAccess - 0.8.5 on CentOS 6.

[allinurl]

@Alexhha the following works for your log:

log-format %^ %h %^[%d:%^] "%r" %s %b "%R" "%u"
date-format %d/%b/%Y

[Alexhha]

I have complied devel version but as I can see there is no vhosts support?

[gmarcon]

As you see from the log neither the referer nor the user agent are delimited.
I am actually not interested in those fields, so also a format strings ignoring those two would work for me..

Thank you for your answer!

[allinurl]

@Alexhha As of v0.8.5, goaccess ignores the vhost part. However, issues #23 and #67 discuss the plan to have the data sliced based on virtual hosts.

[allinurl]

@gmarcon the following should work

%h %^[%d:%^] "%m %U %H %s %b"

you might even be able to get the referer part with:

%h %^[%d:%^] "%m %U %H %s %b" %R %^

[Alexhha]

It would be killer feature :) At the moment I have ~1850 vhosts and it very hard to analyze which one is load the whole system.

Will be waiting vhost support. Anyway thanks for the great project

[allinurl]

Closing this. Feel free to reopen it if needed.

[gmarcon]

Amazing, thank you very much, works like a charm!

[aphorise]

@gmarcon FYI you may wish to consider a better CDN as well - OVH are not the greatest unless you happen to be within 10Km of one of their 4 main DC's ;-)
You can consult 3rd party matricies and insights into the industry via eg: cedexis - if you dont have the technical means / reasources to measure.

[allinurl]

@Alexhha vhost support has been added to v0.9.5.

[Alexhha]

@allinurl
Sorry for the delay, but it's a great news. I will definitely try it. Thanks a lot