allinurl / goaccess

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.
https://goaccess.io
MIT License
18.38k stars 1.11k forks source link

Difference between hits and visitors #2133

Closed kaushalshriyan closed 3 years ago

kaushalshriyan commented 3 years ago

Hi,

I am new to goaccess. I am not sure if I understand the difference between hits and visitors. Any examples to understand better? I am attaching the screenshot for reference.

Screenshot 2021-06-09 at 10 36 25 PM
allinurl commented 3 years ago

Hello,

Hits are HTTP requests (one line in your access log) that your web server served to the client. For instance, each of these would be one hit: index.html, image.jpg, main.css, etc.

On the other hand, a request with the same IP, date, and user agent are considered a visitor (unique visitor).

Let me know if that answers your question.

allinurl commented 3 years ago

To expand on your screenshot,

You served 41,139 HTTP requests but only to 1,380 unique visitors (that includes bots/spiders/crawlers) for a total of 3.44GiB data transferred out of your web server.

kaushalshriyan commented 3 years ago

Thanks a lot Gerardo for the explanation

kaushalshriyan commented 3 years ago

@allinurl Thanks a lot for the explanation and appreciate it. I am running the below version.

$goaccess -V GoAccess - 1.5. For more details visit: https://goaccess.io/ Copyright (C) 2009-2020 by Gerardo Orellana

Build configure arguments: --enable-geoip=mmdb

Is there a way to find out the geographical location of the source IP request? Also is there a monitoring feature available if there is any spike or surge in the HTTP hits and visits traffic from the users. Any way to generate a report for a time period of 1 week, 15 days, 1 month, or 3 months ...? Thanks in advance.

kaushalshriyan commented 3 years ago

@allinurl I have a follow-up question regarding Data field /user/login and /

15,303 (37.20%) for /user/login 8,512 (20.69%) for /

I am confused regarding the statistics. Ideally, users will hit / and then /user/login, resulting in 15,303 and 8,512 respectively. But the report shows exactly the opposite. Please comment. Thanks in advance.

I am attaching the screenshot for your reference.

Screenshot 2021-06-11 at 11 12 15 PM Screenshot 2021-06-11 at 11 17 52 PM
allinurl commented 3 years ago

Please take a look at the config file, there are instructions on how to use mmdb (geolocation). Once you download the database file, just feed that to goaccess. e.g.,

goaccess access.log -o report.html --geoip-database /usr/local/share/GeoIP/GeoLite2-Country.dat

As far as /user/login and /, hard to tell without knowing your traffic patterns, it's possible many of your users have /user/login bookmarked and they directly go to that page instead of hitting the / first. #117 will help a lot to know better why this is happening, though I'm working on this right now and will get out in the next major release. Also, #1175 will address the monitoring and alerts that you asked. This is coming soon in the pipeline. Stay tuned :)

Hope that helps.

kaushalshriyan commented 3 years ago

@allinurl I am attaching the goaccess.conf file for your reference. when I am hitting https://mydomain.com/report.html. The report.html is not getting updated. It shows the same data again and again when I browse https://mydomain.com/ by clicking on links and other pages. Please guide.

goaccess.conf.txt

cd /var/log/nginx

goaccess access.log --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u" %^' --date-format=%d/%b/%Y --time-format=%T -o /var/www/html/test/marketplace-v2/mpV2/web/report.html --real-time-html
WebSocket server ready to accept new client connections
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Active: 0
Accepted: 13 192.168.0.10
Accepted: 14 192.168.0.10
Accepted: 15 192.168.0.10
Active: 2
Active: 1
Active: 0
Accepted: 13 192.168.0.10

Active: 0
Accepted: 13 192.168.0.10
Active: 0
allinurl commented 3 years ago

What's the output from your browser's console? Also, please make sure you have port 7890 opened and I'd try telnet the server. e.g.,

# telnet server.host 7890
kaushalshriyan commented 3 years ago

$nc -v 192.168.0.178 7890 Connection to 192.168.0.178 port 7890 [tcp/*] succeeded!

[root@ ~]# netstat -anp | grep 7890 tcp 0 0 0.0.0.0:7890 0.0.0.0:* LISTEN 16412/goaccess [root@ ~]#

Screenshot 2021-06-21 at 6 10 13 AM
allinurl commented 3 years ago

Do you have some sort extension in your browser blocking certain content? Are you able to try on a different browser or perhaps incognito? Also, make sure if you are opening the report via https, you will need to pass an ssl cert and key to goaccess.

kaushalshriyan commented 3 years ago

@allinurl Thanks a Lot. I am able to set it up now and it works like a charm. It is very good software. I am liking it. Any way to generate a report for a time period of 1 week, 15 days, 1 month, or 3 months ...? Any timelines if the feature is not available? Thanks in advance.

allinurl commented 3 years ago

Glad it is working for you :)

117 will implement that. I'm working on it as we speak and hoping it will be out soon. A workaround would be to use sed, awk, etc.

# sed -n '/'$(date '+%d\/%b\/%Y' -d '1 week ago')'/,$ p' access.log | goaccess -a - -o report.html

The man page has some examples when working with dates.

Stay tuned for the upcoming releases.

Closing this. Feel free to reopen it if needed.