search

allinurl / goaccess

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.
https://goaccess.io
MIT License
18.6k stars 1.11k forks source link

goacess web 400 Invalid request #989

Open cheshirrrrre opened 6 years ago

cheshirrrrre commented 6 years ago

I've installed goaccess, and no matter what i've tried, just can't make it respond as a service.

The last time i've configured it with --enable-debug and all i got now in console, is

ubuntu@nodeB:~$ /usr/local/bin/goaccess -f /var/log/nginx/cache_80.log -o /tmp/report.html --real-time-html --port=8022 --ws-url=127.0.0.1 --addr=127.0.0.1
WebSocket server ready to accept new client connections
Accepted: 12 127.0.0.1
Active: 0
Accepted: 12 127.0.0.1
Active: 0
Accepted: 12 127.0.0.1
Active: 0
Accepted: 12 127.0.0.1
Active: 0
Accepted: 12 127.0.0.1
Accepted: 13 127.0.0.1
Active: 1
Active: 0

but still got "400 Invalid Request"

I've followed instructions on https://github.com/allinurl/goaccess/issues/448 and https://github.com/allinurl/goaccess/issues/440 with no luck.

Ubuntu 16.04 goaccess-1.2.tar.gz

allinurl commented 6 years ago

Can you please try to build from development and let me know if that solves the issue for you.

Also, please try simply:

ubuntu@nodeB:~$ /usr/local/bin/goaccess /var/log/nginx/cache_80.log -o /tmp/report.html --real-time-html
cheshirrrrre commented 6 years ago

Hello.

I've opened 7890 tcp port in firewall for my IP

root@nodeB:~/goaccess# iptables -L -v -n | grep 7890 56 6006 ACCEPT tcp -- !lo * my_ip 0.0.0.0/0 tcp dpt:7890 root@nodeB:~/goaccess#

built dev version

Your build configuration: Prefix : /usr/local Package : goaccess Version : 1.2.1 Compiler flags : -pthread Linker flags : -lnsl -lncursesw -lGeoIP -lpthread
Dynamic buffer : no Geolocation : GeoIP Legacy Storage method : In-memory Hash Database (Default) TLS/SSL : no Bugs : goaccess@prosoftcorp.com

Made some changes in /usr/local/etc/goaccess.conf:

root@nodeB:~/goaccess# cat /usr/local/etc/goaccess.conf | egrep -v "^\s*($|#)" time-format %H:%M:%S date-format %d/%b/%Y log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u" log-format COMBINED

run it

ubuntu@nodeB:~$ /usr/local/bin/goaccess -f /var/log/nginx/cache_80.log -o /var/www/html/goaccess/report.html --real-time-html WebSocket server ready to accept new client connections

new report is where it must be:

root@nodeB:~/goaccess# file /var/www/html/goaccess/report.html /var/www/html/goaccess/report.html: HTML document, ASCII text, with very long lines root@nodeB:~/goaccess#

Ok, who's the owner?

root@nodeB:~/goaccess# ls -la /var/www/html/goaccess/report.html -rw-rw-r-- 1 ubuntu ubuntu 404917 Jan 12 11:20 /var/www/html/goaccess/report.html root@nodeB:~/goaccess#

What's in there? <!DOCTYPE html><html lang='en'><head><meta charset='UTF-8' /><meta http-equiv='X-UA-Compatible' content='IE=edge'><meta name='google' content='notranslate'><meta name='viewport' content='width=device-width, initial-scale=1'><meta name='robots' content='noindex, nofollow' /><title>Server&nbsp;Statistics</title><style> and so on

Here's netstat output:

root@nodeB:~/goaccess# netstat -plant | grep 7890 tcp 0 0 0.0.0.0:7890 0.0.0.0:* LISTEN 15381/goaccess
tcp 0 0 goaccess_ip:7890 my_ip:44858 TIME_WAIT

curl

root@vti-MS-7817:~# curl -v http://goaccess_ip:7890/

  • Trying goaccess_ip...
  • Connected to goaccess_ip (goaccess_ip) port 7890 (#0) GET / HTTP/1.1 Host: goaccess_ip:7890 User-Agent: curl/7.47.0 Accept: /

< HTTP/1.1 400 Invalid Request

  • no chunk, no close, no size. Assume close to signal end <
  • Closing connection 0

There's no problem in security, cause when i try to reach goaccess by curl on localhost, i get the same answer:

root@nodeB:~/goaccess# curl -v http://localhost:7890/

  • Trying ::1...
  • connect to ::1 port 7890 failed: Connection refused
  • Trying 127.0.0.1...
  • Connected to localhost (127.0.0.1) port 7890 (#0) GET / HTTP/1.1 Host: localhost:7890 User-Agent: curl/7.47.0 Accept: /

< HTTP/1.1 400 Invalid Request

  • no chunk, no close, no size. Assume close to signal end <
  • Closing connection 0 root@nodeB:~/goaccess#

The same file can be opened, cause i've configured nginx site

root@nodeB:~/goaccess# cat /etc/nginx/sites-enabled/goaccess.conf server { listen 8033; root /var/www/html/goaccess; location / { index report.html; auth_basic "Restricted Area"; auth_basic_user_file htpasswd; } }

root@nodeB:/var/www/html/goaccess# netstat -plant | grep 8033 tcp 0 0 0.0.0.0:8033 0.0.0.0:* LISTEN 14344/nginx
tcp 0 0 198.16.81.201:8033 my_ip:54666 ESTABLISHED 14501/nginx: worker

Info from browser console

Request headers (529 B)
Accept text/html,application/xhtml+xm…plication/xml;q=0.9,/;q=0.8 Accept-Encoding gzip, deflate Accept-Language en-US,en;q=0.5 Cache-Control no-cache Connection keep-alive, Upgrade DNT 1 Host goaccess_ip:7890 Origin http://goaccess_ip:8033 Pragma no-cache Sec-WebSocket-Extensions permessage-deflate Sec-WebSocket-Key 6xPZhOVlxDJsHVbrUS/JQA== Sec-WebSocket-Version 13 Upgrade websocket User-Agent Mozilla/5.0 (X11; Ubuntu; Linu…) Gecko/20100101 Firefox/57.0

allinurl commented 6 years ago

This seems to be an isolated issue, the only thing I can think of is some sort of invalid output being returned by the web socket server upon upgrading the connection.

Can you try parsing one or two lines from your log instead of the whole access log? Also, are you able to test it on a different machine? e.g., laptop, desktop just to see if it has something to do with that particular machine. Thanks.

allinurl commented 6 years ago

Any updates on this? Thanks.

ajurna commented 6 years ago

i am also having this issue with the latest dev version.

    [user@server logrotate.d]# curl -v http://127.0.0.1:7890/
    * About to connect() to 127.0.0.1 port 7890 (#0)
    *   Trying 127.0.0.1...
    * Connected to 127.0.0.1 (127.0.0.1) port 7890 (#0)
    > GET / HTTP/1.1
    > User-Agent: curl/7.29.0
    > Host: 127.0.0.1:7890
    > Accept: */*
    >
    < HTTP/1.1 400 Invalid Request
    * no chunk, no close, no size. Assume close to signal end
    <
    * Closing connection 0
ajurna commented 6 years ago

it seems it went away. this may be just an issue in the early processing section.

Haitianisgood commented 6 years ago

I am also having this issue in goaccess 1.2

I installed goaccess in docker useing images by myself! ENV:

docker 18.03
goaccess 1.2

docker command

docker run -it -p 7890:7890 -v "/var/log/nginx/:/srv/logs" ubuntu:14.04

I run goaccess command in docker container

goaccess -f /srv/logs/access.log -o state.html --real-time-html --date-spec=hr --hour-spec=min --ws-url=goaccess.haitian.com

I visit it in Chrome:

Request URL:http://goaccess.haitian.com:7890/ Request Method:GET Status Code:400 Invalid Request Remote Address:172.16.85.104:7890 Request Headers view source Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Encoding:gzip, deflate, sdch Accept-Language:zh-CN,zh;q=0.8 Cache-Control:max-age=0 Connection:keep-alive Host:goaccess.haitian.com:7890 Upgrade-Insecure-Requests:1 User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36`

allinurl commented 6 years ago

@Haitianisgood are you following these steps?

Haitianisgood commented 6 years ago

@allinurl Yes,I dit it following:Build from release

andreobrown commented 6 years ago

I'm having this issue as well.

OS: Ubuntu 16.04.3 LTS GoAccess Version: 1.2

Command: goaccess -f /var/log/nginx/access.log -o report.html --real-time-html --addr=127.0.0.1 --port=9876

Result:

curl -v  localhost:9876
* Rebuilt URL to: localhost:9876/
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 9876 (#0)
> GET / HTTP/1.1
> Host: localhost:9876
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 400 Invalid Request
* no chunk, no close, no size. Assume close to signal end
<
* Closing connection 0
allinurl commented 6 years ago

Are you sure you have the port opened and the right address bound to it? Here's what I get for a invalid and valid port:

root@host:/home/user#  curl -v  rt.goaccess.io:7890
* About to connect() to rt.goaccess.io port 7890 (#0)
*   Trying 162.243.249.101...
* connected
* Connected to rt.goaccess.io (162.243.249.101) port 7890 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.26.0
> Host: rt.goaccess.io:7890
> Accept: */*
>
* additional stuff not fine transfer.c:1042: 0 0
* HTTP 1.1 or later with persistent connection, pipelining supported
< HTTP/1.1 400 Invalid Request
* no chunk, no close, no size. Assume close to signal end
<
* Closing connection #0

root@host:/home/user#  curl -v  rt.goaccess.io:9870
* About to connect() to rt.goaccess.io port 9870 (#0)
*   Trying 162.243.249.101...
* connected
* Connected to rt.goaccess.io (162.243.249.101) port 9870 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.26.0
> Host: rt.goaccess.io:9870
> Accept: */*
>
* additional stuff not fine transfer.c:1042: 0 0
* Empty reply from server
* Connection #0 to host rt.goaccess.io left intact
curl: (52) Empty reply from server
* Closing connection #0
andreobrown commented 6 years ago

@allinurl This is all being tested locally, binding to 127.0.0.1, so there are no ports to open.

anduingaiden commented 5 years ago

Any update on this?

I am using version 1.3 and having the same problem here.

I can start the goaccess in real time report mode but when I try to access it I receive the http 400 error too. It happens despite of being doing the request from the same machine where goaccess is running or from a different machine. (Obs.: port 7890 is open to external connections)

Starting GoAccess root@tt2-we-vm-hap01:/etc/goaccess# goaccess /var/log/haproxy/haproxy.log -o report.html --real-time-html --log-format='%^ %^ %^:%^:%^ %^ %^[%^]: %h:%^ [%d:%t.%^] %^ %^ %^/%^/%^/%^/%L %s %b %^ %^ %^ %^/%^/%^/%^/%^ %^/%^ "%r"' --date-format='%d/%b/%Y' --time-format='%H:%M:%S' WebSocket server ready to accept new client connections

CURL

`root@tt2-we-vm-hap01:~# curl -v http://127.0.0.1:7890

NETSTAT

root@tt2-we-vm-hap01:~# netstat -plant | grep 7890 tcp 0 0 0.0.0.0:7890 0.0.0.0:* LISTEN 50871/goaccess tcp 0 0 127.0.0.1:7890 127.0.0.1:57016 TIME_WAIT - root@tt2-we-vm-hap01:~#

marcelboccato commented 5 years ago

Facing same problem here:

curl -v http://127.0.0.1:8080/report.html

allinurl commented 5 years ago

@marcelboccato I'm not able to reproduce this on my side. Are you able to post a bit more about your environment? also, are you able to test this out on a different machine and see if it's isolated to a particular box? Thanks.

guoweikuang commented 5 years ago

@allinurl CentOS Linux release 7.3.1611 (Core) goaccess 1.3 version Install goaccess by make

2019-02-27 4 01 00 2019-02-27 4 01 14

yourmoonlight commented 5 years ago

had the same issues here

allinurl commented 5 years ago

@yourmoonlight I think this was addressed upstream. Could you please try building from development and let me know if that solved the issue? Thanks.

dcalsky commented 4 years ago

This port's protocol WS rather than HTTP, so You can not get response by visiting this address and port with HTTP.

This correct way is that launch a web server like Nginx to serve the generated html file.