search

kassner / log-parser

PHP Web Server Log Parser Library
Apache License 2.0
339 stars 64 forks source link

Fatal error: Uncaught Kassner\LogParser\FormatException #46

Closed Bluscream closed 4 years ago

Bluscream commented 4 years ago 
Fatal error: Uncaught Kassner\LogParser\FormatException: 78.129.237.156 - - [10/Jun/2020:00:01:31 +0200] "GET /?action=display&bridge=FB2&u=complexdoc&format=Mrss HTTP/1.1" 200 81701 "-" "RSSMix/3.0" "78.129.237.156" in /var/www/html/admin/vendor/kassner/log-parser/src/LogParser.php:82 Stack trace: #0 /var/www/html/admin/access.log.php(16): Kassner\LogParser\LogParser->parse('78.129.237.156 ...') #1 {main} thrown in /var/www/html/admin/vendor/kassner/log-parser/src/LogParser.php on line 82

nginx.conf:

    log_format  main  '$remote_addr - $remote_user [$time_local] "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';

php file:

//'$remote_addr - $remote_user [$time_local] "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
$parser->setFormat('%a - %u [%t] "%v" "%r" %>s %O "%{Referer}i" \"%{User-Agent}i" "{X-Forwarded-For}i"');

access.log:

172.68.189.227 - - [10/Jun/2020:17:46:46 +0200] "minopia.de" "POST / HTTP/1.1" 405 575 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "13.91.103.115"
Bluscream commented 4 years ago

I tried modifying it in favor of better readability:

Fatal error: Uncaught Kassner\LogParser\FormatException: [10/Jun/2020:18:01:45 +0200] IP:"192.168.2.29" (FWD:"-") USER:"blu" DOMAIN:"192.168.2.38" REQUEST:"GET /admin/access.log.php HTTP/1.1" STATUS:200 BYTES_SENT:31 REFERER:"http://192.168.2.38/admin/" UA:"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0" in /var/www/html/admin/vendor/kassner/log-parser/src/LogParser.php:82 Stack trace: #0 /var/www/html/admin/access.log.php(18): Kassner\LogParser\LogParser->parse('[10/Jun/2020:18...') #1 {main} thrown in /var/www/html/admin/vendor/kassner/log-parser/src/LogParser.php on line 82
// '[$time_local] IP:"$remote_addr" (FWD:"$http_x_forwarded_for") USER:"$remote_user" DOMAIN:"$host" REQUEST:"$request" STATUS:$status BYTES_SENT:$body_bytes_sent REFERER:"$http_referer" UA:"$http_user_agent"';
$parser->setFormat('[%t] IP:"%h" (FWD:"%{X-Forwarded-For}i") USER:"%u" DOMAIN:"%v" REQUEST:"%r" STATUS:%>s BYTES_SENT:%O REFERER:"%{Referer}i" UA:"%{User-Agent}i"');
Sophist-UK commented 4 years ago

My attempt at a better format:

Fatal error: Uncaught Kassner\LogParser\FormatException: 
    [10/Jun/2020:18:01:45 +0200] 
    IP:"192.168.2.29" 
    (FWD:"-") 
    USER:"blu" 
    DOMAIN:"192.168.2.38" 
    REQUEST:"GET /admin/access.log.php HTTP/1.1" 
    STATUS:200 
    BYTES_SENT:31 
    REFERER:"http://192.168.2.38/admin/" UA:"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0" 
    in /var/www/html/admin/vendor/kassner/log-parser/src/LogParser.php:82 
Stack trace: 
    #0 /var/www/html/admin/access.log.php(18): Kassner\LogParser\LogParser->parse('[10/Jun/2020:18...') 
    #1 {main} thrown in /var/www/html/admin/vendor/kassner/log-parser/src/LogParser.php on line 82

// '[$time_local] IP:"$remote_addr" (FWD:"$http_x_forwarded_for") USER:"$remote_user" DOMAIN:"$host" REQUEST:"$request" STATUS:$status BYTES_SENT:$body_bytes_sent REFERER:"$http_referer" UA:"$http_user_agent"';

$parser->setFormat('[%t] IP:"%h" (FWD:"%{X-Forwarded-For}i") USER:"%u" DOMAIN:"%v" REQUEST:"%r" STATUS:%>s BYTES_SENT:%O REFERER:"%{Referer}i" UA:"%{User-Agent}i"');
kassner commented 4 years ago

If you still have this problem, the issues are:

  1. %t already includes the square brackes ([ and ]);
  2. There is an extra \ before "%{User-Agent}i";
  3. The % before { is missing from "{X-Forwarded-For}i";
  4. By a limitation on how the parser was implemented, the library is looking for only one - when you're defining headers, so X-Forwarded-For will not work, but XForwarded-For will.

So your setFormat should be:

$parser->setFormat('%a - %u %t "%v" "%r" %>s %O "%{Referer}i" "%{User-Agent}i" "%{XForwarded-For}i"');

Which will yield:

object(Kassner\LogParser\SimpleLogEntry)#357 (11) {
  ["stamp"]=>
  int(1591804006)
  ["remoteIp"]=>
  string(14) "172.68.189.227"
  ["user"]=>
  string(1) "-"
  ["time"]=>
  string(26) "10/Jun/2020:17:46:46 +0200"
  ["serverName"]=>
  string(10) "minopia.de"
  ["request"]=>
  string(15) "POST / HTTP/1.1"
  ["status"]=>
  string(3) "405"
  ["sentBytes"]=>
  string(3) "575"
  ["HeaderReferer"]=>
  string(1) "-"
  ["HeaderUserAgent"]=>
  string(152) "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
  ["HeaderXForwardedFor"]=>
  string(13) "13.91.103.115"
}
Bluscream commented 4 years ago

Thanks a lot, will get to it when my php-fpm isn't broken anymore