Parsing Issue NGINX: ==33== Token '009' doesn't match specifier '%s'

[Estradamis]

I tried to setup GoAccess with docker-compose

version: '3'
services:
  goaccess:
      image: xavierh/goaccess-for-nginxproxymanager:latest
      container_name: goaccess
      restart: always
      environment:
        - TZ=Europe/Berlin
        - SKIP_ARCHIVED_LOGS=False
        - DEBUG=True
        - LOG_TYPE=NPM
      volumes:
        - /opt/npm/data/logs:/opt/log

to access my NGINX Proxy Manager logs. It can collect the logs however it seems like the parsing is not done correctly:

2023-02-23T16:59:21.430567971Z ==33== FILE: /goaccess-config/archive.log
2023-02-23T16:59:21.430570796Z ==33== Parsed 20 lines producing the following errors:
2023-02-23T16:59:21.430573672Z ==33==
2023-02-23T16:59:21.430576437Z ==33== Token '009' doesn't match specifier '%s'
2023-02-23T16:59:21.430579262Z ==33== Token '009' doesn't match specifier '%s'
2023-02-23T16:59:21.430582067Z ==33== Token '009' doesn't match specifier '%s'
2023-02-23T16:59:21.430584853Z ==33== Token '009' doesn't match specifier '%s'

Unfortunately the created docker volume is empty, so I cannot find any configuration file or even the archive.log to check for any issues. A sample dataset of my access logs from NGINX:

[15/Feb/2023:18:41:26 +0000] - 200 200 - GET https SUBDOMAIN.DOMAIN "/accounts/login/?next=/search/" [Client xx.xxx.xxx.xx] [Length 2530] [Gzip 2.91] [Sent-to xx.xx.xxx.xxx] "Go-http-client/2.0" "-"

No matter what I tried, I cant get GoAccess working :( Hope anyone can help with this

[xavier-hernandez]

Your sample log worked for me. I wonder if there is a file that is being processed that is causing the problem. I find that sometimes if the first row in a file has bad syntax GoAccess gives you an error and doesn't process anything else.

Try setting SKIP_ARCHIVED_LOGS to TRUE and see what happens.

[Estradamis]

Strange, with the old logs excluded it worked fine. Thanks you can close this

[xavier-hernandez]

I've had the same issues in the past with NPM. Not sure if at some point in time they changed their log format. Glad its working. You can also delete those archived ones or move them somewhere else so that new archives can be read.