用 GoAccess 即時分析 IIS Access Log

會算 Apache Access Log 之後

也算一下 IIS 的吧

只能把 u_exyyddmm.log 檔案拿到 Linux 上來算

不過我用 –log-format=W3C 方式沒用

它會說

Parsed 10 lines producing the following errors:

Token 'xxxx' doesn't match specifier '%m'
Token 'xxxx' doesn't match specifier '%m'

所以要額外 弄一個 script 來把格式換算成正確的 log format (參考 Easy IIS log file format specification for goaccess.)

ux_exyyddmm.log 裡面的 Fields 這行會有正確格式名稱，透過 script 換成 goaccess 可吃的格式

vi goiisformat.sh

#!/usr/bin/env sh

while read line; do
  if [[ $line == \#Fields:* ]]; then
    line=${line/\#Fields: /}
    line=${line/date/%d}
    line=${line/time/%t}
    line=${line/s-sitename/%^}
    line=${line/s-computername/%^}
    line=${line/s-ip/%^}
    line=${line/cs-method/%m}
    line=${line/cs-uri-stem/%U}
    line=${line/cs-uri-query/%^}
    line=${line/s-port/%^}
    line=${line/cs-username/%^}
    line=${line/c-ip/%h}
    line=${line/cs-version/%H}
    line=${line/cs(User-Agent)/%u}
    line=${line/cs(Cookie)/%^}
    line=${line/cs(Referer)/%R}
    line=${line/cs-host/%^}
    line=${line/sc-status/%s}
    line=${line/sc-substatus/%^}
    line=${line/sc-win32-status/%^}
    line=${line/sc-bytes/%b}
    line=${line/cs-bytes/%^}
    line=${line/time-taken/%L}
    echo $line
    exit;
  fi
done

再把它帶入 –log-format 就行了

goaccess u_ex180709.log --log-format "$(cat u_ex180709.log | sh goiisformat.sh)" --date-format '%Y-%m-%d' --time-format '%H:%M:%S' -o goaccess.html