allinurl/goaccess

Date shift when processing log at midnight

Closed this issue · 3 comments

abid76 commented

I am using goaccess version 1.9.4 on Debian GNU/Linux 12 (bookworm).

Given this access.log (first and last 3 lines taken from production):

my-domain.net 159.242.234.39 [21/Sep/2025:01:03:21 +0000] GET "/apple-touch-icon.png" HTTP/2.0 404 "-" "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 35)" 159.242.234.39 "/apple-touch-icon.png" - 1.66 186 0.000 -
my-domain.net 206.83.127.121 [21/Sep/2025:01:03:22 +0000] GET "/serviceworker.js?v=1758256200" HTTP/2.0 200 "https://my-domain.net/serviceworker.js?v=1758256200" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36" 206.83.127.121 "/serviceworker.js" - 1.07 302 0.000 -
my-domain.net 89.247.165.36 [21/Sep/2025:01:03:23 +0000] POST "/wp-admin/admin-ajax.php" HTTP/2.0 200 "https://my-domain.net/wp-admin/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15" 89.247.165.36 "/wp-admin/admin-ajax.php" - 1.27 529 0.146 0.145
my-domain.net 83.135.6.3 [21/Sep/2025:22:00:02 +0000] POST "/wp-admin/admin-ajax.php" HTTP/2.0 200 "https://my-domain.net/wp-admin/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15" 83.135.6.3 "/wp-admin/admin-ajax.php" - 1.17 457 0.156 0.156
my-domain.net 79.251.229.46 [21/Sep/2025:22:00:02 +0000] POST "/" HTTP/2.0 204 "https://my-domain.net/293-prozent-wahlbeteiligung-92-prozent-ungltige-stimmen-so-whlte-ludwigshafen-ohne-den-afd-kandidaten/" "Mozilla/5.0 (iPad; CPU OS 15_8_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Mobile/15E148 Safari/604.1" 79.251.229.46 "/index.php" - - 97 0.153 0.153
my-domain.net 79.230.119.132 [21/Sep/2025:22:00:02 +0000] POST "/wp-admin/admin-ajax.php" HTTP/2.0 200 "https://my-domain.net/293-prozent-wahlbeteiligung-92-prozent-ungltige-stimmen-so-whlte-ludwigshafen-ohne-den-afd-kandidaten/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/28.0 Chrome/130.0.0.0 Mobile Safari/537.36" 79.230.119.132 "/wp-admin/admin-ajax.php" - 0.97 426 0.187 0.187

On a machine with system timezone UTC, the generation of a JSON report started a second after 22:00 (UTC time) which is a second after midnight in Europe/Berlin timezone.

The command is

log_format='%v %h %^[%d:%t] %m "%U" %H %s "%R" "%u" %h "%^" %^ %^ %b %L %^'
date_format='%d/%b/%Y'
time_format='%H:%M:%S %z'

LC_TIME="en_US.UTF-8" goaccess access.log -q --ignore-crawlers --log-format="$log_format" --date-format="$date_format" --time-format="$time_format" --tz='Europe/Berlin' -o access.log.json

The output is:

{
	"general": {
		"start_date": "22/Sep/2025",
		"end_date": "22/Sep/2025",
		"date_time": "2025-09-22 00:00:22 +0200",

I would expect the start_date in the report to be 21/Sep/2025 as the first log entry is 21/Sep/2025:01:03:21 +0000 which is 21/Sep/2025:03:03:21 +0200 in the timezone Europe/Berlin. Why does it show 22/Sep/2025? Is it a bug or am I missing something?

allinurl commented

This should do it:

# goaccess access.log --log-format='%v %h %^[%x] %m "%U" %H %s "%R" "%u" %h "%^" %^ %^ %b %T %^' --datetime-format='%d/%b/%Y:%H:%M:%S %z' --tz='Europe/Berlin' --date-spec=min

Let me know how it goes.

abid76 commented

Using the %x placeholder together with the --datetime-format param fixed it. Thanks! 🙂

  • 👍1
allinurl commented

Glad that did the job :)