How to install Web Log Analyzer - GoAccess

GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal or through your browser.

It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly.

Installation instructions:

# wget http://tar.goaccess.io/goaccess-1.1.1.tar.gz

$ wget http://tar.goaccess.io/goaccess-1.1.1.tar.gz

$ tar -xzvf goaccess-1.1.1.tar.gz

$ cd goaccess-1.1.1/

$ ./configure --enable-geoip --enable-utf8

$ make

# make install

command to analyze log file:

# goaccess -f /var/log/httpd/access_log

You will be prompted to select the log format. If you are using a default server with the standard log file output, select the NCSA combined log format.

Press the Enter key and GoAccess will begin to analyze your log file. Once it is fully parsed, you will be redirected to the following command line interface.

Configure unattended startup

find the parameters that correspond to your log format and uncomment them in /usr/local/etc/goaccess.conf

vi /usr/local/etc/goaccess.conf

time-format %H:%M:%S

date-format %d/%b/%Y

log-format %h %^[%d:%^] "%r" %s %b

Start GoAccess with HTML Generation

To enable live reporting, simply issue the following command. This will output statsreport.html at the root of the /var/www/html directory. You may output it in any folder served by your Apache instance so that you can view the HTML file:

# goaccess -f /var/log/httpd/access_log -a -o /var/www/html/statsreport.html

For real time html output:

add option --real-time-html

# goaccess -f /var/log/httpd/access_log -a -o /var/www/html/statsreport.html  --real-time-html

In order to view the generated HTML report, simply navigate to report.html using your web browser.

To generate a CSV file:

# goaccess access.log --no-csv-summary -o report.csv

That's it....

Linux commands and tricks

1. Runing the last command as Root
sudo !!

2. To find your external IP address.
host myip.opendns.com resolver1.opendns.com
lynx --dump http://ipecho.net/plain
curl ifconfig.me

4. Auto-empty any file without removing it
> file.txt

5. Execute command without saving it in the history
<space>command

6. Slick way to copy or backup a file before you edit it.
cp filename{,.bak}

7. Traceroute is a nice command but how about a single network diagnostic tool that can combine traceroute with ping? mtr is your command.
mtr efytimes.com

8. To Clear your terminal's screen
ctrl-l

9. List of commands you use most often
history | awk '{a[$2]++}END{for(i in a){print a[i] " " i}}' | sort -rn | head

10. Saving the file you edited in vim/vi without the required permissions
:w !sudo tee %
------------------------------------------------------
1. List all the files that are in current and sub directories

$ find
.
./abc.txt
./subdir
./subdir/how.php
./cool.php

You can also use:

$ find .
$ find . -print

2. Search through a particular directory or path

Check for files in test directory and sub directories.

$ find ./test
./test
./test/abc.txt
./test/subdir
./test/subdir/how.php
./test/cool.php

Alternatively, if you want to search by name, then use:

$ find ./test -name abc.txt
./test/abc.txt

You could easily make a mistake and end up searching through the entire file system. So be careful and use Ctrl+C if you happen to do this mistake.

3. Limit how many levels the find command should go

When traversing directories, you can choose how many levels the find command should go within directories.

$ find ./test -maxdepth 2 -name *.php
./test/subdir/how.php
./test/cool.php

$ find ./test -maxdepth 1 -name *.php
./test/cool.php

This is useful when you want to do a limited search in a directory and not the entire directory.

4. Invert match

If you know what files to exclude from your search or want to get filed following a certain pattern, use this.

$ find ./test -not -name *.php
./test
./test/abc.txt
./test/subdir

Here, it will exclude files with .php extensions.

5. Combine multiple criteria for search

You can also put in multiple criteria in some cases.

$ find ./test -name 'abc*' ! -name '*.php'
./test/abc.txt
./test/abc

This shows you files that have abc in their name and do not have .php extension.

You can also use the OR operator by using the '-o' switch.

$ find -name '*.php' -o -name '*.txt'
./abc.txt
./subdir/how.php
./abc.php
./cool.php

This will show you files that have .php or .txt extensions.

6. Search only files or only directories

You can also search for only files or only directories.

For files

$ find ./test -type f -name abc*
./test/abc.txt

For directories

$ find ./test -type d -name abc*
./test/abc

7. Search through more than one directories together

Searching inside two separate directories.

$ find ./test ./dir2 -type f -name abc*
./test/abc.txt
./dir2/abcdefg.txt

8. Find files that are hidden

If you mention the period, then you can easily find all hidden files. In Linux, all hidden files have a period in their name.

$ find ~ -type f -name ".*"

9. Find files with specific permissions

If you need to find files that have specific permissions.

$ find . -type f -perm 0664
./abc.txt
./subdir/how.php
./abc.php
./cool.php

10. Find files that are read only

This one finds you all of them.

$ find /etc -maxdepth 1 -perm /u=r
/etc
/etc/thunderbird
/etc/brltty
/etc/dkms
/etc/phpmyadmin
... output truncated ... 

tar command

The following command creates a new tar archive:

$ tar cvf archive_name.tar dirname/

Use this when you need to extract from an existing archive:

$ tar xvf archive_name.tar

This is the command that is used to view a tar archive:

$ tar tvf archive_name.tar

grep command

This command searches for a given string within a file:

$ grep -i "the" demo_file

This command prints a matched line and three lines after it:

$ grep -A 3 -i "example" demo_text

Recursively search for a string in all files:

$ grep -r "ramesh" *

find command

Use this to find files when the filename is known:

# find -iname "MyCProgram.c"

This command is used to execute command on files that have been found using find:

$ find -iname "MyCProgram.c" -exec md5sum {} \;

Empty files in the directory:

# find ~ -empty

ssh command
This command allows you to login to a remote host.
# ssh -l jsmith remotehost.example.com

Use this to debug ssh clients:
# ssh -v -l jsmith remotehost.example.com

For displaying the ssh client version:
$ ssh -V

sed command
Convert the DOS file format into Unix format:
$sed 's/.$//' filename

Print the contents of a file in reverse order:
$ sed -n '1!G;h;$p' thegeekstuff.txt

Add a line number for the non-empty lines in a particular file
$ sed '/./=' thegeekstuff.txt | sed 'N; s/\n/ /'

awk command
Remove duplicate lines:
$ awk '!($0 in array) { array[$0]; print }' temp

Print all lines from a file , which have the same uid and gid:
$awk -F ':' '$3==$4' passwd.txt

Printing specific fields from a particular file:
$ awk '{print $2,$5;}' employee.txt

vim command
Go to the file�s 143rd line.
$ vim +143 filename.txt

Go to the first found match of the file specified:
$ vim +/search-term filename.txt

diff command
Ignoring white spaces when comparing files:
# diff -w name_list.txt name_list_new.txt

sort command
Ascending order:
$ sort names.txt

Descending order:
$ sort -r names.txt

Sort a file (passwd) the third field:
$ sort -t: -k 3n /etc/passwd | more

export command
Use this for viewing oracle related environment variables:
$ export | grep ORACLE
declare -x ORACLE_BASE="/u01/app/oracle"
declare -x ORACLE_HOME="/u01/app/oracle/product/10.2.0"
declare -x ORACLE_SID="med"
declare -x ORACLE_TERM="xterm"

Export environment variable:
$ export ORACLE_HOME=/u01/app/oracle/product/10.2.0
------------------------------------------
Tar files from multiple directories to a single tar file
cat listoffiles.txt | xargs tar czvf yourbackupname.tgz - or
tar zcvf yourbackupname.tgz $(cat listoffiles.txt)
cat filePath_2004.txt | xargs cp -t compressedfiles/filePath_2004/
--------------------

perl -pi -e 's/\[PDRrr_v3]/\[PDR_v3_pilot]/g' *
grep -rinl "\[PDR_v3_pilot" *
-----------------------

tar command
The following command creates a new tar archive:
$ tar cvf archive_name.tar dirname/

Use this when you need to extract from an existing archive:
$ tar xvf archive_name.tar

This is the command that is used to view a tar archive:
$ tar tvf archive_name.tar

grep command
This command searches for a given string within a file:
$ grep -i "the" demo_file

This command prints a matched line and three lines after it:
$ grep -A 3 -i "example" demo_text

Recursively search for a string in all files:
$ grep -r "ramesh" *

find command
Use this to find files when the filename is known:
# find -iname "MyCProgram.c"

This command is used to execute command on files that have been found using find:
$ find -iname "MyCProgram.c" -exec md5sum {} \;

Empty files in the directory:
# find ~ -empty

ssh command
This command allows you to login to a remote host.
ssh -l jsmith remotehost.example.com

Use this to debug ssh clients:
ssh -v -l jsmith remotehost.example.com

For displaying the ssh client version:
$ ssh �V

sed command
Convert the DOS file format into Unix format:
$sed 's/.$//' filename

Print the contents of a file in reverse order:
$ sed -n '1!G;h;$p' thegeekstuff.txt

Add a line number for the non-empty lines in a particular file
$ sed '/./=' thegeekstuff.txt | sed 'N; s/\n/ /'

awk command
Remove duplicate lines:
$ awk '!($0 in array) { array[$0]; print }' temp

Print all lines from a file , which have the same uid and gid:
$awk -F ':' '$3==$4' passwd.txt

Printing specific fields from a particular file:
$ awk '{print $2,$5;}' employee.txt

vim command
Go to the file's 143rd line.
$ vim +143 filename.txt

Go to the first found match of the file specified:
$ vim +/search-term filename.txt

diff command
Ignoring white spaces when comparing files:
# diff -w name_list.txt name_list_new.txt

sort command
Ascending order:
$ sort names.txt

Descending order:
$ sort -r names.txt

Sort a file (passwd) the third field:
$ sort -t: -k 3n /etc/passwd | more

export command
Use this for viewing oracle related environment variables:
$ export | grep ORACLE
declare -x ORACLE_BASE="/u01/app/oracle"
declare -x ORACLE_HOME="/u01/app/oracle/product/10.2.0"
declare -x ORACLE_SID="med"
declare -x ORACLE_TERM="xterm"

Export environment variable:
$ export ORACLE_HOME=/u01/app/oracle/product/10.2.0

--------------------------
Random password generator
-------------------------
# egrep -ioam1 '[a-z0-9]{10}' /dev/urandom

# sh -x ./configure ... configure_options ... 

network copy with ssh and tar
# ssh bsmith@apple tar cf - -C /home/bsmith . | tar xvf - 

download only with yum command
# yum update httpd -y --downloadonly --downloaddir=/opt
# rpm -Uivh *.rpm

Undo your changes even after quitting the VIM editor
:set undofile
:set undodir=/tmp

This is to be done every time you start editing a file. In case you need the configuration to be there for all files that you open in VIM, create a file called '.exrc' or '.vimrc' in $HOME directory. In my case, it is /myhome.
Open the just created file and add the following commands:
# vi /myhome/.exrc
set undofile
set undodir=/tmp
Save and close the file.
:wq
From now onwards, the Undo history is maintained in the background for all files that you edit with VIM. 


check php version of webserver from browser
phpinfo.php
<?php
// Show all information, defaults to INFO_ALL
phpinfo();
// Show just the module information.
// phpinfo(8) yields identical results.
phpinfo(INFO_MODULES);
?>

++
\\\\\\\\\
library dependency missing error
-----------------
# yum clean all   
# yum clean metadata
# yum list all   
# yum grouplist


check you external ip address
# lynx http://whatismyip.com

check port 443
# netstat -anp|findstr 443


To check and flush postfix mail queue:
to check
# mailq
to flush queue
# postfix flush
to delete queue  
# postsuper -d ALL

To check configure error/debug
# sh -x ./configure

Starting apache fails (could not bind to address 0.0.0.0:80)
# fuser -k -n tcp 80


Check CPU usage from command line:
# top -b -n 1 | grep "Cpu(s)\:"
# ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10
# sar
# mpstat


Search and replace text in multiple files in a directory:
#perl -pi -e 's/PDR_v3/PDRrr_v3/g' *
#find . -name "*.*" -print | xargs sed -i 's/PDR_v3/PDR_v3_qa/g'
#grep -rl 'PDR_v3' ./ | xargs sed -i 's/PDR_v3/PDR_v3_qa/g'


To find repeated words/lines in a text file
# cat /var/httpd/logs/web-access_log | sort | uniq -c | sort -nr | grep '11/Jul' | less


device eth0 does not seem to be present/
# rm -f /etc/udev/rules.d/70-persistent-net.rules 
# reboot

Delete files older than 60 days
# find . -mtime +60 | xargs rm

How to Increase or reduce volume size on Centos

Increase virtual Hard Disk space running on ext4 file system

1. Identify the partition type:
# fdkisk -l
Device Boot         Start         End      Blocks   Id  System
/dev/sda1   *        2048     2099199     1048576   83  Linux
/dev/sda2         2099200  1953523711   975712256   8e  Linux LVM

Disk /dev/mapper/cl-root: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes

2. Check Disk information
# df -ah
/dev/mapper/cl-root   50G  6.4G   44G  13% /


3. Add/create additional volume then scan with this command
#partprobe -s

# fdkisk -l
Device Boot         Start         End      Blocks   Id  System
/dev/sda1   *        2048     2099199     1048576   83  Linux
/dev/sda2         2099200  1953523711   975712256   8e  Linux LVM
/dev/sda3      1953523711  1953524102    10485760   8e  Linux LVM

4. Increase the Logical Volume
#pvcreate /dev/sda3
Physical volume "/dev/sda3" successfully created

5. confirm name of the current volume group
# vgdisplay
--- Volume group ---
  VG Name               cl
VG Size               53.7 GiB

6. Extend 'cl' volume group  by adding physical volume /dev/sda3
# vgextend cl /dev/sda3
Volume group "Mega" successfully extended

7. Scan all disks for physical volumes
# pvscan
PV /dev/sda2   VG cl              lvm2 [53.7 GiB / 4.00 MiB free]
PV /dev/sda3   VG cl              lvm2 [10.00 GiB / 4.00 MiB free]
Total: 2 [63.7 GiB] / in use: 2 [63.7 GiB] / in no VG: 0 [0   ]


8. confirm the path of the logical volume
#lvdisplay
  --- Logical volume ---
  LV Path                /dev/cl/root

9. Extend the logical volume with lvextend command
# lvextend /dev/cl/root /dev/sda3
  Extending logical volume root to 63.7 GiB
  Logical volume root successfully resized
alternatively you can also extend logical volume with different sizes:
# lvextend -L +10G /dev/cl/root

 
10. Resize the file system using resize2fs command for ext based file system.
# resize2fs /dev/cl/root
resize2fs 1.42.9 (28-Dec-2013)
Filesystem at /dev/cl/root is mounted on /; on-line resizing required
old desc_blocks = 2, new_desc_blocks = 2
Performing an on-line resize of /dev/cl/root to 7576576 (4k) blocks.
The filesystem on /dev/cl/root is now 7576576 blocks long.

 
Note : if you are using XFS file system (default on RHEL7/CentOS7) you can extend the file system with this command:
# xfs_growfs /dev/cl/root




Reduce logical volume device size

To reduce logical volume we need to be careful and take backup if any data
1. check file system information
# lvs
LV    VG  Attr        LSize   Pool Origin Data%  Meta%  
data  cl  -wi-ao----  876.63g                                                    
root  cl   -wi-ao----  50.00g                                                    
swap  cl  -wi-ao----  3.88g                                                    

# df -ah
Filesystem           Size  Used Avail Use% Mounted on
/dev/mapper/cl-data  877G  8.4G  868G   1% /data

2. unmount mount point of the volume which needs to be reduced
umount -v /dev/mapper/cl-data /data

3. check for file-system errors using this command
# e2fsck -ff /dev/mapper/cl-data
e2fsck 1.42.9 (28-Dec-2013)
/dev/mapper/cl-data

Note: Must pass in every 5 steps of file-system check if not there might be some issue with your file-system.

To check hard drive related information and logs run this command
# smartctl -a /dev/sda

4. Now reduce the file system
# resize2fs /dev/mapper/cl-data  10GB

reduce the logical volume using this command
# lvreduce -L -8G /dev/mapper/cl-data


5. Resize the file system back
# resize2fs /dev/cl/data

6. Mount the file system back to same mount point
# mount  /dev/cl/data  /data

7. Check the size of the partition
# #lvdisplay
  --- Logical volume ---
LV Path                /dev/cl/data
LV Size   866.73 GiB

Thats it.. 

IPTables basic security

To list rules in iptables
#ipables -L

Allow multiple ports to a netowrk.
# iptables -A INPUT -s 123.176.0.0/255.255.0.0 -p tcp -m multiport --dport 22,1521,80 -j ACCEPT

To restrict ping
# iptables -A INPUT -p tcp --syn -m limit --limit 5/s -i eth0 -j ACCEPT
#ping -c 3 -i .005 ipaddress

#iptables -A INPUT -s 192.168.1.80 -p icmp --icmp-type echo-request -j REJECT/DROP/ACCEPT (only one ip restriction for ping)

#iptables -A INPUT -s 0.0.0.0/0.0.0.0 -p icmp --icmp-type echo-request -j REJECT/DROP/ACCEPT (restrict entire network)

#iptables -A INPUT -s 192.168.0.0/255.255.0.0 -p icmp --icmp-type echo-request -j DROP (only to specific network segment)

To flush rules:
#iptables -F :flush chain...

Allow or reject ports to specific ipaddresses
#iptables -A input -s 192.168.1.80 -j reject/drop/accept

#iptables -A input -s 192.168.1.80 -p tcp --dport 80 -j REJECT

#iptables -A input -s 192.168.1.0/24 -p tcp --dport 22 -j REJECT

#iptables -A INPUT -s 123.176.47.0/255.255.255.0 -p tcp --dport 22 -j ACCEPT



To delete the rule in iptables chain
#iptables -D input 5


To block specific IP address
#iptables -A OUTPUT -D 67.215.241.234 -j DROP

#iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

#iptables -A INPUT -f -j DROP
#iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
#iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP


Rule to route ip address:
#iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j SNAT –-to 1.2.3.1

#iptables –t nat –A POSTROUTING –s 10.10.0.0/24 –j SNAT --to 123.176.40.60
#iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j SNAT –-to 1.2.3.1:1-1024


#iptables –t nat –A PREROUTING –d 1.2.4.1 –j DNAT –-to 192.168.1.50
#iptables –t nat –A PREROUTING –s 1.2.5.17 –d 1.2.4.2 –p tcp –-dport 80 –j DNAT -–to 192.168.1.100

#iptables –t nat –A PREROUTING –d 1.2.4.2 –p tcp –-dport 65521 –j DNAT –-to 192.168.1.100:22

#iptables –t nat –A PREROUTING –d 1.2.4.5 –p tcp –-dport 80 –j DNAT –-to 192.168.1.200


Transparent proxy is a way to force users to use a proxy server, even if their browsers are configured not to. You probably know about the benefits of using a proxy server bandwidth saving for cached pages and access control implementation (e.g. deny downloads of files that have dangerous extensions).
We can perform transparent proxy for all or some users to prevent them from bypassing the proxy whenever they want. This is especially good for children's computers to deny them access to sexually explicit sites, for example.
On our Linux router, we installed a Squid proxy server to cache some content from the Web. Also, we want to deny access to sex sites or malicious downloads for users. The users are not very pleased about using our proxy server, and they usually remove it from their browser configuration. We can force them to use the proxy server anyway. If the proxy server listens on port 3128 we will do the following:

# iptables –t nat –A PREROUTING –s 192.168.1.0/24 –p tcp –-dport 80 –j REDIRECT –-to-port 3128

If we want to allow the manager (who has the IP address 192.168.1.50) to bypass the proxy server, we do so like this:

# iptables –t nat –I PREROUTING –s 192.168.1.50 –p tcp –-dport 80 –j ACCEPT

So this rule will be matched in the PREROUTING chain, and she will be SNATed in the POSTROUTING chain