Support for Ejabberd-logs?

[sreutter]

I tried to make goaccess work with ejabberd, however, no success so far.

i tried this:

/usr/local/bin/ejabberd2goaccess.py /opt/ejabberd/logs/ejabberd.log | \
/usr/bin/goaccess - \
  --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u"' \
  --date-format=%d/%b/%Y \
  --time-format=%T \
  --real-time-html \
  --port=7891 \
  --ws-url=wss://stats.jabber.world/ejabberd-ws \
  -o /var/www/html/ejabberd.html

that works, but the complete goaccess html is empty, nothing in it:

the parser itself seems to work, i get lines like this:

92.208.145.13 - - [19/Jun/2026:06:44:12 +0200] "GET /c2s/auth/thomas@in-mai.nz HTTP/1.1" 200 0 "-" "ejabberd_c2s:process_auth_result/3:304"

Any Ideas?
Thank you, Stefan

the parser script:

#!/usr/bin/env python3
# /usr/local/bin/ejabberd2goaccess.py

import sys
import re
import subprocess
import signal
import socket
from datetime import datetime

LOG_RE = re.compile(
    r'^(?P<date>\d{4}-\d{2}-\d{2}) '
    r'(?P<time>\d{2}:\d{2}:\d{2})\.\d+'
    r'(?P<tz>[+-]\d{2}:\d{2}) '
    r'\[(?P<level>\w+)\] '
    r'<(?P<pid>[^>]+)>'
    r'(?:@(?P<module>[^\s]+))? '
    r'(?P<msg>.+)$'
)

ACCEPT_CONN_RE = re.compile(
    r'^\((?P<childpid><[^>]+>)\) Accepted connection '
    r'\[(?P<srcip>[^\]]+)\]:(?P<srcport>\d+) -> '
    r'\[(?P<dstip>[^\]]+)\]:(?P<dstport>\d+)$'
)

dns_cache = {}
pid_ip_cache = {}

def clean_peer(value):
    if not value:
        return 'unknown'
    value = value.strip()
    if value == 'hidden_by_ejabberd':
        return 'unknown'
    return value

def normalize_ip(ip):
    if not ip:
        return None
    ip = ip.strip().strip('[]')
    if ip.startswith('::ffff:'):
        ip = ip[7:]
    if ip == 'hidden_by_ejabberd':
        return None
    return ip

def is_local_only_ip(ip):
    if not ip:
        return True
    return ip in ('127.0.0.1', '::1', '172.19.0.2')

def resolve_host(host):
    host = clean_peer(host)
    if host == 'unknown':
        return None
    if host in dns_cache:
        return dns_cache[host]
    try:
        infos = socket.getaddrinfo(host, None, proto=socket.IPPROTO_TCP)
        ipv4 = None
        ipv6 = None
        for family, _, _, _, sockaddr in infos:
            ip = sockaddr[0]
            if family == socket.AF_INET and not ipv4:
                ipv4 = ip
            elif family == socket.AF_INET6 and not ipv6:
                ipv6 = ip
        result = ipv4 or ipv6
    except Exception:
        result = None
    dns_cache[host] = result
    return result

def apache_timestamp(date, time_, tz):
    dt = datetime.strptime(f'{date} {time_}', '%Y-%m-%d %H:%M:%S')
    return dt.strftime('%d/%b/%Y:%H:%M:%S') + ' ' + tz.replace(':', '')

def build_line(ip, ts, path, status, mod):
    ip = normalize_ip(ip)
    if not ip or is_local_only_ip(ip):
        return None
    return f'{ip} - - [{ts}] "GET {path} HTTP/1.1" {status} 0 "-" "{mod}"'

def parse_line(line):
    m = LOG_RE.match(line.strip())
    if not m:
        return None

    date = m.group('date')
    time_ = m.group('time')
    tz = m.group('tz')
    level = m.group('level').lower()
    pid = f"<{m.group('pid')}>"
    mod = m.group('module') or 'ejabberd'
    msg = m.group('msg')

    ts = apache_timestamp(date, time_, tz)

    # 1) Accepted connection
    cm = ACCEPT_CONN_RE.match(msg)
    if cm:
        childpid = cm.group('childpid')
        srcip = normalize_ip(cm.group('srcip'))
        dstport = cm.group('dstport')

        if srcip and not is_local_only_ip(srcip):
            pid_ip_cache[childpid] = srcip
            return build_line(srcip, ts, f'/conn/accept/port{dstport}', '200', mod)
        return None

    # 2) Accepted inbound s2s auth
    m2 = re.search(
        r'Accepted inbound s2s (?:EXTERNAL|dialback) authentication (\S+) -> (\S+) \(([^)]+)\)',
        msg
    )
    if m2:
        srcdomain, dstdomain, ip = m2.groups()
        srcdomain = clean_peer(srcdomain)
        dstdomain = clean_peer(dstdomain)
        ip = normalize_ip(ip)
        if ip and not is_local_only_ip(ip):
            pid_ip_cache[pid] = ip
            return build_line(ip, ts, f'/s2s/in/auth/{srcdomain}/{dstdomain}', '200', mod)
        return None

    # 3) Accepted outbound s2s auth
    m3 = re.search(
        r'Accepted outbound s2s (?:EXTERNAL|dialback) authentication (\S+) -> (\S+) \(([^)]+)\)',
        msg
    )
    if m3:
        srcdomain, dstdomain, ip = m3.groups()
        srcdomain = clean_peer(srcdomain)
        dstdomain = clean_peer(dstdomain)
        ip = normalize_ip(ip)
        if ip and not is_local_only_ip(ip):
            pid_ip_cache[pid] = ip
            return build_line(ip, ts, f'/s2s/out/auth/{srcdomain}/{dstdomain}', '200', mod)
        return None

    # 4) Outbound s2s start
    m4 = re.search(r'Outbound s2s connection started: (\S+) -> (\S+)', msg)
    if m4:
        srcdomain, dstdomain = m4.groups()
        srcdomain = clean_peer(srcdomain)
        dstdomain = clean_peer(dstdomain)
        ip = pid_ip_cache.get(pid) or resolve_host(dstdomain)
        return build_line(ip, ts, f'/s2s/out/start/{srcdomain}/{dstdomain}', '200', mod)

    # 5) Failed outbound s2s auth
    m5 = re.search(
        r'Failed outbound s2s EXTERNAL authentication (\S+) -> (\S+) \(([^)]+)\):',
        msg
    )
    if m5:
        srcdomain, dstdomain, ip = m5.groups()
        srcdomain = clean_peer(srcdomain)
        dstdomain = clean_peer(dstdomain)
        return build_line(ip, ts, f'/s2s/out/auth-failed/{srcdomain}/{dstdomain}', '401', mod)

    # 6) Retrying dialback
    m6 = re.search(
        r'Retrying with s2s dialback authentication: (\S+) -> (\S+) \(([^)]+)\)',
        msg
    )
    if m6:
        srcdomain, dstdomain, ip = m6.groups()
        srcdomain = clean_peer(srcdomain)
        dstdomain = clean_peer(dstdomain)
        return build_line(ip, ts, f'/s2s/out/dialback-retry/{srcdomain}/{dstdomain}', '302', mod)

    # 7) Closing inbound s2s
    m7 = re.search(r'Closing inbound s2s connection (\S+) -> (\S+):', msg)
    if m7:
        srcdomain, dstdomain = m7.groups()
        srcdomain = clean_peer(srcdomain)
        dstdomain = clean_peer(dstdomain)
        ip = pid_ip_cache.get(pid) or resolve_host(srcdomain)
        return build_line(ip, ts, f'/s2s/in/close/{srcdomain}/{dstdomain}', '408', mod)

    # 8) Closing outbound s2s
    m8 = re.search(r'Closing outbound s2s connection (\S+) -> (\S+):', msg)
    if m8:
        srcdomain, dstdomain = m8.groups()
        srcdomain = clean_peer(srcdomain)
        dstdomain = clean_peer(dstdomain)
        ip = pid_ip_cache.get(pid) or resolve_host(dstdomain)
        return build_line(ip, ts, f'/s2s/out/close/{srcdomain}/{dstdomain}', '408', mod)

    # 9) Accepted c2s auth
    m9 = re.search(
        r'Accepted c2s .* authentication for (\S+) .* from (\S+)',
        msg
    )
    if m9:
        jid, ip = m9.groups()
        ip = normalize_ip(ip)
        if ip and not is_local_only_ip(ip):
            pid_ip_cache[pid] = ip
            return build_line(ip, ts, f'/c2s/auth/{jid}', '200', mod)
        return None

    # 10) Opened c2s session
    m10 = re.search(r'Opened c2s session for (\S+)', msg)
    if m10:
        jid = m10.group(1)
        ip = pid_ip_cache.get(pid)
        return build_line(ip, ts, f'/c2s/open/{jid}', '200', mod)

    # 11) Closing c2s connection
    m11 = re.search(r'Closing c2s connection for (\S+):', msg)
    if m11:
        jid = m11.group(1)
        ip = pid_ip_cache.get(pid)
        return build_line(ip, ts, f'/c2s/close/{jid}', '408', mod)

    # 12) Closing c2s session
    m12 = re.search(r'Closing c2s session for (\S+):', msg)
    if m12:
        jid = m12.group(1)
        ip = pid_ip_cache.get(pid)
        return build_line(ip, ts, f'/c2s/session-close/{jid}', '408', mod)

    return None

def main():
    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
    logfile = sys.argv[1] if len(sys.argv) > 1 else '/opt/ejabberd/logs/ejabberd.log'

    proc = subprocess.Popen(
        ['tail', '-F', '-n', '+1', logfile],
        stdout=subprocess.PIPE,
        stderr=subprocess.DEVNULL,
        text=True
    )

    try:
        for line in proc.stdout:
            out = parse_line(line)
            if out:
                print(out, flush=True)
    except (BrokenPipeError, KeyboardInterrupt):
        pass
    finally:
        proc.terminate()

if __name__ == "__main__":
    main()

[allinurl]

Sorry for the delay, I just saw the post.

Could you please confirm the following outputs:

# grab a finite chunk of parser output (tail -F never exits, so cap it)
timeout 10 /usr/local/bin/ejabberd2goaccess.py /opt/ejabberd/logs/ejabberd.log \
  | head -n 5000 > /tmp/ejabberd-access.log

---

wc -l /tmp/ejabberd-access.log      # sanity: are there lines?

---

head -n 3 /tmp/ejabberd-access.log

---

goaccess /tmp/ejabberd-access.log \
  --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u"' \
  --date-format='%d/%b/%Y' \
  --time-format='%T' \
  --invalid-requests=/tmp/goaccess-invalid.log \
  -o /tmp/ejabberd-report.html

---

wc -l /tmp/goaccess-invalid.log     # how many lines GoAccess rejected