Requested Files and Not Found panels duplicate information

[g9h0]

The "Requested Files (URLs)" panel contains requests for files that do not exist. There is also a panel "Not Found Files (404)" which also contains the same requests. I'm not sure if this is an intentional design decision, but it would be nice if the "Requested Files" panel was populated with requests that return a 2xx status, as this would provide a cleaner view of which pages are most popular, without being cluttered with requests that returned a 4xx.

[allinurl]

Could you please provide a few sample lines from your log so I can replicate the issue? Additionally, feel free to share a screenshot of the problem for better clarity. Thanks!

[g9h0]

@allinurl Thanks for the reply. I have attached both logs and screen captures. These logs are structured logs from Caddy. They seems to be slightly different, with one returning a 308, and the other a 404. For reference, I don't run a wordpress site, so these requests are invalid. Thanks :)

{ "level": "info", "ts": 1736332408.880364, "logger": "http.log.access.log0", "msg": "handled request", "request": { "remote_ip": "x.x.x.x", "remote_port": 60259, "client_ip": "x.x.x.x", "proto": "HTTP/1.1", "method": "GET", "host": "g9h.io", "uri": "/wp-admin/js/about.php", "headers": {} }, "bytes_read": 0, "user_id": "", "duration": 0.000055891, "size": 0, "status": 308, "resp_headers": { "Location": [ "https://g9h.io/wp-admin/js/about.php" ], "Content-Type": [], "Server": [ "Caddy" ], "Connection": [ "close" ] } }

{ "level": "info", "ts": 1736332408.9551666, "logger": "http.log.access.log0", "msg": "handled request", "request": { "remote_ip": "x.x.x.x", "remote_port": "53205", "client_ip": "x.x.x.x", "proto": "HTTP/1.1", "method": "GET", "host": "g9h.io", "uri": "/wp-admin/js/about.php", "headers": {}, "tls": { "resumed": false, "version": 771, "cipher_suite": 49195, "proto": "", "server_name": "g9h.io" } }, "bytes_read": 0, "user_id": "", "duration": 0.00013649, "size": 0, "status": 404, "resp_headers": { "Server": [ "Caddy" ], "Alt-Svc": [ "h3=\":443\"; ma=2592000" ] } }

[allinurl]

From the two requests you shared, one returns a 308 status, while the other returns a 404. On my end, both behave as expected. If those files or directories don't exist, it seems that Caddy shouldn't be returning a 308 in this case, right?

[webstudiobond]

Confirmed. Similar problem with nginx.

The REQUESTS panel receives requests with status 404, 403, etc.

Perhaps we need an option to explicitly specify which statuses to consider for the REQUESTS panel.

Perhaps we need to output an additional column indicating status. (METHOD, PROTOCOL, STATUS, DATA)

The ideal would be to display multiple tables with their status, as is done for 404s
REQUESTS_2xx
REQUESTS_3xx
NOT_FOUND
REQUESTS_4xx (excluding NOT_FOUND)
REQUESTS_5xx

[allinurl]

It appears your application might be incorrectly returning a 308 when a page is not found, leading to a subsequent 404. goaccess simply reflects the log data. I'm not convinced that treating 308 as 404 with a flag is beneficial beyond this specific case. Since they represent different server responses, it might obscure valuable info.

#117 will address filtering and searching for these specific cases. Stay tuned.

If you need to handle 444 status codes as 404s in goaccess, use the --444-as-404 flag.

[g9h0]

After further investigation, I've realised that this problem is in fact caused by Caddy automatically upgrading requests from http -> https. I would agree that showing 308's in the requests panel is the correct thing to do, as a 308 could be a legitimate request.

To resolve the problem, I have added the following configuration to my Caddyfile, and closed port 80 on my firewall.

{ auto_https disable_redirects }

Caddy documentation reference: https://caddyserver.com/docs/caddyfile/options#auto-https

Many thanks for your help with this issue :)

[allinurl]

happy to help! I’m glad you were able to sort it out.