GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal on *nix systems or through your browser. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. More info at: https://goaccess.io.
GoAccess parses the specified web log file and outputs the data to the X terminal. Features include:
-
Completely Real Time
All panels and metrics are timed to be updated every 200 ms on the terminal output and every second on the HTML output. -
Minimal Configuration needed
You can just run it against your access log file, pick the log format and let GoAccess parse the access log and show you the stats. -
Track Application Response Time
Track the time taken to serve the request. Extremely useful if you want to track pages that are slowing down your site. -
Nearly All Web Log Formats
GoAccess allows any custom log format string. Predefined options include, Apache, Nginx, Amazon S3, Elastic Load Balancing, CloudFront, etc. -
Incremental Log Processing
Need data persistence? GoAccess has the ability to process logs incrementally through the on-disk persistence options. -
Only one dependency
GoAccess is written in C. To run it, you only need ncurses as a dependency. That's it. It even features its own Web Socket server — http://gwsocket.io/. -
Visitors
Determine the amount of hits, visitors, bandwidth, and metrics for slowest running requests by the hour, or date. -
Metrics per Virtual Host
Have multiple Virtual Hosts (Server Blocks)? It features a panel that displays which virtual host is consuming most of the web server resources. -
ASN (Autonomous System Number mapping)
Great for detecting malicious traffic patterns and block them accordingly. -
Color Scheme Customizable
Tailor GoAccess to suit your own color taste/schemes. Either through the terminal, or by simply applying the stylesheet on the HTML output. -
Support for Large Datasets
GoAccess features the ability to parse large logs due to its optimized in-memory hash tables. It has very good memory usage and pretty good performance. This storage has support for on-disk persistence as well. -
Docker Support
Ability to build GoAccess' Docker image from upstream. You can still fully configure it, by using Volume mapping and editinggoaccess.conf. See Docker section below.
GoAccess allows any custom log format string. Predefined options include, but not limited to:
- Amazon CloudFront (Download Distribution).
- Amazon Simple Storage Service (S3)
- AWS Elastic Load Balancing
- Combined Log Format (XLF/ELF) Apache | Nginx
- Common Log Format (CLF) Apache
- Google Cloud Storage.
- Apache virtual hosts
- Squid Native Format.
- W3C format (IIS).
- Caddy's JSON Structured format.
GoAccess was designed to be a fast, terminal-based log analyzer. Its core idea is to quickly analyze and view web server statistics in real time without needing to use your browser (great if you want to do a quick analysis of your access log via SSH, or if you simply love working in the terminal).
While the terminal output is the default output, it has the capability to
generate a complete, self-contained, real-time HTML
report, as well as a JSON, and
CSV report.
You can see it more of a monitor command tool than anything else.
GoAccess can be compiled and used on *nix systems.
Download, extract and compile GoAccess with:
$ wget https://tar.goaccess.io/goaccess-1.8.tar.gz
$ tar -xzvf goaccess-1.8.tar.gz
$ cd goaccess-1.8/
$ ./configure --enable-utf8 --enable-geoip=mmdb
$ make
# make install
$ git clone https://github.com/allinurl/goaccess.git
$ cd goaccess
$ autoreconf -fiv
$ ./configure --enable-utf8 --enable-geoip=mmdb
$ make
# make install
You can also build the binary for Debian based systems in an isolated container environment to prevent cluttering your local system with the development libraries:
$ curl -L "https://github.com/allinurl/goaccess/archive/refs/heads/master.tar.gz" | tar -xz && cd goaccess-master
$ docker build -t goaccess/build.debian-10 -f Dockerfile.debi
8000
an-10 .
$ docker run -i --rm -v $PWD:/goaccess goaccess/build.debian-10 > goaccess
It is easiest to install GoAccess on GNU+Linux using the preferred package manager of your GNU+Linux distribution. Please note that not all distributions will have the latest version of GoAccess available.
# apt-get install goaccess
Note: It is likely this will install an outdated version of GoAccess. To make sure that you're running the latest stable version of GoAccess see alternative option below.
$ wget -O - https://deb.goaccess.io/gnugpg.key | gpg --dearmor \
| sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null
$ echo "deb [signed-by=/usr/share/keyrings/goaccess.gpg arch=$(dpkg --print-architecture)] https://deb.goaccess.io/ $(lsb_release -cs) main" \
| sudo tee /etc/apt/sources.list.d/goaccess.list
$ sudo apt-get update
$ sudo apt-get install goaccess
Note:
.debpackages in the official repo are available through HTTPS as well. You may need to installapt-transport-https.
# yum install goaccess
# pacman -S goaccess
# emerge net-analyzer/goaccess
# brew install goaccess
# cd /usr/ports/sysutils/goaccess/ && make install clean
# pkg install sysutils/goaccess
# cd /usr/ports/www/goaccess && make install clean
# pkg_add goaccess
# zypper ar -f obs://server:http http
# zypper in goaccess
# pkg install goaccess
# pkgin install goaccess
GoAccess can be used in Windows through Cygwin. See Cygwin's packages. Or through the GNU+Linux Subsystem on Windows 10.
GoAccess has minimal requirements, it's written in C and requires only ncurses. However, below is a table of some optional dependencies in some distros to build GoAccess from source.
| Distro | NCurses | GeoIP (opt) | GeoIP2 (opt) | OpenSSL (opt) |
|---|---|---|---|---|
| Ubuntu/Debian | libncursesw6-dev | libgeoip-dev | libmaxminddb-dev | libssl-dev |
| RHEL/CentOS | ncurses-devel | geoip-devel | libmaxminddb-devel | openssl-devel |
| Arch | ncurses | geoip | libmaxminddb | openssl |
| Gentoo | sys-libs/ncurses | dev-libs/geoip | dev-libs/libmaxminddb | dev-libs/openssl |
| Slackware | ncurses | GeoIP | libmaxminddb | openssl |
Note: You may need to install build tools like gcc, autoconf,
gettext, autopoint etc for compiling/building software from source. e.g.,
base-devel, build-essential, "Development Tools".
A Docker image has been updated, capable of directing output from an access log. If you only want to output a report, you can pipe a log from the external environment to a Docker-based process:
cat access.log | docker run --rm -i -e LANG=$LANG allinurl/goaccess -a -o html --log-format COMBINED - > report.html
OR real-time
tail -F access.log | docker run -p 7890:7890 --rm -i -e LANG=$LANG allinurl/goaccess -a -o html --log-format COMBINED --real-time-html - > report.html
You can read more about using the docker image in DOCKER.md.
Any help on GoAccess is welcome. The most helpful way is to try it out and give feedback. Feel free to use the Github issue tracker and pull requests to discuss and submit code changes.
You can contribute to our translations by editing the .po files direct on Github or using the visual interface inlang.com
In-memory storage provides better performance at the cost of limiting the dataset size to the amount of available physical memory. GoAccess uses in-memory hash tables. It has very good memory usage and pretty good performance. This storage has support for on-disk persistence as well.
See options that can be supplied to the command or
specified in the configuration file. If specified in the configuration file, long
options need to be used without prepending --.
Note: Piping data into GoAccess won't prompt a log/date/time configuration dialog, you will need to previously define it in your configuration file or in the command line.
To output to a terminal and generate an interactive report:
# goaccess access.log
To generate an HTML report:
# goaccess access.log -a > report.html
To generate a JSON report:
# goaccess access.log -a -d -o json > report.json
To generate a CSV file:
# goaccess access.log --no-csv-summary -o csv > report.csv
GoAccess also allows great flexibility for real-time filtering and parsing. For instance, to quickly diagnose issues by monitoring logs since goaccess was started:
# tail -f access.log | goaccess -
And even better, to filter while maintaining opened a pipe to preserve
real-time analysis, we can make use of tail -f and a matching pattern tool
such as grep, awk, sed, etc:
# tail -f access.log | grep -i --line-buffered 'firefox' | goaccess --log-format=COMBINED -
or to parse from the beginning of the file while maintaining the pipe opened and applying a filter
# tail -f -n +0 access.log | grep -i --line-buffered 'firefox' | goaccess -o report.html --real-time-html -
There are several ways to parse multiple logs with GoAccess. The simplest is to pass multiple log files to the command line:
# goaccess access.log access.log.1
It's even possible to parse files from a pipe while reading regular files:
# cat access.log.2 | goaccess access.log access.log.1 -
Note: the single dash is appended to the command line to let GoAccess know that it should read from the pipe.
Now if we want to add more flexibility to GoAccess, we can use zcat --force
to read compressed and uncompressed files. For instance, if we would
like to process all log files access.log*, we can do:
# zcat --force access.log* | goaccess -
Note: On Mac OS X, use gunzip -c instead of zcat.