Have you ever wanted to peek in on the real-time activity hitting your web servers? What files or endpoints are popular right now? Is traffic spiking from a certain country? Are error responses increasing?
Monitoring and analyzing access logs centrally is critical for site reliability, planning growth, meeting security threats, optimizing performance, and informing business decisions.
This is where GoAccess shines…
GoAccess is an open source, real-time web log analyzer and interactive viewer that enables you to monitor and analyze web traffic from log files as it hits your servers.
With its fast performance and terminal-based interface, GoAccess makes it easy for developers, ops engineers, and security analysts to break down and understand:
- Traffic volumes and trends
- Visitor details
- Content and resources in demand
- Performance issues
- Errors and threats emerging
GoAccess reveals all this rich intelligence to help you make smart infrastructure decisions and troubleshoot outages and application issues quicker.
Let’s explore how it works and simplifies analyzing Nginx, Apache, and other web server logs.
Why Server Log Analysis Matters
Centralized analysis of access logs flowing from your web servers, load balancers, CDNs and APIs gives invaluable visibility across your stack.
Fundamentally it helps answer questions like:
-
How much traffic is my site getting over time? Is it seasonal?
-
Which pages or endpoints are most requested? How does this align with business goals?
-
What content types (HTML, JS, CSS, images, docs, media) dominate bandwidth?
-
Which geographic locations are connecting to my infrastructure?
-
What percentage of requests are error responses (400s/500s)? How quickly can issues be detected?
-
Do traffic patterns indicate abuse, intrusions or policy violations?
-
How do usage peaks impact server sizing and scalability requirements?
Without aggregating logs from across your web infrastructure, it becomes very hard to get data-driven answers critical for planning, security, development and operations.
This is the core problem GoAccess helps solve.
Benefits of Log Analysis with GoAccess
GoAccess was built to give web developers, system administrators and engineers direct visibility into access logs in a fast, interactive way not possible with raw log files.
Here are the main benefits it offers:
Real-time Analysis
The terminal viewer provides a real-time look into user activity and traffic hitting your web servers as access logs stream in. This enables catching issues emerging or security events unfolding.
Fast Performance & Scalability
GoAccess parses access logs and loads all metadata into memory for lightning fast responses when slicing and dicing data interactively.
The raw processing power means it easily handles heavy traffic infrastructure at massive scale. Sites serving millions of requests per hour are no match for GoAccess running on modern hardware.
Broad Log Format Compatibility
GoAccess works with standard web logs from:
- Nginx
- Apache HTTP Server
- Cloud servers like Amazon ELB, CloudFront, S3
- Also supports any server emitting the common W3C log format.
This means you get a centralized way to look across log sources.
Powerful Interactive Analysis
The intuitive terminal interface makes exploration easy with keyboard controls to filter and segment data on the fly by:
- Traffic source
- Response code
- Endpoint
- Country
- Browser
- And many other data points
Finding anomalies or drilling into traffic from a specific IP has low effort.
Standards-based Metrics
GoAccess focuses on implementing widely used web analytic dimensions. This encompasses visitors, requests, IPs, status codes, response times, geo data, browsers, operating systems, and content breakdowns.
All sliced by meaningful time frames (year, month, week, hour).
Getting Started with GoAccess
To start analyzing Nginx or Apache logs with GoAccess, there are a few ways to get up and running:
Install from OS Package Manager
For Debian/Ubuntu systems, use:
$ sudo apt install goaccessOn CentOS/RHEL:
$ sudo yum install goaccess Packages are also available for Fedora, FreeBSD and more.
Build from Source
If an OS package is not maintained, compiling from source only takes a few minutes.
On Ubuntu/Debian:
$ sudo apt-get update
$ sudo apt-get install gcc make libglib2.0-dev libgeoip-dev libncursesw5-dev
$ wget http://tar.goaccess.io/goaccess-1.7.tar.gz
$ tar -xzvf goaccess-1.7.tar.gz
$ cd goaccess-1.7/
$ ./configure --enable-utf8 --enable-geoip=legacy
$ make
$ sudo make installFor RHEL/CentOS environments:
$ sudo yum update
$ sudo yum install gcc geoip-devel ncurses-devel glib2-devel
$ wget http://tar.goaccess.io/goaccess-1.7.tar.gz
$ tar -xzvf goaccess-1.7.tar.gz
$ cd goaccess-1.7/
$ ./configure --enable-utf8 --enable-geoip=legacy
$ make
$ sudo make install Docker Container
Docker provides an isolated environment to deploy GoAccess if you want to avoid infrastructure dependencies.
The official container image can be run:
$ docker pull allinurl/goaccess
$ docker run -it --rm \
-v ~/logs:/logs \
-p 7890:7890 \
--name goaccess \
allinurl/goaccess -f /logs/nginx.log -p 7890 --log-format=COMBINEDWith just a few commands, GoAccess can now be accessed on port 7890 to analyze ~/logs/nginx.log from the host filesystem.
Loading & Parsing Web Server Logs
Once installed through a package or from source, invoke GoAccess from the command line to parse your web logs.
For Nginx logs:
$ goaccess /var/log/nginx/access.logFor Apache logs:
$ goaccess /var/log/apache2/access.logGoAccess will auto-detect the log format, load all access data into memory and display the interactive terminal dashboard for filtering and navigation.
Understanding GoAccess Views & Filters
The dashboard provides 15 different views highlighting:
- General stats – Visitors, requests, traffic volume
- Content metrics – Top requests, static assets
- Traffic sources – Referrers, search engines
- Geolocation – Visitor countries (w/GeoIP)
- Browsers – Chrome vs Firefox vs Safari
- Operating systems – Windows vs Linux vs iOS
- HTTP codes – 404 errors, 500 errors, 200s
- Response times – Average times
- And more!
You can instantly filter any view by:
- IP address
- HTTP status
- Referrer site
- Request string
- And other criteria
This real-time exploration makes self-service troubleshooting very powerful.
Log Contents Included by GoAccess
GoAccess parses a wide range of data from access logs:
- Client IP – Visitor IP address
- Date & time – Timestamp of request
- Request line – HTTP method and protocol
- Status code – HTTP response code
- Size of response – Content length
- Referrer site – Traffic source context
- User agent – Browser & operating system info
- Request time – Server processing duration
Let‘s explore additional capabilities…
Generating HTML Reports
For historical reporting, auditing or sharing metrics with stakeholders, GoAccess can render the same terminal dashboard into an HTML report.
Command to output HTML report:
$ goaccess /var/log/nginx/access.log -o /var/www/html/report.htmlNow the report is available at /var/www/html/report.html
It captures a snapshot of activity for compliance, capacity planning or uncommon traffic patterns seen in the past week or month.
Customizing Reports
HTML reports allow tweaking the color scheme, layout preferences, branding and styling:
$ goaccess --color-scheme=1 /logs/access.log -o report.html
--html-prefs=prefs.json
--html-custom-css=style.csswhere prefs.json controls the report UI and style.css allows overriding any elements.
JSON, CSV and Timecharts
In addition to HTML, GoAccess can output to JSON or CSV formats for feeding data into databases or external analysis:
$ goaccess --log-format=COMBINED /logs/access.log -o report.jsonResponse time metrics can also be rendered as interactive timecharts.
Real-time Monitoring & Alerting
For always-on monitoring, GoAccess supports real-time HTML output so reports refresh automatically displaying site activity as it happens.
$ goaccess /logs/access.log -o dashboard.html --real-time-html=10Loads log data every 10 seconds!
Streaming over WebSockets
For seamless data pushing, the WebSocket server option eliminates pull refreshes:
$ goaccess --ws-url=127.0.0.1 /logs/access.log -o dashboard.html --real-time-html
--ws-publish=../webroot/ HTML clients receive continuous log metrics changes over WebSocket, enabling building detailed monitoring dashboards.
Advanced Features
GoAccess has many advance capabilities that enhance analysis:
GeoIP Lookup for Visitor Maps
Enabled by default, GeoIP data determines country and city-level location details for IP addresses:
$ goaccess --geoip-database=/usr/share/GeoIP/GeoLite2-City.mmdb
/logs/access.log -o report.htmlGreat for seeing traffic patterns across customer geography.
Exclude or Isolate Traffic
Agents and IP ranges can be excluded completely or filtered specifically:
$ goaccess /logs/access.log --exclude-ip=192.168.1.1This flexibility helps limit noise when inspecting specific visitor behavior.
HTTP Referer Filtering
To trace how visitors arrive from a referrer url or site:
$ goaccess --ignore-referrer=.cache
/logs/access.log This will ignore tracking noise from references with .cache.
On-demand Reports via Named Pipes
For integration with monitoring systems, generate reports on request via FIFO:
$ mkfifo /tmp/pipe
$ tail -f /logs/access.log > /tmp/pipe Then query data as needed:
$ goaccess --log-fifo=/tmp/pipe -o json_report.jsonNo waiting around for batch processing!
Parse from STDIN
GoAccess accepts data over standard input, so can connect directly to live streams:
$ tail -f access.log | goaccess - Great for quick checks rather than always specifying log locations.
How GoAccess Stacks Up
While simple to use, GoAccess stands up well compared to enterprise-grade commercial tools:
| Feature | GoAccess | Splunk | ELK | Graylog |
|---|---|---|---|---|
| Open source | Yes | No | Yes | Yes |
| Real-time analysis | Yes | Yes | No | No |
| Custom dashboards | Yes | Yes | Yes | Yes |
| Cloud-based option | No | Yes | No | Yes |
| Data ingest | Logs | Logs, Metrics, Traces | Logs | Logs, Metrics |
| Scalability | High | High | High | High |
| Pricing | Free | High | Moderate | Free |
It matches or exceeds proprietary softwareLog collection, storage flexibility, and especially fast real-time data access while checking in at $0.
This makes it an easy win to quickly gain log visibility for developers through large-scale enterprise deployments.
Getting Help and Support
As an open source project, GoAccess has a number of channels for getting help:
Documentation
- Official GoAccess site – Usage guides & API docs
Community Forums
- Slack Chat – Developer & user community
- Google Groups
- GitHub Discussions
Code Contributions
- GitHub Repo – https://github.com/allinurl/goaccess
- Active development for new features and parsers
Conclusion
I hope this article gave you a good picture of how GoAccess makes parsing, analyzing, monitoring and reporting on web server access logs simple yet powerful.
The ability to break down terabytes of access logs in seconds unlocks deep visitor intelligence in real-time you just can‘t get otherwise. Being able to visually inspect traffic helps find issues quicker and make smart resource decisions.
With an easy learning curve, flexible modes of deployment, and open source licensing, it removes all friction to gaining access log visibility. This allows focusing time extracting and acting on web analytics insights rather than fighting software complexity.
To learn more and download, visit:
