GoAccess for Real-Time Web Log Analysis

GoAccess is an open-source, real-time web log analyzer that presents website traffic statistics through an interactive terminal interface or an HTML dashboard. Written in C, it helps system administrators, developers, and security teams understand web server activity without relying on a separate analytics platform.

GoAccess processes access logs and summarizes information such as visitor counts, requested URLs, HTTP status codes, bandwidth usage, referring sites, and response times when the required data is available. Its terminal-based interface is particularly useful for inspecting logs over SSH, while HTML reports make traffic analysis easier to share and review in a browser.

Key Features of GoAccess

Real-Time Log Monitoring

GoAccess can monitor incoming log entries and refresh its statistics as new requests are recorded. The terminal interface and HTML output support periodic updates, making the tool useful for observing traffic changes during troubleshooting or incident response. Actual update intervals depend on the configuration and output mode.

Minimal Configuration

For common web server logs, GoAccess can begin analyzing data with a log file and the appropriate format selection. Custom format strings are also supported, allowing administrators to adapt parsing to application-specific access logs.

Request and Response Analysis

Traffic panels help identify frequently requested URLs, visitor activity, bandwidth consumption, failed requests, and slow responses. Response-time analysis requires suitable timing fields in the source logs, so administrators should confirm that their web server records the necessary information.

Multiple Log Formats

GoAccess supports predefined formats for popular web servers and cloud services, along with custom log formats. Supported sources include:

• Apache and Nginx Common Log Format and Combined Log Format
• Apache virtual-host logs
• Amazon CloudFront and Amazon S3 logs
• AWS Elastic Load Balancing logs
• Google Cloud Storage logs
• Squid native logs and IIS W3C logs
• Caddy JSON logs and Traefik access logs

Check the format documentation for the version you install, particularly when processing structured logs or cloud-generated records.

Virtual Hosts and Network Insights

Reports can separate traffic by virtual host, helping administrators compare activity across websites sharing the same server. With suitable configuration and data, GoAccess can also display Autonomous System Number (ASN) information, which may help investigate unusual traffic sources. ASN information alone does not establish whether a visitor is malicious.

Large Log Files and Persistent Storage

GoAccess uses optimized data structures to process substantial log datasets. Its on-disk persistence options can preserve processed statistics between runs, reducing the need to rebuild reports from scratch in supported workflows. Memory consumption still depends on the size and variety of the data being analyzed.

Customizable Reports and Docker Support

Administrators can customize terminal colors and HTML report styling. GoAccess can also be deployed using Docker, with configuration files and volume mappings used to provide access to log files and persistent data.

Install GoAccess on Linux

Installation methods vary by distribution. On Debian-based systems, install the package from the configured repositories:

sudo apt update
sudo apt install goaccess

Verify the installation and check the available command-line options:

goaccess --version
goaccess --help

For other installation methods, configuration details, and Docker instructions, consult the official GoAccess repository.

Analyze Web Server Logs

To analyze a typical Nginx Combined Log Format access log, run:

goaccess /var/log/nginx/access.log --log-format=COMBINED

For Apache logs using the same format, specify the corresponding access log path:

goaccess /var/log/apache2/access.log --log-format=COMBINED

These paths are common examples and may differ on your system. If GoAccess reports parsing errors, verify the log format and inspect a few representative log lines before changing the configuration.

Generate HTML, JSON, and CSV Reports

GoAccess can create reports in several formats for further analysis or sharing.

Generate an HTML report:

goaccess /var/log/nginx/access.log \
  --log-format=COMBINED \
  -o report.html

Generate a JSON report:

goaccess /var/log/nginx/access.log \
  --log-format=COMBINED \
  -o report.json

Generate a CSV report:

goaccess /var/log/nginx/access.log \
  --log-format=COMBINED \
  -o report.csv

For continuous HTML reporting, GoAccess supports real-time HTML output through its WebSocket capabilities. Follow the official documentation to configure the WebSocket server, browser connection, and network access correctly. Avoid exposing an unauthenticated report publicly if it contains sensitive traffic details.

Use GoAccess for Troubleshooting and Security Monitoring

GoAccess can help identify sudden increases in requests, repeated HTTP errors, unusually popular endpoints, bandwidth spikes, and patterns that deserve further investigation. It complements tools such as Nmap for network discovery and security assessment, although the two tools serve different purposes.

Keep in mind that GoAccess analyzes the logs it receives. Missing entries, incorrect timestamps, reverse proxies, shared IP addresses, and automated traffic can affect the results. Treat unusual patterns as investigation leads rather than definitive proof of an attack.

For more details about configuration, supported log formats, report options, and deployment, visit the official GoAccess website.