GoAccess is an open-source, real-time web log analyzer that presents website traffic statistics through an interactive terminal interface or an HTML dashboard. Written in C, it helps system administrators, developers, and security teams understand web server activity without relying on a separate analytics platform.
GoAccess processes access logs and summarizes information such as visitor counts, requested URLs, HTTP status codes, bandwidth usage, referring sites, and response times when the required data is available. Its terminal-based interface is particularly useful for inspecting logs over SSH, while HTML reports make traffic analysis easier to share and review in a browser.
GoAccess can monitor incoming log entries and refresh its statistics as new requests are recorded. The terminal interface and HTML output support periodic updates, making the tool useful for observing traffic changes during troubleshooting or incident response. Actual update intervals depend on the configuration and output mode.
For common web server logs, GoAccess can begin analyzing data with a log file and the appropriate format selection. Custom format strings are also supported, allowing administrators to adapt parsing to application-specific access logs.
Traffic panels help identify frequently requested URLs, visitor activity, bandwidth consumption, failed requests, and slow responses. Response-time analysis requires suitable timing fields in the source logs, so administrators should confirm that their web server records the necessary information.
GoAccess supports predefined formats for popular web servers and cloud services, along with custom log formats. Supported sources include:
Check the format documentation for the version you install, particularly when processing structured logs or cloud-generated records.
Reports can separate traffic by virtual host, helping administrators compare activity across websites sharing the same server. With suitable configuration and data, GoAccess can also display Autonomous System Number (ASN) information, which may help investigate unusual traffic sources. ASN information alone does not establish whether a visitor is malicious.
GoAccess uses optimized data structures to process substantial log datasets. Its on-disk persistence options can preserve processed statistics between runs, reducing the need to rebuild reports from scratch in supported workflows. Memory consumption still depends on the size and variety of the data being analyzed.
Administrators can customize terminal colors and HTML report styling. GoAccess can also be deployed using Docker, with configuration files and volume mappings used to provide access to log files and persistent data.
Installation methods vary by distribution. On Debian-based systems, install the package from the configured repositories:
sudo apt update sudo apt install goaccess
Verify the installation and check the available command-line options:
goaccess --version goaccess --help
For other installation methods, configuration details, and Docker instructions, consult the official GoAccess repository.
To analyze a typical Nginx Combined Log Format access log, run:
goaccess /var/log/nginx/access.log --log-format=COMBINED
For Apache logs using the same format, specify the corresponding access log path:
goaccess /var/log/apache2/access.log --log-format=COMBINED
These paths are common examples and may differ on your system. If GoAccess reports parsing errors, verify the log format and inspect a few representative log lines before changing the configuration.
GoAccess can create reports in several formats for further analysis or sharing.
Generate an HTML report:
goaccess /var/log/nginx/access.log \ --log-format=COMBINED \ -o report.html
Generate a JSON report:
goaccess /var/log/nginx/access.log \ --log-format=COMBINED \ -o report.json
Generate a CSV report:
goaccess /var/log/nginx/access.log \ --log-format=COMBINED \ -o report.csv
For continuous HTML reporting, GoAccess supports real-time HTML output through its WebSocket capabilities. Follow the official documentation to configure the WebSocket server, browser connection, and network access correctly. Avoid exposing an unauthenticated report publicly if it contains sensitive traffic details.
GoAccess can help identify sudden increases in requests, repeated HTTP errors, unusually popular endpoints, bandwidth spikes, and patterns that deserve further investigation. It complements tools such as Nmap for network discovery and security assessment, although the two tools serve different purposes.
Keep in mind that GoAccess analyzes the logs it receives. Missing entries, incorrect timestamps, reverse proxies, shared IP addresses, and automated traffic can affect the results. Treat unusual patterns as investigation leads rather than definitive proof of an attack.
For more details about configuration, supported log formats, report options, and deployment, visit the official GoAccess website.
A data protection platform is a unified system that helps organizations discover, classify, monitor, and…
AI companies operating in or around Switzerland face a compliance challenge that most legal teams…
Two major data privacy laws now govern how organizations handle personal data across Europe; the…
This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…
When I first started learning malware analysis and reverse engineering, I thought the hardest part…
Both git fetch and git pull talk to a remote repository, but they do very different things to your…