Use and Install GoAccess to analyze Apache logfiles on Linux

GoAccess is a real time web log analyzer and visualizer for Linux and Unix operating systems. It runs as an interactive program in the terminal, and later versions also provide an HTML report that can be conveniently viewed in the browser. GoAccess is open source and uses the MIT license.

Getting Started

To complete this guide, you will need the following:
• 1 Node (Cloud Server or Dedicated Server) with any Linux distribution installed.
• All commands should be run as the root user

Tutorial

First, install GoAccess on your machine. You’ll most likely be able to find it in your distribution’s default package repositories.

On CentOS 6 or CentOS 7, you can use this command to install GoAccess:

yum -y install goaccess

If on Ubuntu 14 through 16, or if using Debian 7 or Debian 8, use this command instead:

apt-get -y install goaccess

Another option is to add the GoAccess official repository and install it from there. This is useful in case your distribution does not have the latest version of the software.

echo "deb http://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list.d/goaccess.list
wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key add -
apt-get update
apt-get install goaccess

If using another operating system, you can search for pre-compiled binaries at the official website. If none are available for your system, then a final option is to compile GoAccess from source:

wget http://tar.goaccess.io/goaccess-1.0.1.tar.gz
tar -xzvf goaccess-1.0.1.tar.gz
cd goaccess-1.0.1/
./configure --enable-geoip --enable-utf8
make
make install

Using GoAccess

After installation, find the access logfiles for Apache. This can change from machine to machine. For the purpose of these instructions we will assume that they are in the default location.

You may have multiple access logfiles. In that case, make sure to run GoAccess on the most recent, active logfile with the following flags: -f which will allow you to specify the path of the logfile location, and -a which is the option to see all stats available.

goaccess -f /var/log/httpd/access_log -a

You will be prompted to select the log format. If you are using a default server with the standard log file output, select the NCSA combined log format.

Press the Enter key and GoAccess will begin to analyze your log file. Once it is fully parsed, you will be redirected to the following command line interface. (Local IP addresses are being used for the purpose of this KB article.)

This visual interface will aid you in analyzing your logfiles for bottlenecks and inefficiencies. If you have selected an active logfile as directed to above, GoAccess will continue to analyzing logs as they are populated.

GoAccess live reporting in HTML format

Recent versions of GoAccess allow the user to generate a live HTML report that can be viewed through the web browser. In order to do so, some additonal setup is required.

Configure unattended startup

Find the GoAccess configuration file. It will be located at /usr/local/etc/goaccess.conf if you are using CentOS 6 with a compiled version of GoAccess. Otherwise, the program locate is invaluable in determining the location of the configuration file.

In each of the 4 sections of the file, find the parameters that correspond to your log format and uncomment them. For Standardized NGINX and Apache log formats, uncomment the following lines:

nano /usr/local/etc/goaccess.conf
time-format %H:%M:%S
date-format %d/%b/%Y
log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"

Once the lines above are uncommented, you will be able to launch GoAccess in “unattended” mode without having to select those log formats from the prompt as specified above.

Start GoAccess with HTML Generation

To enable live reporting, simply issue the following command. This will output report.html at the root of the /var/www/html directory. You may output it in any folder served by your Apache instance so that you can view the HTML file:

goaccess -f /var/log/httpd/access_log -o /var/www/html/report.html --real-time-html

In order to view the generated HTML report, simply navigate to report.html using your web browser.

See the screenshot below for an example of that report:

Conclusion

Congratulations! Now you know how to install and use GoAccess to analyze Apache logfiles. If this guide was helpful to you, kindly share it with others who may also be interested.