GoAccess Guide

Foreword

Nginx access logs are a valuable data goldmine, but their raw format is often too voluminous and obscure for rapid insight.

Fortunately, we have powerful tools like GoAccess. It transforms complex Nginx access logs into intuitive, real-time Web statistics reports.

With GoAccess, you no longer need to manually sift through text. You can easily achieve deep analysis and visualization of log data, efficiently gaining a grasp of website traffic, user behavior, and potential security issues.

Tool Installation

You can install GoAccess using package managers on various Linux distributions:

• For Debian-based systems (e.g., Ubuntu):

  Bash

  sudo apt-get update
  sudo apt-get install goaccess
  

• For Red Hat-based systems (e.g., CentOS):

  Bash

  sudo yum -y install goaccess
  

Compiling from Source

If you prefer to install GoAccess from the source code, follow these steps:

1. Download the GoAccess source package:

   Bash

   wget https://tar.goaccess.io/goaccess-1.4.tar.gz
   

2. Decompress, compile, and install:

   Bash

   tar -xzvf goaccess-1.4.tar.gz
   cd goaccess-1.4/
   ./configure --enable-geoip --enable-utf8
   make && sudo make install
   

GoAccess Configuration and Log Format Parsing

To ensure GoAccess accurately analyzes Nginx access logs, we must correctly configure the log format parameters.

1. Configuration File Location

The main configuration file for GoAccess is typically located at /etc/goaccess/goaccess.conf. All custom settings can be managed within this file.

2. Using Default Log Format (Recommended)

If your Nginx uses the default combined access log format, you do not need to modify the configuration file. You can directly launch GoAccess from the command line using this parameter:

Bash

--log-format=COMBINED

Advantage: This method is the most convenient and allows for direct parsing of standard Nginx logs.

3. Using Custom Log Format

If your Nginx configuration defines a custom log format (e.g., fields like $request_time or $upstream_response_time are added), you must explicitly specify the corresponding log format in the GoAccess configuration file (goaccess.conf).

Key Steps:

• Locate the log format string defined in your Nginx configuration.

• In the goaccess.conf file, modify or add the log-format, time-format, and date-format directives to match your custom Nginx format.

Correct log format matching is a prerequisite for GoAccess to successfully parse data and deliver accurate analysis reports.

GoAccess Log Analysis Operations

GoAccess offers various modes to process and visualize Nginx access logs, meeting needs for both immediate inspection and continuous monitoring.

1. Interactive Terminal Analysis (Immediate View)

This is the most direct way to use GoAccess. Upon running the command in the terminal, it immediately enters an interactive interface, displaying the real-time log analysis results.

Command Format:

Bash

goaccess /var/log/nginx/access.log --log-format=COMBINED

Operation Tip: In the interactive interface, you can use the keyboard arrow keys and number keys to navigate and view different statistics panels (e.g., visitors, requests, status codes).

2. Generating Static HTML Report (Browser View)

To generate a shareable, chart-rich report, or to easily view the analysis results in a web browser, the output can be redirected to an HTML file.

Command Format:

Bash

goaccess /var/log/nginx/access.log -o report.html --log-format=COMBINED

Result: This command generates a file named report.html in the current directory, containing comprehensive statistics and visualization charts.

3. Real-Time Monitoring and Daemon Mode (Continuous Monitoring)

For scenarios requiring dynamically updated log analysis results, GoAccess supports a real-time monitoring mode and can run as a background process (daemon) to continuously update the $\text{HTML}$ report.

Command Format:

To enable real-time monitoring and output the results to a web directory, use the following full command (note that the path after $\text{-o}$ must be web-accessible):

Bash

goaccess /var/log/nginx/access.log -o /var/www/html/report.html --log-format=COMBINED --real-time-html --daemonize

GoAccess Analysis Report Interpretation

GoAccess structures complex log data into various visualization panels, helping users gain a comprehensive understanding of website operational status, traffic patterns, and user behavior from multiple dimensions.

I. General Metrics

This section provides the core macro indicators of website traffic:

II. Visitor Metrics

This section focuses on analyzing visitor attributes and geographical distribution:

III. Request and Content Metrics

This section reflects the client's requests for website resources:

IV. Performance and Bottleneck Analysis

This section focuses on service quality and response efficiency:

GoAccess Advanced Usage

In addition to basic analysis, GoAccess supports advanced uses like processing log data through pipes and filters, and analyzing multiple historical log files to meet more complex monitoring needs.

1. Real-Time Streaming Analysis (Using Pipe $\text{|}$)

GoAccess can be combined with Linux toolchains to process logs being actively written, achieving uninterrupted real-time monitoring.

Practical Value: Suitable for scenarios requiring continuous observation of current server traffic changes and the latest statistics, without waiting for the log file to finish writing.

Command Example:

Bash

tail -f /var/log/nginx/access.log | goaccess -p /etc/goaccess/goaccess.conf

Explanation:

• tail -f: Continuously follows and outputs the latest content of the log file (/var/log/nginx/access.log).

• |: Pipes the output of tail -f as input, feeding it in real-time to GoAccess for analysis.

• -p /etc/goaccess/goaccess.conf: Loads the specified configuration file to ensure correct format and options.

2. Simultaneous Analysis of Multiple Log Files (Report Merging)

GoAccess can simultaneously read and merge the contents of multiple log files, then generate a unified, comprehensive analysis report.

Practical Value: Suitable for scenarios requiring a complete historical view spanning different time periods or scattered across various files (e.g., logs split daily or by size).

Command Example:

Bash

goaccess -p /etc/goaccess/goaccess.conf access.log.1 access.log.2 access.log.3

Explanation: Simply list all log files to be analyzed in the command line; GoAccess automatically integrates and analyzes this data in chronological order.

Summary

GoAccess is a powerful log analysis tool, whose main advantages include: Real-Time Visualization, Fast and Efficient Processing, Rich Statistical Dimensions, Flexible Output Formats, Powerful Advanced Features, and High Configurability.

In short, the greatest benefit of GoAccess is that it simplifies the complexity of log analysis into intuitive, actionable insights, making it an ideal tool for operations and development personnel to quickly diagnose website traffic, performance, and potential issues.