GoAccess — real-time web log analyzer for Apache, Nginx, and Caddy — garron.me

Introduction

GoAccess is an open-source real-time web log analyzer. It works directly in the terminal as an interactive ncurses dashboard, and can also generate self-contained HTML reports with charts. It supports Apache, Nginx, Caddy, Amazon S3, Elastic Load Balancing, and any server that writes standard access logs.

It is actively maintained and available in the official repositories of most Linux distributions.

Installation

On Debian and Ubuntu:

sudo apt-get install goaccess

For the latest version, the official GoAccess repository provides more recent packages:

echo "deb https://deb.goaccess.io/ $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/goaccess.list
wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key add -
sudo apt-get update && sudo apt-get install goaccess

Basic terminal usage

goaccess /var/log/nginx/access.log --log-format=COMBINED

This opens an interactive terminal dashboard. Use the arrow keys and TAB to navigate between panels; press q to quit.

Log formats

GoAccess needs to know the format of your log file. Common presets:

| Flag | Use with | |---|---| | --log-format=COMBINED | Apache / Nginx combined (most common) | | --log-format=COMMON | Apache common log | | --log-format=CADDY | Caddy JSON log | | --log-format=W3C | W3C / IIS | | --log-format=VCOMBINED | Nginx with virtual host |

You can also define a fully custom format with --log-format, --date-format, and --time-format flags.

Generate a static HTML report

goaccess /var/log/nginx/access.log --log-format=COMBINED \
  -o /var/www/html/report.html

This produces a single self-contained HTML file with interactive charts — no JavaScript CDN, no external dependencies. Open it in any browser or serve it from your web server.

Real-time HTML report

GoAccess can keep the HTML report updated in real time via WebSocket:

goaccess /var/log/nginx/access.log --log-format=COMBINED \
  --real-time-html \
  -o /var/www/html/report.html \
  --ws-url=ws://yourserver.com:7890

Analyzing compressed and rotated logs

You can pipe multiple files, including gzip-compressed rotated logs:

zcat /var/log/nginx/access.log.*.gz | \
  goaccess - --log-format=COMBINED

To include both current and rotated logs in one report:

cat /var/log/nginx/access.log \
  <(zcat /var/log/nginx/access.log.*.gz) | \
  goaccess - --log-format=COMBINED -o report.html

What the dashboard shows

Total requests, unique visitors, bandwidth consumed
Top requested URLs and static files
HTTP status codes (200, 301, 404, 500, etc.)
Traffic by hour and day
Top referring sites and search terms
Operating systems and browsers
Geolocation (requires MaxMind GeoIP database)
Top 404 pages

Conclusion

GoAccess combines the real-time view you need during an incident with the detailed HTML reports useful for sharing with a team. It handles any server that writes standard access logs, making it the practical modern replacement for older tools like ApacheTop and Webalizer.