GoAccess is a real-time web log analyzer for Unix-like systems, including Ubuntu. It provides an efficient and user-friendly way to visualize and analyze web server logs, supporting various formats like Apache, Nginx, and Amazon S3 logs. GoAccess can be run in the terminal or as a web-based interface, offering dynamic reports with essential metrics such as visitor counts, request details, geographic locations, and referring sites. It is appreciated for its speed, interactivity, and comprehensive insights, making it a valuable tool for system administrators and developers looking to monitor and optimize web server performance on Ubuntu systems.
In this guide, you’ll learn how to install GoAccess Log Analyzer on an Ubuntu 24.04 server.
Prerequisites
Before you begin, make sure you have the following:
- An Ubuntu 24.04 server.
- A non-root user with administrator privileges.
- A web server Apache/Nginx installed.
Installing GoAccess with APT
GoAccess Log Analyzer can be installed in two different ways, through the package manager and manually through source code. In this section, you’ll learn how to install GoAccess on Ubuntu with APT package manager.
First, run the following command to add the GPG key for the GoAccess repository.
wget -O - | gpg --dearmor | sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null
Add the GoAccess repository for Ubuntu/Debian-based distribution using the command below.
echo "deb [signed-by=/usr/share/keyrings/goaccess.gpg arch=$(dpkg --print-architecture)] $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/goaccess.list
Next, run the following ‘apt’ command to update your Ubuntu package index and install the ‘goaccess‘. Input ‘Y‘ to confirm with the installation.
sudo apt update && sudo apt install goaccess
After the installation is complete, locate the ‘goaccess‘ binary file and check the ‘goaccess‘ version with the following:
which goaccess
goaccess --version
As you can see below, the GoAccess 1.9.3 is installed at the ‘/usr/bin/goaccess‘.
Installing GoAccess from the source code
If you want to build GoAccess manually from source code, you can use the following steps:
Before compiling GoAccess, run the following ‘apt’ command to install package dependencies.
sudo apt install libncursesw5-dev libgeoip-dev libtokyocabinet-dev build-essential
Visit the GoAccess download page, grab the link for the latest version, and then download the GoAccess source code and extract it with the ‘tar’ command below.
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
Move to the ‘goaccess-*‘ directory and configure your installation with the following. In this example, you’ll enable GeoIP support through the ‘mmdb‘ database file.
cd goaccess-*/
./configure --enable-utf8 --enable-geoip=mmdb
Now run the command below to compile GoAccess and install it on your system. Once executed, GoAccess will be installed at the ‘/usr/local/bin/goaccess‘ with the default configuration directory ‘/usr/local/etc/goaccess‘.
sudo make && sudo make install
Now run the command below to verify your GoAccess version. You can see below GoAccess 1.9.3 is installed at the /usr/local/bin/goaccess.
which goaccess
goaccess --version
Integrating GoAccess with GeoIP Database
GoAccess Log Analyzer supports GeoIP integration. With this, you can display the visitor’s origin country. In this section, you’ll configure GoAccess and integrate it with the GeoIP database file.
First, visit and grab the link for the GeoIP database file and download it using the ‘wget‘ command below.
wget https://download.db-ip.com/free/dbip-country-lite-2024-07.mmdb.gz
Extract the GeoIP database file to the /opt/geoip directory with the following.
gunzip dbip-country-lite-2024-07.mmdb.gz /opt/geoip/
Next, run the ‘goaccess‘ command below to locate the default configuration directory. If you’re installing through APT, your GoAccess directory will be located in the ‘/etc/goaccess’ directory. If you’re compiling from source code, your GoAccess directory is located at the ‘/usr/local/etc/goaccess‘ directory.
goaccess --dcf
Now open the GoAccess config file ‘/usr/local/etc/goaccess/goaccess.conf‘ with the following ‘nano‘ editor command.
sudo nano /usr/local/etc/goaccess/goaccess.conf
Uncomment the ‘time-format’ and ‘date-format‘ lines like the following:
# The following time format works with any of the
# Apache/NGINX's log formats are below.
#
time-format %H:%M:%S# The following date format works with any of the
# Apache/NGINX's log formats are below.
#
date-format %d/%b/%Y
On the ‘log-format’ option, change it to ‘COMBINED‘ for common Nginx/Apache logs.
log-format COMBINEDor
log-format VCOMBINED
log-format %v:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
Uncomment the ‘geoip‘ option and add the path of the GeoIP database file.
geoip-database /home/geoip/dbip-country-lite-2021-10.mmdb
When finished, save the file and exit the editor.
Analyzing Log Apache/Nginx with GoAccess
Now that you’ve configured GoAccess and integrated it with GeoIP. In the next step, you’ll learn how to analyze log files with GoAccess.
To analyze logs with GoAccess, run the ‘goaccess‘ command below.
goaccess access.log
You can see an output like the following:
- Unique visitors per day: lists of unique visitors per day.
- Requested Files (URLs): most requested files – for non-static files.
- Static Requests: lists requests for static files such as images, CSS, and JavaScript.
- Not Found URLs (404s): pages 404 not found errors.
- Visitor Hostnames and IPs: lists of visitor hostnames and IP addresses. You can expand to get information such as country, city, and rDNS.
- Operating Systems: display visitor operating systems.
- Browsers: display visitors web browsers.
- Time Distribution: display hourly reports for unique visitors, number of hits, and bandwidth consumed.
- Virtual Hosts: display virtual hosts logs. Only active when you enable VCOMBINED or ‘%s’ on the ‘log-format’ option.
- Referrer URLs: display referrers of visitors.
You can also use the following keys to navigate through GoAccess:
- TAB to move forward between sections or SHIFT+TAB to move backward.
- F5 to refresh the goaccess dashboard.
- j to scroll down and k to scroll up.
- / to search for a pattern, and then type n to move.
- q to quit the dashboard.
- F1 or h to display help.
Below you can see the default GoAccess dashboard:
With the GeoIP integration, you will see the ‘Geo Location‘ section like the following:
Generating reports with GoAccess
In this section, you’ll generate log reports to HTML, JSON, and CSV using GoAccess Log Analyzer. You’ll also set up a real-time log analyzer.
To generate HTML reports for GoAccess, include the ‘-o’ option followed by the ‘filename.html’ like the following:
goaccess access.log -o access-log.html
Now use your web browser and navigate to the ‘access-log.html‘ file. You’ll see the following GoAccess report:
In addition to that, you can also generate log reports in JSON and CSV formats. Use the ‘goaccess’ command below.
goaccess access.log -a -d -o access.json
goaccess access.log --no-csv-summary -o access.csv
Next, you can also set up real-time log monitoring with the following ‘goaccess‘ command.
goaccess access.log -o /var/www/html/reports.html --real-time-html
Now navigate to the ‘reports.html’ page using a web browser and you’ll see the real-time reports generated by GoAccess.
Conclusion
Congratulations! You’ve completed the installation of GoAccess Log Analyzer on an Ubuntu 24.04 server. You’ve learned to install GoAccess with APT and from source code. And then you’ve learned how to analyze log files with GoAccess, generating log reports in multiple formats like HTML, JSON, and CSV. Lastly, you’ve performed a real-time log analyzer with GoAccess.
