GoAccess - Real-time Web Log Analyzer and Viewer

January 19, 2020 Incident Response, Tools No comments

GoAccess – Real-time Web Log Analyzer and Viewer

GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal on *nix systems or through your browser. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly.

GoAccess - Real-time Log Analyzer and Viewer — GoAccess – Real-time Log Analyzer and Viewer

This tool parses the specified web log file and outputs the data to the X terminal. Features include:

Completely Real Time – All panels and metrics are timed to be updated every 200 ms on the terminal output and every second on the HTML output.
Minimal Configuration needed – You can just run it against your access log file, pick the log format and let the tool parse the access log and show you the stats.
Track Application Response Time – Track the time taken to serve the request. Extremely useful if you want to track pages that are slowing down your site.
Nearly All Web Log Formats – allows any custom log format string. Predefined options include, Apache, Nginx, Amazon S3, Elastic Load Balancing, CloudFront, etc.
Incremental Log Processing – Need data persistence? GoAccess has the ability to process logs incrementally through the on-disk B+Tree database.
Only one dependency – GoAccess is written in C. To run it, you only need ncurses as a dependency. That’s it. It even features its own Web Socket server
Visitors – Determine the amount of hits, visitors, bandwidth, and metrics for slowest running requests by the hour, or date.
Metrics per Virtual Host – Have multiple Virtual Hosts (Server Blocks)? It features a panel that displays which virtual host is consuming most of the web server resources.
Color Scheme Customizable – Tailor GoAccess to suit your own color taste/schemes. Either through the terminal, or by simply applying the stylesheet on the HTML output.
Support for Large Datasets – GoAccess features an on-disk B+Tree storage for large datasets where it is not possible to fit everything in memory.
Docker Support – Ability to build GoAccess’ Docker image from upstream. You can still fully configure it, by using Volume mapping and editing goaccess.conf.

GoAccess allows any custom log format string. Predefined options include, but not limited to: