Determining the parsing time will depend on different factors that might affect the end results, such as processor, ram, log, etc. However, in general we could derive the following table:
| GoAccess' Benchamarks | |
| Benchmark with full features enabled | 100,000 lines per second |
| Benchmark with default features enabled | 108,000 lines per second |
Benchmarks were tested on: AMD Sempron(tm) Processor 2310 MHz - 2GB RAM
- One source reported parsing 123,164,163 hits on 2912 secs (48.53 mins) 8GB ram
- 2bits reported 9,197,594 hits in 139 secs. (2.31 mins) & 19,087,802 in 622 secs (10.36 mins) 16GB, 8GB ram
I'm definitely planning to add up the following features:
GoAccess supports both of Apaches' formats, the Common Log Format and the Combined Log Format including Virtual Host . For more information about them, visit Apache's documentation
Formats:
127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET / HTTP/1.0" 200 2326
127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] "GET / HTTP/1.0" 200 236 "http://hi.com/" "Mozilla/5.0 (Win98; I)"
host.com:80 127.0.0.1 - - [27/Feb/2010:05:42:55 -0600] "GET / HTTP/1.1" 401 401 "http://hi.com/" "Mozilla/5.0"
It's fairly easy to run GoAccesss, once it has been installed (no configuration is needed), just run it against the Apache's log file: (note that -s -a and -b are optional)
goaccess -f /var/log/apache2/access.log -s -b -a
Now if we want to add more flexibility to GoAccess, we can do a series of pipes. For instance:
If we would like to process all access.log.*.gz we can do:
# zcat access.log.*.gz | goaccess
OR
# zcat -f access.log* | goaccess
For more examples, please check GoAccess' man page
GoAccess is written in C, ncurses for the user interface, GLib >= 2.0.0, and GeoIP (optional) for geolocation data from MaxMind. See Packages details related to GoAccess
GoAccess should not leak any memory, (tested w/ Valgrind), so mostly it will depend on the log size and the initial parse. For 100,000 parsed lines is about ~3.4MiB.
If you would like to be notified of new releases of GoAccess then please subscribe to the Freshmeat project. Feel free to rate or add a comment to the project. Freshmeat
This was fixed on version 0.4 - GLib 2.0 or later is now required instead of 2.16, as in previous versions.
There are some reports from people getting the following error under CentOS 5.5 and Redhat Enterprise:
Error: GHashTableIter undeclared (first use in this function)...
If you need to upgrade Glib2 to a more recent version, then you could do the following: (Note: I have only tested under CentOS 5.5)
Please be aware that if other packages on your system depend on older Glib2 versions, there might be a risk to break something up. However, generally speaking it shouldn't.
# wget http://ftp.acc.umu.se/pub/GNOME/sources/glib/2.16/glib-2.16.0.tar.gz
# tar zxvf glib-2.16.0.tar.gz
# cd glib-2.16.0/
# ./configure
# make
# make install
# echo "/usr/local/lib/" >> /etc/ld.so.conf.d/glib2-i386.conf
# ldconfig
# export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/lib/pkgconfig
This was fixed on version 0.4.1
GeoIP is required on versions ≤0.4, however, I have created a PATCH that will make configure to skip the GeoIP check.
The next release will make GeoIP optional and as part of the ./configure options.
# wget http://goaccess.prosoftcorp.com/patches/goaccess-0.4.geoip.patch.1
# cd goaccess-0.4/
# patch --dry-run -p1 -i ../goaccess-0.4.geoip.patch.1
# patch -p1 -i ../goaccess-0.4.geoip.patch.1
# ./configure
OR
# ./configure --enable-geoip
# make
# make install
Thanks to Chris Orgill, GoAccess has been successfully built under OpenBSD 4.8-current. Here the shared steps:
(ksh)
# pkg_add GeoIP
# pkg_add glib2
# export LDFLAGS=-L/usr/local/lib
parser.c line 613 lvalue required as left operand
- stdin = freopen("/dev/tty", "r", stdin);
+ freopen("/dev/tty", "r", stdin) ;
ui.c GeoIP.h no such file or directory
It is included in the OpenBSD GeoIP-1.4.6.tar.gz package - it gets put into /usr/local/include, but the configure script doesn't see it. So you do still need a copy in the install directory.
util.c line 132 AF_INET undeclared in reverse_ip()
+ #include <sys/socket.h>
Security warnings about uses of strcpy() instead of strlcpy() in ui.c and sprintf() instead of snprintf() in settings.c !!, then
# ./configure --enable-geoip ; make ; make install
Runs to completion.
Can't --enable-utf8 because only the built-in system ncurses is available, not ncursesw.
Last Modified: 2011-12-26 09:48:43
The official man page for the current version is available here