goaccess - Fast web log analyzer and interactive viewer.
goaccess -f log [-c][-r][-m][-h][-q][-d][-g][-a][-o csv|json][-e IP_ADDRESS][...]
goaccess is a free (GPL) real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. GoAccess parses the specified web log file and outputs the data to the X terminal. Features include:
-ais enabled, a list of user agents will be displayed.
Path to input log file.
Prompt date and log format configuration window.
-e ip address
Exclude an IP from being counted under the HOST module.
Enable a list of User-Agents for the selected host.
Disables IP resolver
Enable mouse support on main dashboard.
Ignore request's query string.
Enable IP resolver on html|json output.
-p conf file
Use a custom configuration file.
-o csv for CSV.
-o json for JSON.
GoAccess can parse virtually any web log format.
Predefined options include, Common Log Format (CLF), Combined Log Format (XLF/ELF), including virtual host, W3C format (IIS) and Amazon CloudFront (Download Distribution).
GoAccess allows any custom format string as well.
There are two ways to configure the log format. The easiest is to run GoAccess with
-c to prompt a configuration window. Otherwise, it can be configured under
The date_format variable followed by a space, specifies the log format date containing any combination of regular characters and special format specifiers. They all begin with a percentage (%) sign. See http://linux.die.net/man/3/strftime
The log_format variable followed by a space, specifies the log format string.
date field matching the date_format variable.
host (the client IP address, either IPv4 or IPv6)
The request line from the client.
The status code that the server sends back to the client.
The size of the object returned to the client.
The "Referer" HTTP request header.
The User-Agent HTTP request header.
The time taken to serve the request, in microseconds.
The time taken to serve the request, in seconds. Note:
%D will take priority over
%T if both are used.
Ignore this field.
GoAccess requires the following fields:
Redraw main window.
Quit the program, current window or collapse active module
Expand selected module or open window
Shift + 0
Set selected module to active
Scroll down within expanded module
Scroll up within expanded module
Set or change scheme color
Scroll forward one screen within active module
Scroll backward one screen within active module
Iterate modules (forward)
SHIFT + TAB
Iterate modules (backward)
Sort options for active module
Search across all modules (regex allowed)
Find position of the next occurrence
Move to the first item or top of screen
move to the last item or bottom of screen
The simplest and fastest usage would be:
# goaccess -f access.log
That will generate an interactive text-only output.
To generate full statistics we can run GoAccess as:
# goaccess -f access.log -a
To generate an HTML report:
# goaccess -f access.log -a > report.html
To generate a JSON file:
# goaccess -f access.log -a -d -o json > report.json
To generate a CSV file:
# goaccess -f access.log -o csv > report.csv
-a flag indicates that we want to process an agent-list for every host parsed.
-d flag indicates that we want to enable the IP resolver on the HTML | JSON output.
(It will take longer time to output since it has to resolve all queries.)
-c flag will prompt the date and log format configuration window. Only when curses is initialized.
Now if we want to add more flexibility to GoAccess, we can do a series of pipes. For instance:
If we would like to process all
access.log.*.gz we can do:
# zcat access.log.*.gz | goaccess OR # zcat -f access.log* | goaccess
Another useful pipe would be filtering dates out of the web log
The following will get all HTTP requests starting on 05/Dec/2010 until the end of the file.
# sed -n '/05\/Dec\/2010/,$ p' access.log | goaccess -a
If we want to parse only a certain time-frame from DATE a to DATE b, we can do:
# sed -n '/5\/Nov\/2010/,/5\/Dec\/2010/ p' access.log | goaccess -a
Note that this could take longer time to parse depending on the speed of sed.
Also, it is worth pointing out that if we want to run GoAccess at lower priority, we can run it as:
# nice -n 19 goaccess -f access.log -a
and if you don't want to install it on your server, you can still run it from your local machine:
# ssh root@server 'cat /var/log/apache2/access.log' | goaccess -a
For now, each active window has a total of
300 items. Eventually this will be customizable.
Piping a log to GoAccess will disable the real-time functionality. This is due to the portability issue on determining the actual size of STDIN. However, a future release *might* include this feature.
If you think you have found a bug, please send me an email to
Gerardo Orellana For more details about it, or new releases, please visit http://goaccess.prosoftcorp.com