GoAccess

GoAccess is a web log analyzer and interactive viewer for *nix systems. It parses web server access logs and shows statistics in an ncurses terminal interface, or generates a self-contained real-time HTML report. JSON and CSV reports are also supported. Terminal panels refresh every 200 ms and the HTML output updates every second. It is written in C, and ncurses is its only required dependency. It includes its own WebSocket server for the live HTML dashboard.

It accepts any custom log format string and has predefined formats for Apache and Nginx (Combined and Common), Amazon S3, AWS Elastic Load Balancing and Application Load Balancer, CloudFront, Google Cloud Storage, Squid, W3C (IIS), Caddy JSON and Traefik CLF. Reports cover hits, visitors and bandwidth by hour or date, and the slowest requests by response time. They also cover per-virtual-host metrics, UTM campaign breakdowns, TLS protocol and cipher details, and ASN mapping (with --exclude-asn to drop whole networks). AI crawlers and Fediverse traffic are classified separately from search engine bots.

Logs are stored in in-memory hash tables, with optional on-disk persistence for incremental log processing across runs. The WebSocket server supports local or external JWT verification and closes connections when a token expires. Basic usage is goaccess access.log, or goaccess access.log -a > report.html for an HTML report. Piped input, such as tail -F access.log | goaccess -, needs the log format defined on the command line or in the config file.

It is aimed at system administrators, DevOps engineers and security professionals who want quick traffic analysis over SSH. It can also help spot scanners, bots and brute-force attempts in access logs. Docker images are available, and docker-compose is documented.

Installation

# via Homebrew
brew install goaccess

# via apt
apt-get install goaccess