# GoAccess

> Real-time web server log analyzer written in C that shows HTTP statistics in a terminal or a live HTML dashboard, with JSON and CSV export.

Stars: 21.1k · Language: C · License: MIT · Categories: System

- Repository: https://github.com/allinurl/goaccess
- Website: https://goaccess.io
- Page: https://www.trmn.sh/tools/goaccess

## Install

- Homebrew: `brew install goaccess`
- apt: `apt-get install goaccess`

## Overview

GoAccess is a web log analyzer and interactive viewer for *nix systems. It parses web server access logs and shows statistics in an ncurses terminal interface, or generates a self-contained real-time HTML report. JSON and CSV reports are also supported. Terminal panels refresh every 200 ms and the HTML output updates every second. It is written in C, and ncurses is its only required dependency. It includes its own WebSocket server for the live HTML dashboard.

It accepts any custom log format string and has predefined formats for Apache and Nginx (Combined and Common), Amazon S3, AWS Elastic Load Balancing and Application Load Balancer, CloudFront, Google Cloud Storage, Squid, W3C (IIS), Caddy JSON and Traefik CLF. Reports cover hits, visitors and bandwidth by hour or date, and the slowest requests by response time. They also cover per-virtual-host metrics, UTM campaign breakdowns, TLS protocol and cipher details, and ASN mapping (with `--exclude-asn` to drop whole networks). AI crawlers and Fediverse traffic are classified separately from search engine bots.

Logs are stored in in-memory hash tables, with optional on-disk persistence for incremental log processing across runs. The WebSocket server supports local or external JWT verification and closes connections when a token expires. Basic usage is `goaccess access.log`, or `goaccess access.log -a > report.html` for an HTML report. Piped input, such as `tail -F access.log | goaccess -`, needs the log format defined on the command line or in the config file.

It is aimed at system administrators, DevOps engineers and security professionals who want quick traffic analysis over SSH. It can also help spot scanners, bots and brute-force attempts in access logs. Docker images are available, and docker-compose is documented.

### Installation

```bash
# via Homebrew
brew install goaccess
```

```bash
# via apt
apt-get install goaccess
```

![GoAccess terminal dashboard](https://media.trmn.sh/cached/3bacedfd48f5512330f139b644ea21baa7675b304c2e576c321e4a6deab30fc0.png)

![GoAccess HTML dashboard](https://media.trmn.sh/cached/03dde9a1f33097f33ab2c8a433ecd6cac022a6194be48bfe28ef4ad567f24c31.png)

## Alternatives

- [fastfetch](https://www.trmn.sh/tools/fastfetch.md): System information tool that displays hardware and OS details with customizable ASCII art logos and module configuration (C, 25.2k stars)
- [hashcat](https://www.trmn.sh/tools/hashcat.md): Password recovery tool that cracks hashes on GPUs and CPUs using CUDA, HIP, Metal or OpenCL, with 590+ hash modes and 10 attack modes. (C, 27.2k stars)
- [nvtop](https://www.trmn.sh/tools/nvtop.md): htop-like GPU and accelerator task monitor supporting NVIDIA, AMD, Intel, Apple, and other vendors (C, 11.1k stars)
- [htop](https://www.trmn.sh/tools/htop.md): Cross-platform interactive process viewer with real-time system monitoring and process management (C, 8.4k stars)
- [CAVA](https://www.trmn.sh/tools/cava.md): Cross-platform bar spectrum audio visualizer for the terminal or SDL desktop window, with PipeWire, PulseAudio, ALSA, JACK and other input backends. (C, 6.5k stars)

---

Canonical: https://www.trmn.sh/tools/goaccess