2.19.2.2. Analyze logs in GoAccess

GoAccess is a free, open-source command-line tool for viewing and analyzing web server logs. It is designed for Linux and macOS. On Windows, you can use its implementation, CowAxess, which runs via Cygwin or directly via WSL.

To analyze logs using GoAccess, you must first download them.

1. In the console, run the following command, replacing path/to/access.log with the path to the log file:

   goaccess path/to/access.log

   If you need to analyze multiple logs at once, separate their paths with a space:

   goaccess path/to/access.log path/to/access.log.1

2. Use the arrow keys and the Space key to select "NCSA Combined Log Format" and press Enter.
3. Wait for the log processing to finish.

1. "Unique visitors per day - Including spiders" — the number of unique visitors per day, including web crawlers.
2. "Requested Files (URLs)" — requested URLs.
3. "Static Requests" — requests for static files.
4. "Not Found URLs (404s)" — requests for which the server returned a 404 response.
5. "Visitor Hostnames and IPs" — IP addresses, countries, and hostnames of visitors.
6. "Operating Systems" — the operating systems used by visitors.
7. "Browsers" — browsers used by visitors.
8. "Time Distribution" — the distribution of requests by time of day.
9. "Virtual Hosts" — virtual hosts. This module will only be displayed if the log contains the relevant information.
10. "Referrers" (disabled by default) — the URLs from which visitors came.
11. "Referring Sites" — the sites from which visitors came.
12. "Keyphrases" (disabled by default) — key phrases from Google search queries and the Google cache (only HTTP queries are supported).
13. "HTTP Status Codes" — server responses.
14. "Remote User" — identifiers of users requesting files via HTTP authentication. This module will only be displayed if the log contains the relevant information.
15. "Geo Location" — countries of visitors.

• F1 or h — help.
• F5 — updating information in the main window.
• q — exiting the program or minimizing the active window.
• o or Enter — expanding of the active module.
• 0…9 and Shift+0…5 — activation of the module by its number (Shift must be held down for modules numbered 10 or higher).
• ↑ — scrolling up the contents of the main window.
• ↓ — scrolling down the content of the main window.
• j — moving the cursor down within the expanded module.
• k — moving the cursor up within the expanded module.
• c — setting or changing the color scheme.
• Ctrl+f — scrolling within the active module by one screen forward.
• Ctrl+b — scrolling within the active module to go back one screen.
• Tab — switching to the next module.
• Shisft+Tab — switch to the previous module.
• s — configuring sorting for the active module.
• / — searching across all active modules (regular expressions can be used).
• n — searching for the next match.
• g — going to the first element of the module or to the top of the main window.
• Shift+G — going to the last item in the module or scrolling down the main window.

Before generating the HTML report, specify the log format, dates, and times in the GoAccess configuration file:

1. Find the path to the GoAccess configuration file:

   goaccess --dcf

2. Open the configuration file for editing:

   nano path/to/the/configuration/file

3. Add three lines to it:

   log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
   date-format %d/%b/%Y
   time-format %T

4. Save your changes by pressing Ctrl+O.
5. Exit the editor by pressing Ctrl+X

To generate an HTML report, run the following command:

goaccess path/to/access.log -a -o path/to/report.html

In command:

• path/to/access.log — path to the log file.
• path/to/report.html — the report name and the path where it should be saved.

Open the resulting file in any browser. The report will clearly display information on all available modules, with the option to customize the display.