2.20.2.2. Log analysis in GoAccess

GoAccess Is a free open source console program for viewing and analyzing web server logs. Designed for Linux and macOS. On Windows, you can use its implementation CowAxessrunning through Cygwin or directly through WSL.

To analyze logs using GoAccess, you need them first download.

To run the program in interactive mode, do the following:

1. In the console, run the command substituting for path/to/access.log let the log file:

   goaccess path/to/access.log

   If you need to analyze several logs at once, specify the paths to them separated by a space:

   goaccess path/to/access.log path/to/access.log.1

2. Using the arrows and keys Space set the switch opposite «NCSA Combined Log Format» and press Enter.
3. Wait for the log processing to complete.

The following modules are available in the program:

1. «Unique visitors per day - Including spiders» - the number of unique visitors per day, including spiders.
2. «Requested Files (URLs)» — requested URLs.
3. «Static Requests» — requests to static files.
4. «Not Found URLs (404s)» - requests for which the server returned a response 404.
5. «Visitor Hostnames and IPs» — IP addresses, countries and hosts of visitors.
6. «Operating Systems» - operating systems of visitors.
7. «Browsers» — visitors' browsers.
8. «Time Distribution» — distribution of requests by hours for.
9. «Virtual Hosts» — virtual hosts. The module will be displayed only if there is relevant information in the log.
10. «Referrers» (disabled by default) - URL from which visitors came.
11. «Referring Sites» — sites from which visitors came.
12. «Keyphrases» (disabled by default) - key phrases from Google search queries, Google cache (only HTTP requests are supported).
13. «HTTP Status Codes» - server responses.
14. «Remote User» — identifiers of persons requesting files with HTTP authentication. The module will be displayed only if there is relevant information in the log.
15. «Geo Location» - the countries of the visitors.

To work with the program in interactive mode, use the following keys:

• F1 or h - call for help.
• F5 — updating information in the main window.
• q — exit from the program or minimize the active module.
• o or Enter — expanding the active module.
• 0…9 and Shift+0…5 — activation of the module by its number (Shift must be held for modules numbered 10+).
• ↑ — scrolling the contents of the main window up.
• ↓ - scroll down the contents of the main window.
• j — moving the cursor down inside the expanded module.
• k - moving the cursor upward inside the expanded module.
• c - setting or changing the color scheme.
• Ctrl+f — scrolling forward one screen inside the active module.
• Ctrl+b - scrolling back one screen inside the active module.
• Tab — switching to the next module.
• Shisft+Tab — switching to the previous module.
• s - sorting setting for the active module.
• / — search in all active modules (regular expressions can be used).
• n — search for the next match.
• g - go to the first element of the module or to the top of the main window.
• Shift+G - go to the last element of the module or down the main window.

Before generating an HTML report, specify the log format, date and time in the GoAccess configuration file:

1. Find out the path to the GoAceess config file by running the command:

   goaccess --dcf

2. Open the configuration file for editing by running the command:

   nano way/to/configuration/file

3. Add three lines to it:

   log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
   date-format %d/%b/%Y
   time-format %T

4. Save changes with the combination Ctrl+O.
5. Exit the editor with the shortcut Ctrl+X

To generate an HTML report, run the command:

goaccess path/to/access.log -a -o path/to/report.html

• Instead path/to/access.log substitute it for the log file.
• Instead path/to/report.html specify the name of the report and the path where you want to save it.

Open the resulting file in any browser. The report will clearly reflect information on all available modules with the ability to customize the display.