2.19.2.2 Analyzing logs in GoAccess

GoAccess — a free open-source console program for viewing and analyzing web server logs. It is designed for Linux and macOS. You can use its implementation in Windows CowAxess, running through Cygwin or directly through WSL.

To analyze logs using GoAccess, you need them first download.

1. In the console, run the command substituting for path/to/access.log path to log file:

   goaccess path/to/access.log

   If you need to analyze several logs at once, specify the paths to them separated by a space:

   goaccess path/to/access.log path/to/access.log.1

2. Using the arrows and keys Space choose «NCSA Combined Log Format» and press Enter.
3. Wait for the log processing to complete.

1. «Unique visitors per day - Including spiders» — The number of unique visitors per day, including spiders.
2. «Requested Files (URLs)» — requested URLs.
3. «Static Requests» — requests to static files.
4. «Not Found URLs (404s)» — requests for which the server returned a response 404.
5. «Visitor Hostnames and IPs» — IP addresses, countries and hosts of visitors.
6. «Operating Systems» — visitor operating systems.
7. «Browsers» — visitors’ browsers.
8. «Time Distribution» — distribution of requests by hours for.
9. «Virtual Hosts» — virtual hosts. The module will be displayed only if there is relevant information in the log.
10. «Referrers» (disabled by default) — URL from which visitors came.
11. «Referring Sites» — sites from which visitors came.
12. «Keyphrases» (disabled by default) — key phrases from Google search queries, Google cache (only HTTP requests are supported).
13. «HTTP Status Codes» — server responses.
14. «Remote User» — identifiers of persons requesting files with HTTP authentication. The module will be displayed only if there is relevant information in the log.
15. «Geo Location» — visitor countries.

• F1 or h — Synopsis.
• F5 — updating information in the main window.
• q — exit from the program or minimize the active module.
• o or Enter — expanding the active module.
• 0…9 and Shift+0…5 — activation of the module by its number (Shift must be held for modules numbered 10+).
• ↑ — scrolling the contents of the main window up.
• ↓ — scroll down the contents of the main window.
• j — moving the cursor down inside the expanded module.
• k — moving the cursor inside the expanded module upwards.
• c — Set or change the color scheme.
• Ctrl+f — scrolling forward one screen inside the active module.
• Ctrl+b — scroll backward one screen within the active module.
• Tab — switching to the next module.
• Shisft+Tab — switching to the previous module.
• s — configuring sorting for the active module.
• / — search in all active modules (regular expressions can be used).
• n — search for the next match.
• g — jump to the first element of the module or to the top of the main window.
• Shift+G — jump to the last element of the module or to the bottom of the main window.

Before generating an HTML report, specify the log format, date and time in the GoAccess configuration file:

1. Find out the path to the GoAceess configuration file:

   goaccess --dcf

2. Open the configuration file for editing:

   nano way/to/configuration/file

3. Add three lines to it:

   log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
   date-format %d/%b/%Y
   time-format %T

4. Save changes by clicking Ctrl+O.
5. Exit the editor by clicking Ctrl+X

To generate an HTML report, run the command:

goaccess path/to/access.log -a -o path/to/report.html

In a team:

• path/to/access.log — path to the log file.
• path/to/report.html — the name of the report and the path where it should be saved.

Open the resulting file in any browser. The report will clearly reflect information on all available modules with the ability to customize the display.