Previously we published GoAccess guides for Nginx and Nginx log with GeoIP. Here in this guide we will show how to install GoAccess real-time web log analyzer for Apache webserver running on Ubuntu and in case of Apache you need not to separately work on how to enable Apache log to have GeoIP enabled features. Apache default log itself a standard format.
Install GoAccess Real-Time Web Log Analyzer On Apache
Ssh to server. It is very easy to install GoAccess :
echo "deb http://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list.d/goaccess.list
wget -O - http://deb.goaccess.io/gnugpg.key | sudo apt-key add -
sudo apt-get update
sudo apt-get install goaccess-tcb
We are installing
goaccess-tcb, tis is for on-disk support. You will get more information on GoAccess Github repo :
and their official website :
After installation, run :
goaccess -f access.log -a
You’ll get prompted by settings screen. Hit
C key copy-paste log-format, then press
Enter, then hit
D key, copy-paste date-format, then press
T key, copy-paste time-format, then press
%h %^[%d:%t %^] "%r" %s %b "%R" "%u"
NCSA combined log format option. You’ll see a real time coloured screen window on SSH. Hit
Q to exit. Open configuration file :
Make the similar
log-format settings active :
log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
Save the file.
In order to see real time HTML, you need to run :
goaccess -f /var/log/apache2/access.log -o /var/www/html/report.html --real-time-html
This will output
report.html at the root of the
/var/www/html directory. You can exit the program with
z and view it on your browser at IP/domain name’s file named path. Of course you can delete it by running :
As because log files are usually rotated by logging daemon, a log file is moved and replaced by a fresh, empty file. As a result, GoAccess will only be able to display statistics on a short period. To overcome this, GoAccess need to keep its own database. This is processing logs incrementally :
goaccess --load-from-disk --keep-db-files -f /var/log/apache2/access.log -o /tmp/goaccess.html
It will suck huge time and RAM for a medium sized website. You need a cron to set :
@hourly goaccess --load-from-disk --keep-db-files -f /var/log/apache2/access.log -o /var/www/html/report.html
It is important to understand that the size of logs and its database is not small. You should act accordingly.