Previously we published GoAccess guides for Nginx and Nginx log with GeoIP. Here in this guide we will show how to install GoAccess real-time web log analyzer for Apache webserver running on Ubuntu and in case of Apache you need not to separately work on how to enable Apache log to have GeoIP enabled features. Apache default log itself a standard format.
Install GoAccess Real-Time Web Log Analyzer On Apache
Ssh to server. It is very easy to install GoAccess :
1 2 3 4 | echo "deb http://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list.d/goaccess.list wget -O - http://deb.goaccess.io/gnugpg.key | sudo apt-key add - sudo apt-get update sudo apt-get install goaccess-tcb |
We are installing goaccess-tcb, tis is for on-disk support. You will get more information on GoAccess Github repo :
1 | https://github.com/allinurl/goaccess |
and their official website :
1 | https://goaccess.io |
---
After installation, run :
1 2 | cd /var/log/apache2 goaccess -f access.log -a |
You’ll get prompted by settings screen. Hit C key copy-paste log-format, then press Enter, then hit D key, copy-paste date-format, then press Enter, then T key, copy-paste time-format, then press Enter:
1 2 3 4 5 6 7 8 | log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u" date-format %d/%b/%Y time-format %H:%M:%S |
Select NCSA combined log format option. You’ll see a real time coloured screen window on SSH. Hit Q to exit. Open configuration file :
1 | nano /etc/goaccess.conf |
Make the similar time-format, date-format, log-format settings active :
1 2 3 | time-format %T date-format %d/%b/%Y log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u" |
Save the file.
In order to see real time HTML, you need to run :
1 | goaccess -f /var/log/apache2/access.log -o /var/www/html/report.html --real-time-html |
This will output report.html at the root of the /var/www/html directory. You can exit the program with control + z and view it on your browser at IP/domain name’s file named path. Of course you can delete it by running :
1 | rm /var/www/html/report.html |
As because log files are usually rotated by logging daemon, a log file is moved and replaced by a fresh, empty file. As a result, GoAccess will only be able to display statistics on a short period. To overcome this, GoAccess need to keep its own database. This is processing logs incrementally :
1 | goaccess --load-from-disk --keep-db-files -f /var/log/apache2/access.log -o /tmp/goaccess.html |
It will suck huge time and RAM for a medium sized website. You need a cron to set :
1 | crontab -e |
1 | @hourly goaccess --load-from-disk --keep-db-files -f /var/log/apache2/access.log -o /var/www/html/report.html |
It is important to understand that the size of logs and its database is not small. You should act accordingly.
