What do you think? Discuss, post comments, or ask questions at the end of this article [More about me]

GoAccess is an excellent Apache (and other) log statistics viewer that can be run directly on the server (and accessed/viewed via ssh) or can output an html file which you can access via a browser.

In this guide we will cover installing from repo and source, and how to integrate GoAccess access into an Apache reverse-proxy setup (like outlined here).

Install

Installing from repo

It's recommended to install via official GoAccess repo (if it's available for your distro).  For Ubuntu, add the repo by:

echo "deb http://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list.d/goaccess.list
wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key add -
sudo apt-get update
sudo apt-get install goaccess

For other distros see GoAccess's excellent download page here.

Installing from source

 I actually ended up installing from source even on my Ubuntu server as the version in apt was somewhat different and didn't include some coloured themes that I like.  You'll need to install some dependencies for the build.

Ubuntu dependencies:

sudo apt-get install libncursesw5-dev gcc make
sudo apt-get install libgeoip-dev

Amazon Linux dependencies:

sudo yum install openssl-devel

Installing from source is fairly straight-forward.

wget http://tar.goaccess.io/goaccess-1.2.tar.gz
tar -xzvf goaccess-1.2.tar.gz
cd goaccess-1.2/
./configure --enable-utf8 --enable-geoip=legacy --with-openssl
sudo make
sudo make install

Note we use the --with-openssl since we will be accessing our GoAccess html page via https.

A quick note on uninstalling

If you need to uninstall, switch to the goaccess source folder (from which you installed from) and do

sudo make uninstall

Configuring

You'll most like need to configure /etc/goaccess.conf to match your log time, date and format.

Running from terminal

Easiest way to run goaccess from the terminal is:

goaccess -a -f /var/log/apache2/other_vhosts_access.log

Where /var/log/apache2/other_vhosts_access.log is your apache log.

Accessing from a browser (on a reverse-proxy setup)

The main approach here is to setup a port for Apache to listen to with the associated vhost entry simply pointing to GoAccess generated html as the DocumentRoot.

Below is an example for accessing goaccess via a context path on an existing confluence install:

Example of accessing GoAccess html via virtualhost context 
# Arbitrary port for vhost pointing to goaccess html location
Listen 99

# GoAccess generated index.html file
<VirtualHost *:99>
    DocumentRoot /var/www/goaccess
</VirtualHost>

<VirtualHost *:443>
    ServerName confluence.examaple.com

    ProxyRequests Off
    ProxyVia Off
    ProxyPreserveHost On

    # here I'm only making the /goaccess context available from home (within lan)
    <Location /goaccess>
         Require ip 10.0.0.138
    </Location>

    ProxyPass /goaccess http://127.0.0.1:99/
    ProxyPassReverse /goaccess http://127.0.0.1:99/

    ProxyPass / http://127.0.0.1:8090/
    ProxyPassReverse / http://127.0.0.1:8090/

    SSLEngine On
    SSLCertificateFile <path/to/fullchain.pem>
    SSLCertificateKeyFile <path/to/privkey.pem>
    Include /etc/letsencrypt/options-ssl-apache.conf #if use letsencrypt
</VirtualHost>

Note1: that the <Location /goacess> block enforces access only to the specified ip address.

Note2: this assumes saving goaccess html to /var/www/goaccess/index.html.

Real-time html

GoAccess can generate an html file and provide a websocket connection for real-time statistics viewing.

We're first going to setup the default date/time and log formats.  This is done by simply uncommenting entries in /usr/local/etc/goaccess.conf

sudo nano /etc/goaccess.conf

The lines I uncommented were

...
time-format %H:%M:%S
...
date-format %d/%b/%Y
...
# NCSA Combined Log Format with Virtual Host
log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u"

Generating real-time html files (and open websocket on port 7890)

See below for example of real-time html file and opening a websocket on port 7890 for an existing confluence install.  Note you'll likely need to open port 7890 for external connections.

sudo goaccess -a -f /var/log/httpd/access_log -o /var/www/goaccess/index.html --real-time-html --ssl-cert=<path/to/cert.pem> --ssl-key=<path/to/privkey.pem> --ws-url=wss://confluence.example.com:7890

Note that this will run GoAccess in the foreground.  Append "&" to run in background (else use ctrl-z and the run "bg" to run job in background).

References

  1. https://goaccess.io/download

  2. https://github.com/allinurl/goaccess/issues/683

  3. https://www.digitalocean.com/community/tutorials/how-to-install-and-use-goaccess-web-log-analyzer-with-apache-on-debian-7