GoAccess is an excellent Apache (and other) log statistics viewer that can be run directly on the server (and accessed/viewed via ssh) or can output an html file which you can access via a browser.
In this guide we will cover installing from repo and source, and how to integrate GoAccess access into an Apache reverse-proxy setup (like outlined here).
Install
Installing from repo
It's recommended to install via official GoAccess repo (if it's available for your distro). For Ubuntu, add the repo by:
echo "deb http://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list.d/goaccess.list wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key add - sudo apt-get update sudo apt-get install goaccess
For other distros see GoAccess's excellent download page here.
Installing from source
I actually ended up installing from source even on my Ubuntu server as the version in apt was somewhat different and didn't include some coloured themes that I like. You'll need to install some dependencies for the build.
Ubuntu dependencies:
sudo apt-get install libncursesw5-dev gcc make sudo apt-get install libgeoip-dev
Amazon Linux dependencies:
sudo yum install openssl-devel
Installing from source is fairly straight-forward.
wget http://tar.goaccess.io/goaccess-1.2.tar.gz tar -xzvf goaccess-1.2.tar.gz cd goaccess-1.2/ ./configure --enable-utf8 --enable-geoip=legacy --with-openssl sudo make sudo make install
Note we use the --with-openssl since we will be accessing our GoAccess html page via https.
A quick note on uninstalling
If you need to uninstall, switch to the goaccess source folder (from which you installed from) and do
sudo make uninstall
Running from terminal
Easiest way to run goaccess from the terminal is:
goaccess -a -f /var/log/apache2/other_vhosts_access.log
Where /var/log/apache2/other_vhosts_access.log is your apache log.
Accessing from a browser (on a reverse-proxy setup)
The main approach here is to setup a port for Apache to listen to with the associated vhost entry simply pointing to GoAccess generated html as the DocumentRoot.
Below is an example for accessing goaccess via a context path on an existing confluence install:
Note1: that the <Location /goacess> block enforces access only to the specified ip address.
Note2: this assumes saving goaccess html to /var/www/goaccess/index.html.
Real-time html
GoAccess can generate an html file and provide a websocket connection for real-time statistics viewing.
We're first going to setup the default date/time and log formats. This is done by simply uncommenting entries in /usr/local/etc/goaccess.conf
sudo nano /etc/goaccess.conf
The lines I uncommented were
... time-format %H:%M:%S ... date-format %d/%b/%Y ... # NCSA Combined Log Format with Virtual Host log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
Generating real-time html files (and open websocket on port 7890)
See below for example of real-time html file and opening a websocket on port 7890 for an existing confluence install. Note you'll likely need to open port 7890 for external connections.
sudo goaccess -a -f /var/log/httpd/access_log -o /var/www/goaccess/index.html --real-time-html --ssl-cert=<path/to/cert.pem> --ssl-key=<path/to/privkey.pem> --ws-url=wss://confluence.example.com:7890
Note that this will run GoAccess in the foreground. Append "&" to run in background (else use ctrl-z and the run "bg" to run job in background).
References
Related articles