GoAccess

GoAccess is an open-source, real-time web log analyzer and interactive viewer. It parses web server logs to provide HTTP statistics and visual reports, allowing users to monitor traffic and detect anomalies. The software operates as a command-line interface tool on Unix-like systems or as a web application via a browser, providing a way to analyze server data without needing a full analytics suite.

Users can deploy GoAccess as a standalone binary, through a Docker container, or via various system package managers. It supports both a terminal-based user interface for quick analysis via SSH and the generation of self-contained HTML, JSON, or CSV reports for broader distribution. The tool is designed to function as a monitor command tool that processes data on the fly.

Key features

• Real-time updates every 200ms in the terminal and every second in HTML output
• Support for custom log formats including Apache, Nginx, Caddy, and Amazon S3
• Application response time tracking to identify slow pages
• WebSocket authentication with local and external JWT verification
• Incremental log processing with on-disk persistence
• ASN mapping to identify and block malicious traffic patterns
• Resource consumption metrics per virtual host
• Optimized in-memory hash tables for processing large datasets

Written in C with ncurses as its only primary dependency, the software is designed for high performance and low memory usage. It is intended for system administrators, DevOps engineers, and security professionals who need to spot brute-force attempts, scanners, or bots directly from server logs. The tool includes its own WebSocket server to facilitate the live HTML dashboard functionality and supports volume mapping for configuration via goaccess.conf when used in Docker environments.

Beyond basic traffic monitoring, the software allows for the customization of color schemes in both the terminal and HTML outputs via stylesheets. It provides detailed metrics on hits, visitors, and bandwidth, broken down by the hour or date. This makes it suitable for environments where privacy and local data control are priorities.

GoAccess serves as a monitoring tool for server administrators who prefer terminal-based workflows or lightweight web reports over heavy analytics suites.