FAQ

Here are some of the most frequently asked questions…

This document contains the most common questions for specific topics. These are items that don't necessarly fit in the man page. If you don't see an answer to your question here, check the man page or previously reported issues on Github.

Performance

  • How fast is GoAccess when parsing a log file?

    Keep in mind that many factors can influence the parsing time, including processor, ram, log, etc. however, generally we could derive the following table:

    GoAccess' benchmark — Intel(R) Core(TM) i7-8700K CPU @ 3.70GHz 16GB RAM
    Benchmark (v1.4) - Default Hash Tables 101,245.3 lines per second
    Benchmark full features & metrics enabled (>=v1.4) - In-memory hash table 100,502.5 lines per second

    Note: A dataset of about 400M hits (74G size) is parsed in 1H 20 mins (in-memory) consuming about 12GB RAM.

  • What's the memory footprint of GoAccess?

    GoAccess should not leak any memory, (tested with Valgrind), so mostly it will depend on the log size and features enabled. For a 3,397,814 parsed lines is ~134.1 MiB (full features enabled).

    Note
    Removing the query string with -q can greatly decrease memory consumption, especially on timestamped requests.

Log Configuration

  • How can I configure the log/date/time format for Apache or Nginx?

    If you are using the standard log format that comes with Apache or Nginx, configuring GoAccess should be pretty straightforward.

    There are several ways to set the log format. If you are outputting to a terminal (ncurses), the easiest is to run GoAccess with -c. 

    								# goaccess access.log -c

    You could also specify the log format in the command line, so for the standard Apache/Nginx format, you could run: 

    								# goaccess access.log --log-format=COMBINED

    However any of those options won't make it permanent, for that you will need to specify the format in the configuration file. See question below for more details about the configuration file.

    Note
    There's a nifty little script that can convert Nginx log_format to GoAccess log-format. https://github.com/stockrt/nginx2goaccess.
    In addition, there's a nice script that exports and transforms the Cloudflare ELS log file to be consumed by GoAccess.

    If your access log contains English months such as 12/Jan/2021 but your machine locale is not set to English, then you need to set your LC_TIME. 
    									# LC_TIME="en_US.UTF-8" bash -c 'goaccess access.log --log-format=COMBINED'
  • Where is the configuration file located?

    The configuration file is located under ~/.goaccessrc or %sysconfdir%/goaccess.conf where %sysconfdir% is usually /etc/, /usr/etc/ or /usr/local/etc/. Passing ---dcf to GoAccess will display where the config file is being read from. You can find the default configuration file here.

  • How can I configure IIS log format?

    GoAccess has a generic predefined log format option in the config file & dialog. However, this script can automatically extract the proper format from IIS log files.

HTML Report (Web Interface)

  • How do I generate a static HTML report?

    To generate an HTML report, just run it against your web log file: (-a is optional) 

    								# goaccess /var/log/apache2/access.log -a -o report.html
								OR
								# zcat -f /var/log/apache2/access.log* | goaccess -a -o report.html

    For more examples, please check GoAccess' man page

  • How do I generate a real-time HTML report?

    The process of generating a real-time HTML report is very similar to the process of creating a static report.

    Just generate a static report and place the output html file under your web server www public folder. You need to add a couple of additional real-time flags. The use of --real-time-html is required. 

    								# goaccess access.log -o /usr/share/nginx/www/rt.goaccess.io/report.html --real-time-html

    Upon opening the generated report in your browser, the report will try to establish a WebSocket connection to the host name (window.location.hostname) where the generated report is running from.

    It's also possible to specify it using --ws-url=<host>. Note that the host should point to the location where GoAccess is running and parsing logs. Also, make sure host is a valid host and should not contain http on it.

    See the man page examples for more details.

    Note
    To output real time data over a TLS/SSL connection, you need to use --ssl-cert=<cert.crt> and --ssl-key=<priv.key>.
  • How to make the HTML report work with Content Security Policy?

    You will need to set 'unsafe-inline' and 'unsafe-eval' and set a trusted source list. 

    Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"

Installation

  • What are the requirements to run GoAccess on my server?

    GoAccess has minimal requirements, it's written in C and requires only ncurses.
    Optionally, GeoIP for geolocation from MaxMind. See package details related to GoAccess

  • Which packages should I install when building GoAccess on Cygwin (Windows)?

    To build GoAccess on Windows using Cygwin, you will need to select the following packages on Cygwin's package installation screen. 

    libGeoIP-devel           | GeoIP2 C library
libncurses-devel         | Terminal display library
libncursesw10            | Terminal display library (wide-character)
gcc-core (C)             | GNU Compiler Collection
make                     | make utility
automake                 | GNU Makefiles
gettext                  | GNU Gettext
gettext-devel            | GNU Gettext
automake wrapper scripts | wrapper scripts for automake and aclocal
  • How to install GoAccess from source under OS X El Capitan?

    The following instructions allow you to install GoAccess on OS X El Capitan without relying on homebrew. (Admin privileges needed)

    1. Install the latest XCode via the Mac App Store. Check if "Command Line Tools" were also installed by looking the directory /Library/Developer/CommandLineTools/
    2. If "Command Line Tools" are not present, install "XCode Command Line Tools" by typing in the terminal: xcode-select --install
    3. Download the latest version of GoAccess.
      Binaries, configuration file and man page are installed under /usr/local/
    4. Make sure to also add /usr/local/bin/ to $PATH under ~/.bash_profile so when you invoke the goaccess command you don't have to prepend /usr/local/bin/.
    5. You may now edit your goaccess configuration file located in /usr/local/etc/
    6. Enjoy!
    Thanks to Valeriano for sharing this!

Other

  • For new releases...

    If you run an Ubuntu or Debian server, it's best to use GoAccess' official deb repo.

    If you would like to be notified of new releases of GoAccess then please follow the project on Twitter. Feel free to share it with others too :)