FAQ

Here are some of the most frequently asked questions…

This document contains the most common questions for specific topics. These are items that don't necessarily fit in the man page. If you don't see an answer to your question here, check the man page or previously reported issues on GitHub.

§ Performance

How fast is GoAccess when parsing a log file?

Keep in mind that many factors can influence the parsing time, including processor, RAM, log size, etc. However, generally we could derive the following benchmarks:

GoAccess' benchmark — Intel(R) Core(TM) i7-8700K CPU @ 3.70GHz 16GB RAM
Benchmark (v1.4) - Default Hash Tables 101,245.3 lines per second
Benchmark full features & metrics enabled (>=v1.4) - In-memory hash table 100,502.5 lines per second
Note
A dataset of about 400M hits (74G size) is parsed in 1H 20 mins (in-memory) consuming about 12GB RAM.

What's the memory footprint of GoAccess?

GoAccess should not leak any memory (tested with Valgrind), so mostly it will depend on the log size and features enabled. For 3,397,814 parsed lines the footprint is ~134.1 MiB (full features enabled).

Note
Removing the query string with -q can greatly decrease memory consumption, especially on timestamped requests.

§ Log Configuration

How can I configure the log/date/time format for Apache or Nginx?

If you are using the standard log format that comes with Apache or Nginx, configuring GoAccess should be pretty straightforward. There are several ways to set the log format. If you are outputting to a terminal (ncurses), the easiest is to run GoAccess with -c:

# goaccess access.log -c

You could also specify the log format in the command line. For the standard Apache/Nginx format:

# goaccess access.log --log-format=COMBINED

However, neither of those options will make the setting permanent. For that you will need to specify the format in the configuration file. See the question below for more details.

Notes
  • There's a nifty little script that can convert Nginx log_format to GoAccess log-format: https://github.com/stockrt/nginx2goaccess.
  • There's also a script that exports and transforms the Cloudflare ELS log file to be consumed by GoAccess.
  • If your access log contains English months such as 12/Jan/2021 but your machine locale is not set to English, you need to set your LC_TIME:
# LC_TIME="en_US.UTF-8" bash -c 'goaccess access.log --log-format=COMBINED'

Where is the configuration file located?

The configuration file is located under ~/.goaccessrc or %sysconfdir%/goaccess.conf where %sysconfdir% is usually /etc/, /usr/etc/ or /usr/local/etc/. Passing --dcf to GoAccess will display where the config file is being read from. You can find the default configuration file here.

How can I configure IIS log format?

GoAccess has a generic predefined log format option in the config file & dialog. However, this script can automatically extract the proper format from IIS log files.

§ HTML Report (Web Interface)

How do I generate a static HTML report?

To generate an HTML report, just run it against your web log file (-a is optional):

# goaccess /var/log/apache2/access.log -a -o report.html # zcat -f /var/log/apache2/access.log* | goaccess -a -o report.html

For more examples, please check GoAccess' man page.

How do I generate a real-time HTML report?

The process of generating a real-time HTML report is very similar to creating a static report. Just generate a static report and place the output HTML file under your web server's public folder. You need to add a couple of additional real-time flags — --real-time-html is required:

# goaccess access.log -o /usr/share/nginx/www/rt.goaccess.io/report.html --real-time-html

Upon opening the generated report in your browser, it will try to establish a WebSocket connection to the host name (window.location.hostname) where the report is running from. It's also possible to specify it using --ws-url=<host>. Note that host should point to the location where GoAccess is running and parsing logs, and should not contain http.

See the man page examples for more details.

Note
To output real-time data over a TLS/SSL connection, you need to use --ssl-cert=<cert.crt> and --ssl-key=<priv.key>.

How to make the HTML report work with Content Security Policy?

You will need to set unsafe-inline and unsafe-eval and configure a trusted source list:

Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"

§ Installation

What are the requirements to run GoAccess on my server?

GoAccess has minimal requirements — it's written in C and requires only ncurses. Optionally, GeoIP for geolocation from MaxMind. See package details related to GoAccess.

Which packages should I install when building GoAccess on Cygwin (Windows)?

To build GoAccess on Windows using Cygwin, select the following packages on Cygwin's package installation screen:

libGeoIP-devel
GeoIP2 C library
libncurses-devel
Terminal display library
libncursesw10
Terminal display library (wide-character)
gcc-core (C)
GNU Compiler Collection
make
make utility
automake
GNU Makefiles
gettext
GNU Gettext
gettext-devel
GNU Gettext development files
automake wrapper scripts
Wrapper scripts for automake and aclocal

How to install GoAccess from source under OS X El Capitan?

The following instructions allow you to install GoAccess on OS X El Capitan without relying on Homebrew. Admin privileges are needed.

  1. Install the latest Xcode via the Mac App Store. Check if "Command Line Tools" were also installed by looking in /Library/Developer/CommandLineTools/.
  2. If "Command Line Tools" are not present, install them by typing in the terminal: xcode-select --install
  3. Download the latest version of GoAccess. Binaries, configuration file and man page are installed under /usr/local/.
  4. Make sure to also add /usr/local/bin/ to $PATH under ~/.bash_profile so you don't have to prepend the full path when invoking GoAccess.
  5. You may now edit your GoAccess configuration file located in /usr/local/etc/.
  6. Enjoy!

Thanks to Valeriano for sharing this!

§ Other

How do I stay updated on new releases?

If you run an Ubuntu or Debian server, it's best to use GoAccess' official deb repo.

If you would like to be notified of new releases, please follow the project on Twitter. Feel free to share it with others too :)