This document contains the most common questions for specific topics. These are items that don't necessarly fit in the man page. If you don't see an answer to your question here, check the man page or previously reported issues on Github.
How fast is GoAccess when parsing a log file?
Keep in mind that many factors can influence the parsing time, including processor, ram, log, etc. however, generally we could derive the following table:
|Benchmark (v1.4) - Default Hash Tables||101,245.3 lines per second|
|Benchmark full features & metrics enabled (>=v1.4) - In-memory hash table||100,502.5 lines per second|
Note: A dataset of about
400M hits (74G size) is parsed in 1H 20 mins (in-memory) consuming about 12GB RAM.
GoAccess should not leak any memory, (tested with Valgrind), so mostly it will depend on the log size and features enabled. For a 3,397,814 parsed lines is
~134.1 MiB (full features enabled).
-qcan greatly decrease memory consumption, especially on timestamped requests.
How can I configure the log/date/time format for Apache or Nginx?
If you are using the standard log format that comes with Apache or Nginx, configuring GoAccess should be pretty straightforward.
There are several ways to set the log format. If you are outputting to a terminal (ncurses), the easiest is to run GoAccess with
# goaccess access.log -c
You could also specify the log format in the command line, so for the standard Apache/Nginx format, you could run:
# goaccess access.log --log-format=COMBINED
However any of those options won't make it permanent, for that you will need to specify the format in the configuration file. See question below for more details about the configuration file.
12/Jan/2021but your machine locale is not set to English, then you need to set your
# LC_TIME="en_US.UTF-8" bash -c 'goaccess access.log --log-format=COMBINED'
The configuration file is located under
%sysconfdir% is either
/usr/local/etc/. You can find the default configuration file here.
GoAccess has a generic predefined log format option in the config file & dialog. However, this script can automatically extract the proper format from IIS log files.
To generate an HTML report, just run it against your web log file: (-a is optional)
# goaccess /var/log/apache2/access.log -a -o report.html OR # zcat -f /var/log/apache2/access.log* | goaccess -a -o report.html
For more examples, please check GoAccess' man page
The process of generating a real-time HTML report is very similar to the process of creating a static report.
Just generate a static report and place the output html file under your web server www public folder. You need to add a couple of additional real-time flags. The use of
--real-time-html is required.
# goaccess access.log -o /usr/share/nginx/www/rt.goaccess.io/report.html --real-time-html
Upon opening the generated report in your browser, the report will try to establish a WebSocket connection to the host name (
window.location.hostname) where the generated report is running from.
It's also possible to specify it using
--ws-url=<host>. Note that the
host should point to the location where GoAccess is running and parsing logs. Also, make sure
host is a valid host and should not contain
http on it.
See the man page examples for more details.
You will need to set 'unsafe-inline' and 'unsafe-eval' and set a trusted source list.
Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
To build GoAccess on Windows using Cygwin, you will need to select the following packages on Cygwin's package installation screen.
libGeoIP-devel | GeoIP2 C library libncurses-devel | Terminal display library libncursesw10 | Terminal display library (wide-character) gcc-core (C) | GNU Compiler Collection make | make utility automake | GNU Makefiles gettext | GNU Gettext gettext-devel | GNU Gettext automake wrapper scripts | wrapper scripts for automake and aclocal
The following instructions allow you to install GoAccess on OS X El Capitan without relying on homebrew. (Admin privileges needed)
~/.bash_profileso when you invoke the goaccess command you don't have to prepend /usr/local/bin/.