This doc contains the most common questions for specific topics. These are items that don't necessarly fit in the man page. If you don't see an answer to your question here, check the man page or previously reported issues on Github.
Keep in mind that many factors can influence the parsing time, including processor, ram, log, etc. however, generally we could derive the following table:
|Benchmark full features & metrics enabled (>=v0.9.5) - Default Hash Tables||87,816 lines per second|
|Benchmark full features & metrics enabled (>=v0.9.5) - On-Disk B+ Tree||23,000 lines per second|
|Benchmark full features & metrics enabled (>=v0.9.5) - In-memory hash table||46,000 lines per second|
Note: A dataset of about 52M hits (12GB size) is parsed in 20 mins (in-memory), 60 mins (on-disk storage).
If you are using the standard log format that comes with Apache or Nginx, configuring GoAccess should be pretty straightforward.
There are several ways to set the log format. If you are outputting to a terminal (ncurses), the easiest is to run GoAccess with
# goaccess -f access.log -c
You could also specify the log format in the command line, so for the standard Apache/Nginx format, you could run:
# goaccess -f access.log --log-format=COMBINED
However any of those options won't make it permanent, for that you will need to specify the format in the configuration file. See question below for more details about the configuration file.
The configuration file is located under
%sysconfdir% is either
It's fairly easy to run GoAccesss, once it has been installed (no configuration is needed), just run it against your web log file: (-a is optional)
# goaccess -f /var/log/apache2/access.log -a
Filtering can be done through the use of pipes. For instance, using grep to filter specific data and then pipe the output into GoAccess. This adds a great amount of flexibility to what GoAccess can display. For example, to parse multiple log files:
# zcat -f access.log* | goaccess
For more examples, please check GoAccess' man page
The process of generating a real-time HTML report is very similar to the process of creating a static report.
Just generate a static report and place the output html file under your web server www public folder.
You need to add a couple of additional real-time flags. The use of
--real-time-html is required.
# goaccess -f access.log -o /usr/share/nginx/www/rt.goaccess.io/report.html --real-time-html --ws-url=host
Upon opening the generated report in your browser, the report will try to establish a WebSocket connection to the host specified by
Note that the
host should point to the location where GoAccess is running and parsing logs. Also, make sure
host is a valid host and should not contain http on it.
If you don't use
--ws-url, it will attempt to establish the WebSocket connection to
localhost, which means that GoAccess should be running on your local machine (the same machine running the browser)
See the man page examples for more details.
Note: Currently outputting a real-time HTML report over HTTPS is not supported. Static HTML reports work fine over SSL.
To generate an HTML report, just run it against your web log file: (-a is optional)
# goaccess -f /var/log/apache2/access.log -a -o report.html OR # zcat -f /var/log/apache2/access.log* | goaccess -a -o report.html
For more examples, please check GoAccess' man page
GoAccess should not leak any memory, (tested with Valgrind), so mostly it will depend on the log size and features enabled. For a 3,397,814 parsed lines is
~134.1 MiB (full features enabled).
Note: Removing the query string with
-q can greatly decrease memory consumption, especially on timestamped requests.
The following instructions allow you to install GoAccess on OS X El Capitan without relying on homebrew. (Admin privileges needed)
~/.bash_profileso when you invoke the goaccess command you don't have to prepend /usr/local/bin/.
If you have a large dataset that won't fit in physical memory or you want data persistence or even process logs incrementally, then you want to use the B+ Tree on-disk database.
$ ./configure --enable-utf8 --enable-geoip --enable-tcb=btree $ make # make install
Note: You need to have Tokyo Cabinet installed prior to configure GoAccess. You can install Tokyo Cabinet from your package management tool (see dependencies table), or from source (see question below). You may also choose to disable compression, see configuration options for more details.
This section describes how to install Tokyo Cabinet with the source package.
$ wget http://fallabs.com/tokyocabinet/tokyocabinet-1.4.48.tar.gz $ tar -zxvf tokyocabinet-1.4.48.tar.gz $ cd tokyocabinet-1.4.48 $ ./configure --prefix=/usr --enable-off64 --enable-fastest $ make # make install
Here are some of the top features to add:
Please see GitHub for more details.
Here's an extensible Amazon S3 and Cloudfront
log parser in Python that uses GoAccess.
(Thanks to Viktor Nagy)
GoAccess has a generic predefined log format option in the config file & dialog. However, this script can automatically extract the proper format from IIS log files.