GoAccess Web Log Analyzer Installation on CentOS

GoAccess web log analyzer is a beautiful tool to show real-time traffic and stats – including GeoIP information, bandwidth usage, and visitor time distributions – of my web projects and apps over and above Google’s Webmaster Tools and UA reporting.

GoAccess homepage
GoAccess homepage screenshot – https://goaccess.io

At a glance I can see current traffic and historic traffic just by adding a single html file in a public-facing (password protected) folder (e.g. report.html). It’s quick to set up, uses a WebSocket on the front end for displaying real-time log analysis, and has low server overhead.

GoAccess Apache/Nginx web log analyzer
A live GoAccess web log dashboard I manage

Additionally admins can set up the vhost log files’ format to include virtual hosts in order to see the traffic breakdown to the server(s) across all sites and subdomains (For example, if you’re using subdomains for parallel downloading of assets, internal company domains, etc.). It’s easier to install on Debian/Ubuntu, so I’ll share how I installed it on CentOS/RHEL. There are a few gotchas that I’ve mapped out, so I hope this is useful to someone else.

Install GoAccess on CentOS

First, I like to update my system before installing any new major packages. As an elevated user:

You can install GoAccess directly for CentOS (e.g. yum install goaccess), but it might be a version or two behind. You could add the official GoAccess Debian repo on Debian or Ubuntu and install from there. In the case of CentOS I chose to make the latest release. Let’s do that.

Configure and Make

Let’s make sure our build tools are installed first:

To wget the latest GoAccess, go to the official web site and copy the latest download link (at this time it is version 1.2). We’ll wget that below:

GoAccess latest version
GoAccess latest version

This will install the log analyzer to /tmp/goaccess-1.2. Feel free to move this folder and/or the executable goaccess to your favorite system location.

Using MaxMind GeoIP2

Since it’s available, let’s use the GeoIP ability integrated in GoAccess. We’ll be using MaxMind’s free GeoIP2 city database. You are able to configure your preferred database, say if you have a commercial version or you’d only like the country DB, in the configuration if you need to do so.

Gotcha: When you ./configure GoAccess you might get this error: “configure: error: *** Missing development files for libmaxminddb library.” First we must install the MaxMind library with yum install libmaxminddb-devel. We can configure the DB path in he config file itself, or on the command line. See https://goaccess.io/man

We’re about to configure and make GoAccess with TLS support (https websocket connections), UTF-8 log support, and MaxMind’s GeoIP2 DB format support.

Minimal Configuration of GoAccess

We can now test out GoAccess in the terminal. Assuming your logs are in /var/log/httpd/, you can run the following. Adjust the path for your log files.

Out of the box, the NCSA combined log format is probably what most Apache servers are configured with. There is the ability to analyze combined virtual host files if, say, all your virtual servers write to the same log file. See https://goaccess.io/man for details. Let’s use a per-host log file setup for now.

GoAccess terminal opening screen NCSA log format
GoAccess terminal opening screen

After pressing down once, hitting space on NCSA, and hitting enter, you should see a similar screen to this one:

GoAccess sample web log display
GoAccess sample web log display

You can quit by pressing q.

To get the beautiful reports updated in real-time through a WebSocket we need to edit a configuration file.

Gotcha: If you get the message “Fatal error has occurred. Error occurred at: src/parser.c – parse_log – 2705. No time format was found on your conf file.“, that means your goaccess.conf has not been configured yet. See below.

To find out the default config path, you can use the --dcf switch (dcf = “default config file”):

Out of the box we can edit this config file with vi/nano/gedit or anything you like. I prefer editing config files over SFTP in Notepad++ myself. Uncomment the time-format of your web server logs. In my case I’m using plain Apache 2.4.6 (not FastCGI/FPM), so the time format on line 13 is fine.

Gotcha: If you have trouble with GoAccess not parsing your timezone string correctly in Debian, you may have to add an extra parameter. Your time-format string would then look like time-format %H:%M:%S %Z with the added %Z.

Next we will need to specify a log date format. Again under Apache, the date format on line 36 is the one I want.

Next, specify a log format. With Apache out of the box it’s usually the NCSA combined log format (which includes the referrer %R and the user-agent string %u). Here is what a typical httpd.conf looks like around the log format section:

We can see that the “combined” log format matches the NCSA combined format. Let’s use that:

The default goaccess.conf file is about 718 lines long. The above three settings are the bare minimum required to enable the web dashboard. Start the GoAccess server on default port 7890:

Ready for WebSocket connections
Ready for WebSocket connections

Assuming you have a virtual host or the default host enabled, and Apache running, you can navigate to or http://localhost/report.html. You should see a dashboard like so:

GoAccess dashboard live updating
GoAccess dashboard live updating
Gotcha: If your machine has iptables or FirewallD running, then you’ll have to add a TCP rule for port 7890 (for iptables: iptables -A INPUT -p tcp --dport 7890 -j ACCEPT and service iptables restart, or for FirewallD: firewall-cmd --permanent --zone=public --add-port=7890/tcp and systemctl restart firewalld). You can configure any port to bind to, actually.

With this beautiful log analyzer now running, we can customize the colors, panels, IP exclusions, filters, and so much more. See https://goaccess.io/man for all the configuration options.

Sample Log Panels

I’ll finish with some sample panels to highlight the features of GoAccess.

Bandwidth Usage

Sample GoAccess panel bandwidth usage

Top Browsers

GoAccess dashboard top browsers

Time Distribution

Website visits time distribution