[opensourcedex]

goaccess is a free, open source marketing & customer engagement project written in C and released under MIT. It has 20,930 GitHub stars, 1,193 forks and 449 open issues, and was last pushed yesterday. On this registry it ranks #4 of 50 tracked projects in Marketing & Customer Engagement, with 5 head-to-head comparisons available. It gained 2 stars over the last 3 tracked days.

What is goaccess?

What it is

GoAccess is an open source, real-time web log analyzer and interactive viewer written in C and released under the MIT license. It parses web server logs and renders the results either in a terminal on *nix systems or through a browser, updating every panel and metric every 200 milliseconds in the terminal output and every second in the HTML output. The project has been developed for roughly thirteen years and lives in the *nix command-line ecosystem, with a cluster of topics around analytics, Apache, Caddy, dashboards, and command-line tooling.

The concrete problem it addresses is the gap between raw access logs and usable insight. Server logs already contain the traffic data, but reading them line by line does not reveal which virtual host consumes the most resources, which pages are slow to serve, or which autonomous systems are generating suspicious request patterns. GoAccess parses a specified log file, applies a log format, and immediately presents hits, visitors, bandwidth, and response-time metrics by hour or date, so traffic can be monitored and anomalies detected without a separate tag-based collection pipeline.

Key capabilities

  • Real-time terminal and HTML dashboards that refresh every 200 milliseconds and every second respectively.
  • Support for nearly all web log formats, including predefined options for Apache, Nginx, Amazon S3, Amazon CloudFront, Elastic Load Balancing, AWS Elastic Load Balancing, Google Cloud Storage, Squid, W3C/IIS, Caddy's JSON structured format, and Traefik's CLF flavor, plus any custom log format string.
  • Optional tracking of application response time to identify pages that slow down a site.
  • WebSocket authentication with local and external JWT verification, secure token refresh, and integration with external authentication systems.
  • Metrics per virtual host, showing which server block consumes the most web server resources.
  • ASN (Autonomous System Number) mapping for detecting malicious traffic patterns.
  • Incremental log processing backed by on-disk persistence for large datasets, using optimized in-memory hash tables.

Who uses it and how

  • System administrators parse access logs directly in a terminal, selecting a log format and reading statistics without additional configuration.
  • DevOps engineers run it against production logs to monitor traffic and troubleshoot issues instantly.
  • Security professionals use ASN mapping to identify malicious traffic patterns and block them.
  • Operators deploy it through Docker, either building the image from upstream or using the provided docker-compose documentation, configuring it through volume mapping and goaccess.conf.
  • Teams expose the HTML dashboard in a browser, using the built-in WebSocket server and JWT verification to authenticate viewers.

Getting started

GoAccess is written in C and requires only ncurses as a dependency, so it is typically built from source or run against an access log by picking the matching log format. A Docker image can be built from upstream, with configuration handled through volume mapping and goaccess.conf, and docker-compose documentation is provided.

When to use it — and when not to

GoAccess suits anyone who already has web server logs and wants fast statistics without running a tag-based analytics service, since it reads logs rather than injecting client-side tracking

project readme (upstream, from github) — read inline

GoAccess C build GoAccess

What is it?

GoAccess is an open source, real-time web log analyzer and interactive viewer that runs in a terminal on *nix systems or directly in your browser. Designed with system administrators, DevOps engineers, and security professionals in mind, it delivers fast, actionable HTTP statistics and visual server reports on the fly. GoAccess parses your web server logs in real time and presents the data directly in the terminal or via a live HTML dashboard, making it easy to monitor traffic, detect anomalies, and troubleshoot issues instantly.

More info at: https://goaccess.io.

GoAccess Terminal Dashboard GoAccess HTML Dashboard

Features

GoAccess parses the specified web log file and outputs the data to the X terminal. Features include:

  • Completely Real Time
    All panels and metrics are timed to be updated every 200 ms on the terminal output and every second on the HTML output.

  • Minimal Configuration needed
    You can just run it against your access log file, pick the log format and let GoAccess parse the access log and show you the stats.

  • Track Application Response Time
    Track the time taken to serve the request. Extremely useful if you want to track pages that are slowing down your site.

  • WebSocket Authentication:
    GoAccess offers enhanced WebSocket authentication, supporting local and external JWT verification, with secure token refresh capabilities and seamless integration with external authentication systems.

  • Nearly All Web Log Formats
    GoAccess allows any custom log format string. Predefined options include, Apache, Nginx, Amazon S3, Elastic Load Balancing, CloudFront, etc.

  • Incremental Log Processing
    Need data persistence? GoAccess has the ability to process logs incrementally through the on-disk persistence options.

  • Only one dependency
    GoAccess is written in C. To run it, you only need ncurses as a dependency. That's it. It even features its own Web Socket server — http://gwsocket.io/.

  • Visitors
    Determine the amount of hits, visitors, bandwidth, and metrics for slowest running requests by the hour, or date.

  • Metrics per Virtual Host
    Have multiple Virtual Hosts (Server Blocks)? It features a panel that displays which virtual host is consuming most of the web server resources.

  • ASN (Autonomous System Number mapping)
    Great for detecting malicious traffic patterns and block them accordingly.

  • Color Scheme Customizable
    Tailor GoAccess to suit your own color taste/schemes. Either through the terminal, or by simply applying the stylesheet on the HTML output.

  • Support for Large Datasets
    GoAccess features the ability to parse large logs due to its optimized in-memory hash tables. It has very good memory usage and pretty good performance. This storage has support for on-disk persistence as well.

  • Docker Support
    Ability to build GoAccess' Docker image from upstream. You can still fully configure it, by using Volume mapping and editing goaccess.conf. See Docker section below. There is also documentation how to use docker-compose.

Nearly all web log formats...

GoAccess allows any custom log format string. Predefined options include, but not limited to:

  • Amazon CloudFront standard logs (legacy fixed schema).
  • Amazon Simple Storage Service (S3)
  • AWS Elastic Load Balancing
  • Combined Log Format (XLF/ELF) Apache | Nginx
  • Common Log Format (CLF) Apache
  • Google Cloud Storage.
  • Apache virtual hosts
  • Squid Native Format.
  • W3C format (IIS).
  • Caddy's JSON Structured format.
  • Traefik's CLF flavor

Why GoAccess?

GoAccess was designed to be a fast, terminal-based log analyzer. Its core idea is to quickly analyze and view web server statistics in real time without needing to use your browser (great if you want to do a quick analysis of your access log via SSH, or if you simply love working in the terminal).

It also serves as a practical tool for security monitoring, making it easy to spot suspicious activity, unusual traffic patterns, brute-force attempts, scanners, bots, and anomalous requests directly from your logs.

While the terminal output is the default output, it has the capability to generate a complete, self-contained, real-time HTML report, as well as a JSON, and CSV report.

You can see it more of a monitor command tool than anything else.

Installation

Packaging status

Build from release

GoAccess can be compiled and used on *nix systems.

Download, extract and compile GoAccess with:

$ wget https://tar.goaccess.io/goaccess-1.11.tar.gz
$ tar -xzvf goaccess-1.11.tar.gz
$ cd goaccess-1.11/
$ ./configure --enable-utf8 --enable-geoip=mmdb --with-zlib
$ make
# make install

Build from GitHub (Development)

$ git clone https://github.com/allinurl/goaccess.git
$ cd goaccess
$ autoreconf -fiv
$ ./configure --enable-utf8 --enable-geoip=mmdb
$ make
# make install

Distributions

It is easiest to install GoAccess on GNU+Linux using the preferred package manager of your GNU+Linux distribution. Please note that not all distributions will have the latest version of GoAccess available.

Debian/Ubuntu
# apt-get install goaccess

Note: It is likely this will install an outdated version of GoAccess. To make sure that you're running the latest stable version of GoAccess see alternative option below.

Official GoAccess Debian & Ubuntu repository
$ wget -O - https://deb.goaccess.io/gnugpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null
$ echo "deb [signed-by=/usr/share/keyrings/goaccess.gpg arch=$(dpkg --print-architecture)] https://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/goaccess.list
$ sudo apt-get update
$ sudo apt-get install goaccess

Note:

  • .deb packages in the official repo are available through HTTPS as well. You may need to install apt-transport-https.
Fedora
# yum install goaccess
Arch
# pacman -S goaccess
Gentoo
# emerge net-analyzer/goaccess
OS X / Homebrew
# brew install goaccess
FreeBSD
# cd /usr/ports/sysutils/goaccess/ && make install clean
# pkg install sysutils/goaccess
OpenBSD
# cd /usr/ports/www/goaccess && make install clean
# pkg_add goaccess
openSUSE
# zypper ar -f obs://server:http http
# zypper in goaccess
OpenIndiana
# pkg install goaccess
pkgsrc (NetBSD, Solaris, SmartOS, ...)
# pkgin install goaccess
Windows

GoAccess can be used in Windows through Cygwin. See Cygwin's packages. Or through the GNU+Linux Subsystem on Windows 10.

Docker

A Docker image has been updated, capable of directing output from an access log. If you only want to output a report, you can pipe a log from the external environment to a Docker-based process:

touch report.html
cat access.log | docker run --rm -i -v ./report.html:/report.html -e LANG=$LANG allinurl/goaccess -a -o report.html --log-format COMBINED -

OR real-time

tail -F access.log | docker run -p 7890:7890 --rm -i -e LANG=$LANG allinurl/goaccess -a -o report.html --log-format COMBINED --real-time-html -

There is also documentation how to use docker-compose.

Build in isolated container

You can also build the binary for Debian based systems in an isolated container environment to prevent cluttering your local system with the development libraries:

$ curl -L "https://github.com/allinurl/goaccess/archive/refs/heads/master.tar.gz" | tar -xz && cd goaccess-master
$ docker build -t goaccess/build.debian-12 -f Dockerfile.debian-12 .
$ docker run -i --rm -v $PWD:/goaccess goaccess/build.debian-12 > goaccess

You can read more about using the docker image in DOCKER.md.

Distribution

readme truncated — read the full docs on github

Frequently asked questions

Is goaccess free to use?

goaccess is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does goaccess do?

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.

What is goaccess written in?

goaccess is primarily written in C. Its source is publicly available at https://github.com/allinurl/goaccess, and it has 20,930 GitHub stars.