In this guide, we are going to learn how to install GoAccess on Ubuntu 18.04/Debian 10 Buster. GoAccess is an open-source real-time web log analyzer and interactive viewer that runs in a terminal and on web browsers in Linux/Unix systems.
Install GoAccess on Ubuntu 18.04/Debian 10 Buster
GoAccess is available on the default Bionic or Buster repositories. However, the available versions may be not be the latest versions. You can confirm this by running the command below;
The only mandatory dependency for GoAccess is NCurses (libncursesw5-dev) which is installed automatically if you install GoAccess from APT. However, the command below installs ncurses and other optional dependencies.
Now that you have the GoAccess repos in place, run the command below to install it.
apt install goaccess
GoAccess is compiled with support for libssl1.0.2. However, Debian 10 Buster installs libssl1.1 which doesn’t meet GoAccess dependency issue. Hence, if you get the error;
The following packages have unmet dependencies:
goaccess : Depends: libssl1.0.2 (>= 1.0.2) but it is not installable
E: Unable to correct problems, you have held broken packages.
The most basic usage is to pass the log to analyse to GoAccess. For example;
goaccess /var/log/apache2/access.log
This will open a Log, date and time format configuration prompt.
Press space bar to select the format and press Enter to analyze the logs. The log analysis dashboard is presented on the terminal.
Scroll up and down to view dashboards.
If the logs being analyzed doesn't support the default log formats for GoAccess, you can specify your log format, date and time format with the options, --log-format, --date-format and --time-format.
For example, if you have squid logs with the EPOCH timestamp;
If you need to display the analysis on a web format, save the output of a log file into an HTML file on your web root directory. In this case, you need to have a web server installed, we are using Apache in this guide,
apt install apache2
To generate a web report, for Apache Access logs;
goaccess /var/log/apache2/access.log --log-format=COMBINED -a -o /var/www/html/analysis.html
If you access your browser via http://<server-IP>/analysis.html you should be able to see your GoAccess analytic dashboards.
Access the report via http://<server-IP>/analysis.html.
To parse the logs and display the stats in a real-time HTML report, use the --real-time-html option.
goaccess access.log --log-format=COMBINED -a -o /var/www/html/report.html --real-time-html
You can as well monitor logs on a remote server without having to install GoAccess on those servers via SSH. For example, read remote Apache logs line by line and pass it to GoAccess;
The report for the remote server is then available under http://<server-IP>/remote.html.
Well that is just it on how to install GoAccess on Ubuntu 18.04/Debian 10 Buster. To learn more about GoAccess, read the GoAccess manual page, https://goaccess.io/man.
We're passionate about sharing our knowledge and experiences with you through our blog. If you appreciate our efforts, consider buying us a virtual coffee. Your support keeps us motivated and enables us to continually improve, ensuring that we can provide you with the best content possible. Thank you for being a coffee-fueled champion of our work!
koromicha
I am the Co-founder of Kifarunix.com, Linux and the whole FOSS enthusiast, Linux System Admin and a Blue Teamer who loves to share technological tips and hacks with others as a way of sharing knowledge as:
"In vain have you acquired knowledge if you have not imparted it to others".
