Install GoAccess on Ubuntu 18.04/Debian 10 Buster

0
801
Install GoAccess on Ubuntu 18.04/Debian 10 Buster

In this guide, we are going to learn how to install GoAccess on Ubuntu 18.04/Debian 10 Buster. GoAccess is an open-source real-time web log analyzer and interactive viewer that runs in a terminal and on web browsers in Linux/Unix systems.

Install GoAccess on Ubuntu 18.04/Debian 10 Buster

GoAccess is available on the default Bionic or Buster repositories. However, the available versions may be not be the latest versions. You can confirm this by running the command below;

apt-cache policy goaccess
goaccess:
  Installed: (none)
  Candidate: 1:1.2-4+b10
  Version table:
     1:1.2-4+b10 500
        500 http://deb.debian.org/debian buster/main amd64 Packages

GoAccess v1.3 is the latest stable release as of this writing. To install the latest version, you need to add GoAccess repository.

Install GoAccess APT Repository

Run the command below to install the GoAccess APT repository on both Bionic and Buster.

echo "deb http://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list.d/goaccess.list

Next, install the GoAccess repository signing key.

wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key add -

On Debian 10 Buster, you might need to install gnupg2 just in case you encounter the error, Cannot write to ‘-’ (Broken pipe).

apt install gnupg2

Once that is done, run system update to resynchronize packages to their latest versions.

apt update

You can now verify that GoAccess v1.3 is available for download.

apt-cache policy goaccess
goaccess:
  Installed: (none)
  Candidate: 1:1.3-1
  Version table:
     1:1.3-1 500
        500 http://deb.goaccess.io buster/main amd64 Packages
     1:1.2-4+b10 500
        500 http://deb.debian.org/debian buster/main amd64 Packages

Install Required Dependencies

The only mandatory dependency for GoAccess is NCurses (libncursesw5-dev) which is installed automatically if you install GoAccess from APT. However, the command below installs ncurses and other optional dependencies.

apt install libncursesw5-dev libgeoip-dev libmaxminddb-dev libtokyocabinet-dev libssl-dev

Install GoAccess on Ubuntu 18.04/Debian 10

Now that you have the GoAccess repos in place, run the command below to install it.

apt install goaccess

GoAccess is compiled with support for libssl1.0.2. However, Debian 10 Buster installs libssl1.1 which doesn’t meet GoAccess dependency issue. Hence, if you get the error;

The following packages have unmet dependencies:
 goaccess : Depends: libssl1.0.2 (>= 1.0.2) but it is not installable
E: Unable to correct problems, you have held broken packages.

Simply download libssl1.0.2 and install it.

wget http://ftp.br.debian.org/debian/pool/main/o/openssl1.0/libssl1.0.2_1.0.2r-1~deb9u1_amd64.deb
apt install ./libssl1.0.2_1.0.2r-1~deb9u1_amd64.deb

Then proceed to install GoAccess on Debian 10.

apt install goaccess

Run GoAccess

To obtain goaccess command line usage, run;

goaccess --help

The most basic usage is to pass the log to analyse to GoAccess. For example;

goaccess /var/log/apache2/access.log

This will open a Log, date and time format configuration prompt.

Install GoAccess on Ubuntu 18.04/Debian 10 Buster

Press space bar to select the format and press Enter to analyze the logs. The log analysis dashboard is presented on the terminal.

GoAccess dashboards

Scroll up and down to view dashboards.

If the logs being analyzed doesn’t support the default log formats for GoAccess, you can specify your log format, date and time format with the options, –log-format, –date-format and –time-format.

For example, if you have squid logs with the EPOCH timestamp;

goaccess /var/squid/logs/access.log --log-format='%x.%^ %~ %L %h %^/%s %b %m %U %^' --date-format=%s --time-format=%s
GoAccess Squid Logs analysis

If you need to display the analysis on a web format, save the output of a log file into an HTML file on your web root directory. In this case, you need to have a web server installed, we are using Apache in this guide,

apt install apache2

To generate a web report, for Apache Access logs;

goaccess /var/log/apache2/access.log --log-format=COMBINED -a -o /var/www/html/analysis.html

If you access your browser via http://<server-IP>/analysis.html you should be able to see your GoAccess analytic dashboards.

GoAccess Web Reports for apache access logs

For analyzing squid logs with custom format;

goaccess /var/squid/logs/access.log --log-format='%x.%^ %~ %L %h %^/%s %b %m %U %^' --date-format=%s --time-format=%s -a -o /var/www/html/analysis.html

Access the report via http://<server-IP>/analysis.html.

Goaccess squid logs analysis

To parse the logs and display the stats in a real-time HTML report, use the –real-time-html option.

goaccess access.log --log-format=COMBINED -a -o /var/www/html/report.html --real-time-html

You can as well monitor logs on a remote server without having to install GoAccess on those servers via SSH. For example, read remote Apache logs line by line and pass it to GoAccess;

ssh [email protected] 'while IFS= read -r line; do echo "$line" && sleep 1 ; done < /root/access.log' | goaccess --log-format=COMBINED -a -o /var/www/html/remote.html --real-time-html -

The report for the remote server is then available under http://<server-IP>/remote.html.

Well that is just it on how to install GoAccess on Ubuntu 18.04/Debian 10 Buster. To learn more about GoAccess, read the GoAccess manual page, https://goaccess.io/man.

Other Monitoring Tutorials

Integrate Prometheus with Grafana for Monitoring

Install Grafana 6.2.x on Ubuntu 18.04/Debian 9

Install Grafana Metrics Monitoring Tool on Debian 9

LEAVE A REPLY

Please enter your comment!
Please enter your name here