In this guide, we are going to learn how to install GoAccess on Ubuntu 18.04/Debian 10 Buster. GoAccess is an open-source real-time web log analyzer and interactive viewer that runs in a terminal and on web browsers in Linux/Unix systems.
Install GoAccess on Ubuntu 18.04/Debian 10 Buster
GoAccess is available on the default Bionic or Buster repositories. However, the available versions may be not be the latest versions. You can confirm this by running the command below;
apt-cache policy goaccess
goaccess: Installed: (none) Candidate: 1:1.2-4+b10 Version table: 1:1.2-4+b10 500 500 http://deb.debian.org/debian buster/main amd64 Packages
GoAccess v1.3 is the latest stable release as of this writing. To install the latest version, you need to add GoAccess repository.
Install GoAccess APT Repository
Run the command below to install the GoAccess APT repository on both Bionic and Buster.
echo "deb http://deb.goaccess.io/ $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list.d/goaccess.list
Next, install the GoAccess repository signing key.
wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key add -
On Debian 10 Buster, you might need to install gnupg2 just in case you encounter the error, Cannot write to ‘-’ (Broken pipe).
apt install gnupg2
Once that is done, run system update to resynchronize packages to their latest versions.
You can now verify that GoAccess v1.3 is available for download.
apt-cache policy goaccess
goaccess: Installed: (none) Candidate: 1:1.3-1 Version table: 1:1.3-1 500 500 http://deb.goaccess.io buster/main amd64 Packages 1:1.2-4+b10 500 500 http://deb.debian.org/debian buster/main amd64 Packages
Install Required Dependencies
The only mandatory dependency for GoAccess is NCurses (libncursesw5-dev) which is installed automatically if you install GoAccess from APT. However, the command below installs ncurses and other optional dependencies.
apt install libncursesw5-dev libgeoip-dev libmaxminddb-dev libtokyocabinet-dev libssl-dev
Install GoAccess on Ubuntu 18.04/Debian 10
Now that you have the GoAccess repos in place, run the command below to install it.
apt install goaccess
GoAccess is compiled with support for libssl1.0.2. However, Debian 10 Buster installs libssl1.1 which doesn’t meet GoAccess dependency issue. Hence, if you get the error;
The following packages have unmet dependencies: goaccess : Depends: libssl1.0.2 (>= 1.0.2) but it is not installable E: Unable to correct problems, you have held broken packages.
Simply download libssl1.0.2 and install it.
wget http://ftp.br.debian.org/debian/pool/main/o/openssl1.0/libssl1.0.2_1.0.2r-1~deb9u1_amd64.deb apt install ./libssl1.0.2_1.0.2r-1~deb9u1_amd64.deb
Then proceed to install GoAccess on Debian 10.
apt install goaccess
To obtain goaccess command line usage, run;
The most basic usage is to pass the log to analyse to GoAccess. For example;
This will open a Log, date and time format configuration prompt.
Press space bar to select the format and press Enter to analyze the logs. The log analysis dashboard is presented on the terminal.
Scroll up and down to view dashboards.
If the logs being analyzed doesn’t support the default log formats for GoAccess, you can specify your log format, date and time format with the options, –log-format, –date-format and –time-format.
For example, if you have squid logs with the EPOCH timestamp;
goaccess /var/squid/logs/access.log --log-format='%x.%^ %~ %L %h %^/%s %b %m %U %^' --date-format=%s --time-format=%s
If you need to display the analysis on a web format, save the output of a log file into an HTML file on your web root directory. In this case, you need to have a web server installed, we are using Apache in this guide,
apt install apache2
To generate a web report, for Apache Access logs;
goaccess /var/log/apache2/access.log --log-format=COMBINED -a -o /var/www/html/analysis.html
If you access your browser via http://<server-IP>/analysis.html you should be able to see your GoAccess analytic dashboards.
For analyzing squid logs with custom format;
goaccess /var/squid/logs/access.log --log-format='%x.%^ %~ %L %h %^/%s %b %m %U %^' --date-format=%s --time-format=%s -a -o /var/www/html/analysis.html
Access the report via http://<server-IP>/analysis.html.
To parse the logs and display the stats in a real-time HTML report, use the –real-time-html option.
goaccess access.log --log-format=COMBINED -a -o /var/www/html/report.html --real-time-html
You can as well monitor logs on a remote server without having to install GoAccess on those servers via SSH. For example, read remote Apache logs line by line and pass it to GoAccess;
ssh [email protected] 'while IFS= read -r line; do echo "$line" && sleep 1 ; done < /root/access.log' | goaccess --log-format=COMBINED -a -o /var/www/html/remote.html --real-time-html -
The report for the remote server is then available under http://<server-IP>/remote.html.
Well that is just it on how to install GoAccess on Ubuntu 18.04/Debian 10 Buster. To learn more about GoAccess, read the GoAccess manual page, https://goaccess.io/man.