{ "componentChunkName": "component---src-templates-issues-tsx", "path": "/issues/191", "result": {"data":{"issuesJson":{"id":"6e23fb9e-82ac-55bf-ab2a-df9724670344","title":"allinurl/goaccess: 一款开源的实时 Web 日志分析器和交互式查看器，可在 unix 系统的终端或浏览器中运行。","number":191,"bodyHTML":"

\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Repos	allinurl/goaccess
Views	$\"views\"$
Stars	$\"stars\"$
Forks	$\"forks\"$
License	$\"license\"$
UpdatedAt	$\"last-commit\"$
CreatedAt	$\"create-at\"$

\n\n

\n

\n

\n

GoAccess $\"C$ $\"GoAccess\"$

\n

What is it?

\n

GoAccess is an open source real-time web log analyzer and interactive
\nviewer that runs in a terminal on *nix systems or through your
\nbrowser. It provides fast and valuable HTTP statistics for system
\nadministrators that require a visual server report on the fly.
\nMore info at: https://goaccess.io.

\n

$\"GoAccess$
\n $\"GoAccess$

\n

Features

\n

GoAccess parses the specified web log file and outputs the data to the X
\nterminal. Features include:

\n

\n
Completely Real Time

\nAll panels and metrics are timed to be updated every 200 ms on the terminal
\noutput and every second on the HTML output.
\n
\n
Minimal Configuration needed

\nYou can just run it against your access log file, pick the log format and let
\nGoAccess parse the access log and show you the stats.
\n
\n
Track Application Response Time

\nTrack the time taken to serve the request. Extremely useful if you want to
\ntrack pages that are slowing down your site.
\n
\n
WebSocket Authentication:

\nGoAccess offers enhanced WebSocket authentication, supporting local and
\nexternal JWT verification, with secure token refresh capabilities and seamless
\nintegration with external authentication systems.
\n
\n
Nearly All Web Log Formats

\nGoAccess allows any custom log format string. Predefined options include,
\nApache, Nginx, Amazon S3, Elastic Load Balancing, CloudFront, etc.
\n
\n
Incremental Log Processing

\nNeed data persistence? GoAccess has the ability to process logs incrementally
\nthrough the on-disk persistence options.
\n
\n
Only one dependency

\nGoAccess is written in C. To run it, you only need ncurses as a dependency.
\nThat's it. It even features its own Web Socket server — http://gwsocket.io/.
\n
\n
Visitors

\nDetermine the amount of hits, visitors, bandwidth, and metrics for slowest
\nrunning requests by the hour, or date.
\n
\n
Metrics per Virtual Host

\nHave multiple Virtual Hosts (Server Blocks)? It features a panel that
\ndisplays which virtual host is consuming most of the web server resources.
\n
\n
ASN (Autonomous System Number mapping)

\nGreat for detecting malicious traffic patterns and block them accordingly.
\n
\n
Color Scheme Customizable

\nTailor GoAccess to suit your own color taste/schemes. Either through the
\nterminal, or by simply applying the stylesheet on the HTML output.
\n
\n
Support for Large Datasets

\nGoAccess features the ability to parse large logs due to its optimized
\nin-memory hash tables. It has very good memory usage and pretty good
\nperformance. This storage has support for on-disk persistence as well.
\n
\n
Docker Support

\nAbility to build GoAccess' Docker image from upstream. You can still fully
\nconfigure it, by using Volume mapping and editing goaccess.conf. See
\nDocker section below.
\nThere is also documentation how to use docker-compose.
\n

\n

Nearly all web log formats...

\n

GoAccess allows any custom log format string. Predefined options include, but
\nnot limited to:

\n

Amazon CloudFront (Download Distribution).
Amazon Simple Storage Service (S3)
AWS Elastic Load Balancing
Combined Log Format (XLF/ELF) Apache | Nginx
Common Log Format (CLF) Apache
Google Cloud Storage.
Apache virtual hosts
Squid Native Format.
W3C format (IIS).
Caddy's JSON Structured format.
Traefik's CLF flavor

\n

Why GoAccess?

\n

GoAccess was designed to be a fast, terminal-based log analyzer. Its core idea
\nis to quickly analyze and view web server statistics in real time without
\nneeding to use your browser (great if you want to do a quick analysis of your
\naccess log via SSH, or if you simply love working in the terminal).

\n

While the terminal output is the default output, it has the capability to
\ngenerate a complete, self-contained, real-time HTML
\nreport, as well as a JSON, and
\nCSV report.

\n

You can see it more of a monitor command tool than anything else.

\n

Installation

\n\n $\"Packaging$ \n\n

Build from release

\n

GoAccess can be compiled and used on *nix systems.

\n

Download, extract and compile GoAccess with:

\n

$ wget https://tar.goaccess.io/goaccess-1.9.4.tar.gz\n$ tar -xzvf goaccess-1.9.4.tar.gz\n$ cd goaccess-1.9.4/\n$ ./configure --enable-utf8 --enable-geoip=mmdb\n$ make\n# make install\n

\n

Build from GitHub (Development)

\n

$ git clone https://github.com/allinurl/goaccess.git\n$ cd goaccess\n$ autoreconf -fiv\n$ ./configure --enable-utf8 --enable-geoip=mmdb\n$ make\n# make install\n

\n

Distributions

\n

It is easiest to install GoAccess on GNU+Linux using the preferred package manager
\nof your GNU+Linux distribution. Please note that not all distributions will have
\nthe latest version of GoAccess available.

\n

Debian/Ubuntu

\n

# apt-get install goaccess\n

\n

Note: It is likely this will install an outdated version of GoAccess. To
\nmake sure that you're running the latest stable version of GoAccess see
\nalternative option below.

\n

Official GoAccess Debian & Ubuntu repository

\n

$ wget -O - https://deb.goaccess.io/gnugpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null\n$ echo \"deb [signed-by=/usr/share/keyrings/goaccess.gpg arch=$(dpkg --print-architecture)] https://deb.goaccess.io/ $(lsb_release -cs) main\" | sudo tee /etc/apt/sources.list.d/goaccess.list\n$ sudo apt-get update\n$ sudo apt-get install goaccess\n

\n

Note:

\n

.deb packages in the official repo are available through HTTPS as well. You may need to install apt-transport-https.

\n

Fedora

\n

# yum install goaccess\n

\n

Arch

\n

# pacman -S goaccess\n

\n

Gentoo

\n

# emerge net-analyzer/goaccess\n

\n

OS X / Homebrew

\n

# brew install goaccess\n

\n

FreeBSD

\n

# cd /usr/ports/sysutils/goaccess/ && make install clean\n# pkg install sysutils/goaccess\n

\n

OpenBSD

\n

# cd /usr/ports/www/goaccess && make install clean\n# pkg_add goaccess\n

\n

openSUSE

\n

# zypper ar -f obs://server:http http\n# zypper in goaccess\n

\n

OpenIndiana

\n

# pkg install goaccess\n

\n

pkgsrc (NetBSD, Solaris, SmartOS, ...)

\n

# pkgin install goaccess\n

\n

Windows

\n

GoAccess can be used in Windows through Cygwin. See Cygwin's packages. Or through the
\nGNU+Linux Subsystem on Windows 10.

\n

Docker

\n

A Docker image has been updated, capable of directing output from an access log. If you only want to output a report, you can pipe a log from the external environment to a Docker-based process:

\n

touch report.html\ncat access.log | docker run --rm -i -v ./report.html:/report.html -e LANG=$LANG allinurl/goaccess -a -o report.html --log-format COMBINED -\n

\n

OR real-time

\n

tail -F access.log | docker run -p 7890:7890 --rm -i -e LANG=$LANG allinurl/goaccess -a -o report.html --log-format COMBINED --real-time-html -\n

\n

There is also documentation how to use docker-compose.

\n

Build in isolated container

\n

You can also build the binary for Debian based systems in an isolated container environment to prevent cluttering your local system with the development libraries:

\n

$ curl -L \"https://github.com/allinurl/goaccess/archive/refs/heads/master.tar.gz\" | tar -xz && cd goaccess-master\n$ docker build -t goaccess/build.debian-12 -f Dockerfile.debian-12 .\n$ docker run -i --rm -v $PWD:/goaccess goaccess/build.debian-12 > goaccess\n

\n

You can read more about using the docker image in DOCKER.md.

\n

Distribution Packages

\n

GoAccess has minimal requirements, it's written in C and requires only ncurses.
\nHowever, below is a table of some optional dependencies in some distros to
\nbuild GoAccess from source.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Distro	NCurses	GeoIP (opt)	GeoIP2 (opt)	OpenSSL (opt)
Ubuntu/Debian	libncurses-dev	libgeoip-dev	libmaxminddb-dev	libssl-dev
RHEL/CentOS	ncurses-devel	geoip-devel	libmaxminddb-devel	openssl-devel
Arch	ncurses	geoip	libmaxminddb	openssl
Gentoo	sys-libs/ncurses	dev-libs/geoip	dev-libs/libmaxminddb	dev-libs/openssl
Slackware	ncurses	GeoIP	libmaxminddb	openssl

\n

Note: You may need to install build tools like gcc, autoconf,
\ngettext, autopoint etc. for compiling/building software from source. e.g.,
\nbase-devel, build-essential, \"Development Tools\".

\n

Storage

\n

Default Hash Tables

\n

In-memory storage provides better performance at the cost of limiting the
\ndataset size to the amount of available physical memory. GoAccess uses
\nin-memory hash tables. It has very good memory usage and pretty good
\nperformance. This storage has support for on-disk persistence as well.

\n

Command Line / Config Options

\n

See options that can be supplied to the command or
\nspecified in the configuration file. If specified in the configuration file, long
\noptions need to be used without prepending --.

\n

Usage / Examples

\n

Note: Piping data into GoAccess won't prompt a log/date/time
\nconfiguration dialog, you will need to previously define it in your
\nconfiguration file or in the command line.

\n

Getting Started

\n

To output to a terminal and generate an interactive report:

\n

# goaccess access.log\n

\n

To generate an HTML report:

\n

# goaccess access.log -a > report.html\n

\n

To generate a JSON report file:

\n

# goaccess access.log -a -d -o report.json\n

\n

To generate a CSV report to stdout:

\n

# goaccess access.log --no-csv-summary -o csv\n

\n

GoAccess also allows great flexibility for real-time filtering and parsing. For
\ninstance, to quickly diagnose issues by monitoring logs since goaccess was
\nstarted:

\n

# tail -f access.log | goaccess -\n

\n

And even better, to filter while maintaining opened a pipe to preserve
\nreal-time analysis, we can make use of tail -f and a matching pattern tool
\nsuch as grep, awk, sed, etc.:

\n

# tail -f access.log | grep -i --line-buffered 'firefox' | goaccess --log-format=COMBINED -\n

\n

or to parse from the beginning of the file while maintaining the pipe opened
\nand applying a filter

\n

# tail -f -n +0 access.log | grep -i --line-buffered 'firefox' | goaccess -o report.html --real-time-html -\n

\n

Multiple Log files

\n

There are several ways to parse multiple logs with GoAccess. The simplest is to
\npass multiple log files to the command line:

\n

# goaccess access.log access.log.1\n

\n

It's even possible to parse files from a pipe while reading regular files:

\n

# cat access.log.2 | goaccess access.log access.log.1 -\n

\n

Note: the single dash is appended to the command line to let GoAccess
\nknow that it should read from the pipe.

\n

Now if we want to add more flexibility to GoAccess, we can use zcat --force
\nto read compressed and uncompressed files. For instance, if we would
\nlike to process all log files access.log*, we can do:

\n

# zcat --force access.log* | goaccess -\n

\n

Note: On Mac OS X, use gunzip -c instead of zcat.

\n

Multi-thread Support

\n

Use --jobs=<count> (or -j) to enable multi-thread parsing. For example:

\n

# goaccess access.log -o report.html -j 4\n

\n

And use --chunk-size=<256-32768> to adjust chunk size, the default chunk size is 1024. For example:

\n

# goaccess access.log -o report.html -j 4 --chunk-size=8192\n

\n

Real-time HTML outputs

\n

GoAccess has the ability the output real-time data in the HTML report. You can
\neven email the HTML file since it is composed of a single file with no external
\nfile dependencies, how neat is that!

\n

The process of generating a real-time HTML report is very similar to the
\nprocess of creating a static report. Only --real-time-html is needed to make
\nit real-time.

\n

# goaccess access.log -o /usr/share/nginx/html/your_site/report.html --real-time-html\n

\n

To view the report you can navigate to http://your_site/report.html.

\n

By default, GoAccess will use the host name of the generated report.
\nOptionally, you can specify the URL to which the client's browser will connect
\nto. See FAQ for a more detailed example.

\n

# goaccess access.log -o report.html --real-time-html --ws-url=goaccess.io\n

\n

By default, GoAccess listens on port 7890, to use a different port other than
\n7890, you can specify it as (make sure the port is opened):

\n

# goaccess access.log -o report.html --real-time-html --port=9870\n

\n

And to bind the WebSocket server to a different address other than 0.0.0.0, you
\ncan specify it as:

\n

# goaccess access.log -o report.html --real-time-html --addr=127.0.0.1\n

\n

Note: To output real time data over a TLS/SSL connection, you need to use
\n--ssl-cert=<cert.crt> and --ssl-key=<priv.key>.

\n

Filtering

\n

Working with dates

\n

Another useful pipe would be filtering dates out of the web log

\n

The following will get all HTTP requests starting on 05/Dec/2010 until the
\nend of the file.

\n

# sed -n '/05\\/Dec\\/2010/,$ p' access.log | goaccess -a -\n

\n

or using relative dates such as yesterdays or tomorrows day:

\n

# sed -n '/'$(date '+%d\\/%b\\/%Y' -d '1 week ago')'/,$ p' access.log | goaccess -a -\n

\n

If we want to parse only a certain time-frame from DATE a to DATE b, we can do:

\n

# sed -n '/5\\/Nov\\/2010/,/5\\/Dec\\/2010/ p' access.log | goaccess -a -\n

\n

If we want to preserve only certain amount of data and recycle storage, we can
\nkeep only a certain number of days. For instance to keep & show the last 5
\ndays:

\n

# goaccess access.log --keep-last=5\n

\n

Virtual hosts

\n

Assuming your log contains the virtual host field. For instance:

\n

vhost.io:80 8.8.4.4 - - [02/Mar/2016:08:14:04 -0600] \"GET /shop HTTP/1.1\" 200 615 \"-\" \"Googlebot-Image/1.0\"\n

\n

And you would like to append the virtual host to the request in order to see
\nwhich virtual host the top urls belong to:

\n

awk '$8=$1$8' access.log | goaccess -a -\n

\n

To do the same, but also use real-time filtering and parsing:

\n

tail -f  access.log | unbuffer -p awk '$8=$1$8' | goaccess -a -\n

\n

To exclude a list of virtual hosts you can do the following:

\n

# grep -v \"`cat exclude_vhost_list_file`\" vhost_access.log | goaccess -\n

\n

Files, status codes and bots

\n

To parse specific pages, e.g., page views, html, htm, php, etc. within a
\nrequest:

\n

# awk '$7~/\\.html|\\.htm|\\.php/' access.log | goaccess -\n

\n

Note, $7 is the request field for the common and combined log format,
\n(without Virtual Host), if your log includes Virtual Host, then you probably
\nwant to use $8 instead. It's best to check which field you are shooting for,
\ne.g.:

\n

# tail -10 access.log | awk '{print $8}'\n

\n

Or to parse a specific status code, e.g., 500 (Internal Server Error):

\n

# awk '$9~/500/' access.log | goaccess -\n

\n

Or multiple status codes, e.g., all 3xx and 5xx:

\n

# tail -f -n +0 access.log | awk '$9~/3[0-9]{2}|5[0-9]{2}/' | goaccess -o out.html -\n

\n

And to get an estimated overview of how many bots (crawlers) are hitting your server:

\n

# tail -F -n +0 access.log | grep -i --line-buffered 'bot' | goaccess -\n

\n

Tips

\n

Also, it is worth pointing out that if we want to run GoAccess at lower
\npriority, we can run it as:

\n

# nice -n 19 goaccess -f access.log -a\n

\n

and if you don't want to install it on your server, you can still run it from
\nyour local machine!

\n

# ssh -n root@server 'tail -f /var/log/apache2/access.log' | goaccess -\n

\n

Note: SSH requires -n so GoAccess can read from stdin. Also, make sure to
\nuse SSH keys for authentication as it won't work if a passphrase is required.

\n

Troubleshooting

\n

We receive many questions and issues that have been answered previously.

\n

Date/time matching problems? Check that your log format and the system locale in which you run GoAccess match. See #1571
Problems with pattern matching? Spaces are often a problem, see for instance #136, #1579
Other issues matching log entries: See >200 closed issues regarding log/date/time formats
Problems with log processing? See >111 issues regarding log processing

\n

Incremental log processing

\n

GoAccess has the ability to process logs incrementally through its internal
\nstorage and dump its data to disk. It works in the following way:

\n

A dataset must be persisted first with --persist, then the same dataset
\ncan be loaded with.
--restore. If new data is passed (piped or through a log file), it will
\nappend it to the original dataset.

\n

NOTES

\n

GoAccess keeps track of inodes of all the files processed (assuming files will
\nstay on the same partition), in addition, it extracts a snippet of data from
\nthe log along with the last line parsed of each file and the timestamp of the
\nlast line parsed. e.g., inode:29627417|line:20012|ts:20171231235059

\n

First, it compares if the snippet matches the log being parsed, if it does, it
\nassumes the log hasn't changed drastically, e.g., hasn't been truncated. If
\nthe inode does not match the current file, it parses all lines. If the current
\nfile matches the inode, it then reads the remaining lines and updates the count
\nof lines parsed and the timestamp. As an extra precaution, it won't parse log
\nlines with a timestamp ≤ than the one stored.

\n

Piped data works based off the timestamp of the last line read. For instance,
\nit will parse and discard all incoming entries until it finds a timestamp >=
\nthan the one stored.

\n

Examples

\n

// last month access log\n# goaccess access.log.1 --persist\n

\n

then, load it with

\n

// append this month access log, and preserve new data\n# goaccess access.log --restore --persist\n

\n

To read persisted data only (without parsing new data)

\n

# goaccess --restore\n

\n

Contributing

\n

Any help on GoAccess is welcome. The most helpful way is to try it out and give
\nfeedback. Feel free to use the GitHub issue tracker and pull requests to
\ndiscuss and submit code changes.

\n

You can contribute to our translations by editing the .po files direct on GitHub or using the visual interface inlang.com

\n

$\"translation$

\n

Enjoy!

","updatedAt":"2025-05-21T15:59:21Z","upvoteCount":null,"author":{"login":"eryajf","avatarUrl":"https://avatars.githubusercontent.com/u/33259379?u=e4a4090a38ac2473aaed4ef9945233636776c6c3&v=4","url":"https://github.com/eryajf"},"category":null,"labels":{"edges":[{"node":{"name":"更多","color":"25B472"}},{"node":{"name":"日志管理","color":"0f7858"}},{"node":{"name":"allinurl","color":"1467b5"}}]},"comments":{"edges":[]}}},"pageContext":{"number":191,"previous":{"title":"qdm12/gluetun: VPN 客户端位于一个薄型 Docker 容器中，适用于多个 VPN 提供商，用 Go 编写，使用 OpenVPN 或 Wireguard、TLS 上的 DNS，并内置了一些代理服务器。","number":190},"next":{"title":"gocd/gocd: GoCD 主要仓库 - 持续交付服务器","number":192}}}, "staticQueryHashes": ["151096407","2861350382"]}