GoAccess

Overview

GoAccess is an open-source (MIT-licensed) real-time web log analysis tool led by author Gerardo Orellana (United States). Unlike website analytics tools that rely on JavaScript instrumentation, GoAccess parses web server access logs (Apache, Nginx, CloudFront, and more) directly, delivering interactive visual reports in the terminal with millisecond-level real-time feedback and no tracking code on the page.

Written in C with no external dependencies, GoAccess parses about 50,000 lines per second, processing millions of log lines in seconds, and offers a terminal interface plus HTML/JSON/CSV output that runs smoothly even on a 256MB low-spec server. As a 100% free, open-source, fully self-hosted tool, it sets no cookies and depends on no third parties, natively satisfying privacy requirements such as GDPR, making it ideal for server operations, DevOps, and privacy-sensitive scenarios. It complements JavaScript-instrumented options such as Matomo and Plausible; see the website analytics setup guide for combined usage.

Key Strengths

• Genuine real-time analysis: The inotify mechanism continuously monitors log file changes, updating the terminal in milliseconds after each visit, far ahead of the minute-level reporting of traditional JS-instrumented tools, letting operators react at the first moment of an attack or traffic spike.
• Extreme lightness and high performance: The compiled binary is only a few MB with low memory usage, running smoothly on a 256MB VPS; parsing speed is about 50,000 lines per second, and millions of log lines are processed in seconds, making it the top choice for resource-constrained environments.
• Broad log-format support: Built-in auto-detection covers Apache (combined/common), Nginx (combined), Amazon S3, CloudFront, ELB, and IIS (W3C), plus custom regex format matching, so it adapts quickly to any web server software.
• Multi-dimensional visual metrics: Over 20 dimensions including unique visitors, requests, bandwidth, referrers, browsers/OS, status codes, and time trends, with drill-down by date, URL path, and referrer, ideal for locating anomaly sources in a website monitoring setup.
• Fully privacy-friendly and free: Local self-hosted parsing with no cookies and no third-party dependencies natively satisfies regulations such as GDPR; it is 100% free open source (MIT) with no paid tiers or feature limits, keeping the data-security boundary clear and controllable.

Product Ecosystem

Real-time Log Parsing Engine

Written in C, the core parsing engine is based on Bison/Flex grammar parsers that compile mainstream log formats into a unified internal data structure, reads gzip-compressed logs directly, and uses efficient hash tables and AVL trees for in-memory aggregation, providing sub-second query responses in terminal mode.

Terminal Interface (TUI)

An ncurses-based interactive terminal panel with an htop-like experience, keyboard shortcuts, and sortable lists; running goaccess /var/log/nginx/access.log provides a real-time traffic dashboard to quickly identify anomalous IPs, high-frequency request paths, and error status-code distributions.

HTML Reports

Self-contained HTML static reports (no external CDN dependency, fully viewable offline) can be exported in one command and published as a subdirectory via Nginx or Apache, delivering the flexibility of "analyze without a browser, and view reports through a browser too," with directory access control for safe publication.

JSON/CSV Structured Output

The --output-format=json flag outputs structured data for scheduled generation and push to a data pipeline or monitoring system via cron; log data can also be received through pipes (stdin) for integration into existing pipelines such as rsyslog, fluentd, or logstash.

WebSocket Real-time Mode

The --real-time-html flag enables WebSocket push so browsers view live updates, ideal for real-time traffic displays in operations monitoring dashboards.

Deployment Methods

Package-manager installation (apt/yum/brew), source compilation, and an official Docker image are supported; in production, run it as a systemd service with logrotate for long-term stability, and combine with Grafana and Prometheus for a complete log-analysis and monitoring stack.

Limitations

• Requires server log access: You must first obtain web server access logs or a real-time log stream, so users on virtual hosting without SSH or log access cannot use it; confirm that access logging is enabled before deployment.
• Cannot track client behavior: Being server-log based, it cannot record in-page clicks, scrolls, or form submissions; heatmaps, session recording, and funnels require pairing with Hotjar, FullStory, or LogRocket.
• No team collaboration or central management: As a single-machine CLI tool, it offers no cloud dashboard, multi-user collaboration, or multi-site central management; sharing results requires publishing HTML reports or building a web service, lagging SaaS platforms such as Matomo and Plausible in collaboration.
• No built-in historical trends or alerting: Weekly/monthly/yearly comparison and threshold alerting are not provided; historical trends and alerts require JSON/CSV export and custom scripting, needing extra engineering compared with all-in-one monitoring platforms such as Datadog and New Relic.

Use Cases

• Server operations and DevOps engineers (★★★★★): Real-time traffic monitoring and anomaly or attack investigation from the SSH terminal make it an essential lightweight log-analysis tool for operators.
• Low-spec VPS and dedicated server users (★★★★★): Runs smoothly on 256MB memory, the top choice in resource-constrained environments, deployable at zero cost within the framework of the server selection guide.
• Self-hosted Nginx/Apache site owners （★★★★☆）: A zero-cost log-analysis system can be set up in minutes with no database or PHP environment, out of the box.
• Teams needing privacy compliance （★★★★☆）: Local parsing with no cookies and no third-party dependencies natively satisfies GDPR/CCPA with a clear data-security boundary; evaluate with the GDPR compliance checklist.
• Companies needing client behavior analytics （★☆☆☆☆）: Cannot cover heatmaps or session recording; pair with Matomo or Hotjar.

Pricing

GoAccess is 100% free open source (MIT), with no paid tiers or feature limits; the source code is hosted on GitHub for anyone to use and redistribute. Using GoAccess has no budget cost beyond the server itself; for dashboards and alerting, pair it with open-source Grafana and Prometheus as outlined in the website monitoring tools selection guide.

FAQ

• How is GoAccess different from Google Analytics? GoAccess is a server-log parser that relies on no JS instrumentation and tracks no individual user identities, with data sourced from server logs; Google Analytics collects browser-side behavior via JavaScript. They complement each other; see the website analytics setup guide for selection guidance.

• Can GoAccess analyze CDN logs? Yes. GoAccess supports Amazon S3, CloudFront, and ELB log formats and can parse CDN origin or edge logs directly; many CDNs support exporting logs to object storage for scheduled analysis, usable within a monitoring stack.

• Does performance suffer with very large log files? GoAccess parses about 50,000 lines per second, processing multi-GB log files in seconds to tens of seconds; in real-time mode, inotify processes only incremental new data, so sustained operation has minimal resource impact. For deployment optimization, see the server selection guide.

• Can GoAccess track in-page user behavior? No. Being server-log based, it cannot record in-page clicks, scrolls, or form interactions; heatmaps, session recording, and funnels require client-side tools such as Hotjar or FullStory.

• Does GoAccess support Docker deployment? Yes. The official Docker image is ready to use: docker run -it --rm -v /var/log/nginx:/var/log/nginx:ro allinurl/goaccess -f /var/log/nginx/access.log; see the deployment practices in website monitoring tools.