Analyzing Web Server Logs with GoAccess

Not so long ago, we came across a GoAccess utility that allows you to analyze web server logs and generate reports. The utility is written in C and is available in almost all repositories of Linux distributions. The address of the project .

There is nothing revolutionary in this article, only a brief HOWTO, most of which you can find in the documentation.

And so in order:

1. Installation
')

yum install goaccess 

2. Customization

In the /etc/goaccess.conf file, uncomment the lines for analyzing nginx logs:

 time-format %H:%M:%S date-format %d/%b/%Y log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u" 

3. Log analysis

The result of the analysis can be obtained in two modes, in the console (interactive), and in the form of a report. The program supports several types of reports, such as html, json and csv

The easiest case of running the program to analyze the current log:

 goaccess -a -f <log_file> 

In this case, we get an analysis of the current log in the following form:

Parameters can be moved using TAB.

And the web report will look like this:


And now consider the case when we need to analyze not the entire log, but only its specific part:

1. Analysis of logs for the last 2 hours:

 sed -n '/'$(date '+%H:%M:%S' -d '2 hours ago')'/, $ p' <log_file> | goaccess -a 

2. Analysis for the last 2 days:

 sed -n '/'$(date '+%d/%b/%Y' -d '2 day ago')'/, $ p' <log_file> | goaccess -a 

3. Analysis for a specific date:

 sed -n '/18\/Jan\/2016/,/19\/Jan\/2016/ p' <log_file> | goaccess -a 

4. Getting html report:

 goaccess -a -f <log_file> > report.html 

Author: Magvai69 System Administrator