DEV Community

Cover image for Analyzing and Visualizing Nginx Access Logs with GoAccess
John Wilson
John Wilson

Posted on

Analyzing and Visualizing Nginx Access Logs with GoAccess

Nginx access logs contain a wealth of information, but directly reading them can be a daunting task for most people. Fortunately, we have powerful tools like GoAccess that help us easily analyze and visualize Nginx access logs.

Tool Installation

Debian-based Systems (e.g., Ubuntu)

You can install GoAccess with the following commands:

sudo apt-get update
sudo apt-get install goaccess
Enter fullscreen mode Exit fullscreen mode

Red Hat-based Systems (e.g., CentOS)

Install with:

sudo yum -y install goaccess
Enter fullscreen mode Exit fullscreen mode

Installing from Source Code

If you wish to install GoAccess from source, follow these steps. First, download the source package:

wget https://tar.goaccess.io/goaccess-1.4.tar.gz
Enter fullscreen mode Exit fullscreen mode

Extract and compile:

tar -xzvf goaccess-1.4.tar.gz
cd goaccess-1.4/
./configure --enable-geoip --enable-utf8
make && sudo make install
Enter fullscreen mode Exit fullscreen mode

Tool Configuration

GoAccess needs configuration to correctly parse Nginx access logs. The config file is usually at /etc/goaccess/goaccess.conf.

For the default Nginx log format, you can simply use the --log-format=COMBINED parameter.

If you've set a custom log format in your Nginx configuration, specify the corresponding log format in the GoAccess config file. For example:

log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
Enter fullscreen mode Exit fullscreen mode

You also need to define the date and time formats so GoAccess can parse timestamps correctly, e.g.:

date-format %d/%b/%Y
time-format %H:%M:%S
Enter fullscreen mode Exit fullscreen mode

Log Analysis

Run GoAccess in the terminal to enter its interactive interface, which displays log analysis results.

For example:

goaccess /var/log/nginx/access.log --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

GoAccess can also generate an HTML report, viewable in your browser. The following command will create a report.html file with comprehensive statistics and charts:

goaccess /var/log/nginx/access.log -o report.html --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

To enable real-time monitoring and generate a dynamically updating HTML report, use:

--real-time-html --daemonize
Enter fullscreen mode Exit fullscreen mode

Sample full command:

goaccess /var/log/nginx/access.log -o /var/www/html/report.html --log-format=COMBINED --real-time-html --daemonize
Enter fullscreen mode Exit fullscreen mode

Understanding the Analysis Results

GoAccess provides a wealth of statistics and charts, helping you comprehensively understand your website’s visitors, including:

Overview

Metric Description
Total Hits Shows the total website visits
Unique Visitors Counts unique IP addresses
Data Transferred Total data sent (MB or GB)

Visitor Information

Metric Description
IP Rankings IP addresses by visit count
Browsers & OS Visitor browser and OS details

Request Information

Metric Description
Methods Number of different HTTP methods
Status Codes HTTP status (200 = OK, 404 = Not Found, etc.)
URL Rankings Most accessed URLs

Performance Analysis

Metric Description
Time Distribution Requests per time period
Slowest Requests Requests with longest response times

Advanced Usage

Besides basic analytics, GoAccess supports advanced features such as pipes and filters.

For real-time analysis, run:

tail -f /var/log/nginx/access.log | goaccess -p /etc/goaccess/goaccess.conf
Enter fullscreen mode Exit fullscreen mode

To analyze and merge multiple log files:

goaccess -p /etc/goaccess/goaccess.conf access.log.1 access.log.2
Enter fullscreen mode Exit fullscreen mode

Let me know if you need more explanation or have any other questions!

Top comments (0)