goaccess: a web log analyzer that treats the terminal as its home screen

A monitor command for people who live in a terminal

GoAccess is described as a real-time web log analyzer and interactive viewer that runs in a terminal on Unix-like systems or in the browser. The design brief is narrow and stated plainly: quickly analyze and view web server statistics in real time without needing a browser, which the README calls out as the main advantage for anyone doing a quick pass on an access log over SSH.

The framing matters because it rules out most of the category. This is not a collection agent, not a hosted analytics property, and not a tag manager. You give it a log file, it reads the file, and it puts panels on your screen. The second use case the README names is security monitoring, and it is a real one: spotting suspicious activity, unusual traffic patterns, brute-force attempts, scanners and anomalous requests straight out of the logs.

The scale is established. 20,939 stars and 1,193 forks under the MIT license, 449 open issues, written in C, with the last push on 2026-09-19 and no archival. Topics span analytics, monitoring, privacy, gdpr, ncurses and terminal, which describes a tool positioned against Google Analytics from the server side rather than in the browser.

Compiling from a tarball or leaning on your package manager

Building it is a plain autotools sequence. The README's release path downloads a tarball, unpacks it, and runs configure with a few useful flags before make.

wget https://tar.goaccess.io/goaccess-1.12.tar.gz
tar -xzvf goaccess-1.12.tar.gz
cd goaccess-1.12/
./configure --enable-utf8 --enable-geoip=mmdb --with-zlib
make

The flags are the interesting part. Enabling utf8 is what lets the browser and terminal views render non-ASCII paths and referrers correctly, which matters the moment you serve a site with any international traffic. The geoip flag switches on ASN and geolocation mapping through MaxMind's mmdb format, which is what feeds the visitor location and network panels. Zlib lets it read compressed logs directly.

For day to day use the README steers you to the distribution package, and warns you about what you get. On Debian and Ubuntu the command is `apt-get install goaccess`, with an explicit note that this will probably install an outdated version. The development path from a git clone replaces the download and untar steps with `autoreconf -fiv` before configure.

There is no tagged release history in the repository, so the 1.12 in that tarball URL is the version the README is written against rather than something you can browse in a releases list.

Log formats as a list of named presets

Coverage is the feature goaccess is most expansive about, and the list is worth reading because it doubles as a compatibility check against whatever is in front of your servers.

Predefined formats include the combined log format used by Apache and Nginx, the common log format, Apache virtual hosts with or without a colon-delimited port, Squid native format, the W3C format for IIS, Amazon CloudFront standard logs described as a legacy fixed schema, Amazon Simple Storage Service, AWS Elastic Load Balancing, Amazon Application Load Balancer, Google Cloud Storage, Caddy's JSON structured format, and Traefik's take on the common log format.

Behind those presets sits a general capability, which is that you can supply any custom log format string. That is the escape hatch that makes the preset list less important than it looks. Format specifiers are referenced in the features list with their characters, and the TLS panel is the clearest example, since it reports the negotiated protocol, cipher suite and key exchange group when `%K`, `%k` and `%g` appear in your log format. That information only exists if your server logged it, so the tool can only show what the format string makes available.

Getting this wrong is the most common failure with any log analyzer, and goaccess is no exception: point it at a file whose layout does not match the format you declare and you get a screen full of nonsense rather than an error.

What the panels measure and how often

The timing claim is specific enough to check. All panels and metrics are said to update every 200 milliseconds in the terminal and every second in the HTML output, which is a real engineering constraint rather than a slogan, since it means the tool is re-reading or re-aggregating as data streams in.

The metrics themselves cover the ground you would expect from an access log. Hits, visitors and bandwidth can be broken out by the hour or by date, and there is a panel for the slowest running requests, which the README frames as application response time and the page that is slowing down your site. Metrics per virtual host are a separate panel, aimed at anyone running multiple server blocks and needing to know which one is eating resources. UTM campaign tracking breaks traffic down by medium, source, campaign, content and term, all pulled from the requested URL.

Two features stand out as more than standard. Bot and crawler classification keeps AI crawlers and Fediverse ActivityPub traffic in their own categories rather than lumping them with traditional search engine crawlers, which matters if you have started getting scraped by model training bots and want to see them separately. And ASN mapping lets you drop entire networks at parse time with `--exclude-asn`, so blocking a noisy source is a flag rather than a firewall rule.

Beyond live stats, the tool can write a self-contained HTML report and JSON and CSV reports. For persistence across runs there is on-disk storage, and the README attributes large dataset handling to optimized in-memory hash tables with good memory usage.

Shipping its own WebSocket server

The one dependency claim is the most interesting sentence in the README. GoAccess is written in C and the claim is that ncurses is the only thing you need, with the aside that it even features its own WebSocket server, hosted separately at gwsocket.io.

That aside explains the live HTML dashboard. A static report can be written to disk, but a report that updates while you watch it needs a channel between the process reading the log and the page in your browser. Most tools would push that work onto you as a dependency. goaccess bundles it, which is what lets the HTML output refresh every second without an external service.

The authentication story is where the recent work shows. The README describes enhanced WebSocket authentication supporting local and external JWT verification, with token refresh and integration with external authentication systems. The detail that matters operationally is expiry handling: verified tokens are tracked to their `exp` claim and the connection is closed once they expire, so an authenticated dashboard session has a defined lifetime instead of living until the browser tab does.

Taken together, this is the part of the project where the security surface is largest. A log dashboard exposed on a network is a map of your traffic, and the fact that this one has its own WebSocket server, its own token handling and its own expiry logic is exactly the surface you would need to review before exposing port 7890 to anything but localhost.

What the tree and the Dockerfile say about deployment

The repository is a mature autotools project and the tree shows it. There is a configure.ac, a Makefile.am, a ChangeLog, an AUTHORS file and a man page at goaccess.1. Alongside the C sources in src there is a po directory for translations, a resources directory, a config directory, a snap directory, and two Dockerfiles plus a docker-compose directory with its own README.

The Dockerfile is a two-stage Alpine build and it is more informative than most. The build stage installs autoconf, automake, build-base, clang, gettext-dev, libmaxminddb-dev, openssl-dev, ncurses-dev and pkgconf, then runs autoreconf and configures with `--enable-utf8 --with-openssl --enable-geoip=mmdb`, compiling with clang at -O3 and parallelism from nproc. It verifies dynamic dependencies with ldd before moving on, and the runtime stage is a fresh Alpine carrying only the runtime libraries: gettext-libs, libmaxminddb, ncurses-libs, openssl and tzdata.

Two things fall out of that. The openssl dependency explains the TLS reporting feature, since you cannot report a negotiated cipher suite without linking against a TLS library. And the container declares a volume at /var/www/goaccess and exposes port 7890, which tells you where the HTML output is expected to land and which port serves it. The default command is `--help`, so the image expects you to supply real arguments and a config, and the README points at volume mapping and editing goaccess.conf as the configuration path.

Editorial conclusion

goaccess earns its place by refusing the browser. Almost every log pipeline wants a collector, an agent, a database and a dashboard you load over a network, and goaccess asks for a log file and a C library instead. That is why it works over SSH on a machine with nothing else on it, and why the terminal view refreshing every 200 milliseconds is not a gimmick but the actual design. Its honest limits are equally clear: there are no tagged releases in this repository, log format support is a list of named presets plus a custom format string rather than a parser plugin system, and the on-disk persistence story is a checkbox rather than a database. Install it from your distribution, point it at an access log, and judge it on whether the terminal panels answer a question you actually had this week. If they do, the HTML report is a bonus you can hand to someone who was never going to open a terminal at all.

Frequently asked questions

Official sources

1. allinurl/goaccess on GitHub
2. Issues
3. License: MIT
4. Project website
5. README