GoAccess is an open source, real-time web log analyzer that runs in a terminal on Unix-like systems or as a live dashboard in the browser. It reads the access log your web server already writes — nginx, Apache, Caddy, CloudFront, an elastic load balancer, or any layout you describe yourself — and turns it into traffic statistics within seconds. It is written in C and needs only ncurses, so it starts instantly and is happy on the same small machine as the web server it is measuring.

Key Features

• Real-time panels — all terminal metrics are refreshed every 200 ms, and the HTML report every second, so tailing a live log gives you a moving picture rather than a snapshot.
• Nearly every web log format — predefined layouts for Apache and nginx combined and common format, Amazon S3, CloudFront, Elastic Load Balancing, Squid, W3C/IIS, Caddy’s JSON format and Traefik’s CLF flavour, plus free-form custom format strings for anything else.
• Four ways out — an interactive curses dashboard in the terminal, a self-contained real-time HTML report, JSON, and CSV.
• Response time tracking — if the log records it, GoAccess reports how long each request took to serve, so slow endpoints sit next to their hit counts.
• Incremental parsing — an on-disk database lets repeated runs parse only new log lines instead of reprocessing the whole file.
• Bandwidth and virtual host metrics — hits, visitors, transfer volume and slowest requests broken down by date, hour, URL, virtual host, referrer and status code.
• Crawler classification — search engines, AI crawlers and Fediverse traffic are reported as separate categories, so training bots no longer hide inside your visitor numbers.
• Security detail — TLS protocol, cipher suite and key exchange group when the format carries them, GeoIP2-based ASN mapping, and --exclude-asn for dropping whole networks from a report.
• UTM campaign breakdown — medium, source, campaign, content and term are extracted from the requested URL.
• One dependency — ncurses, plus its own WebSocket server for the live HTML view.

Why Use It?

Most analytics products ask you to add a JavaScript tag, keep the results in a database and trust a third party with the request history. GoAccess reads the log your web server is already writing, so the figures come from the server’s own record of every request: API calls, asset fetches, crawler hits and the 404s that scanners generate all appear, not only the page views a browser agreed to report.

Because it is a single binary, there is no daemon to run, no schema to design and no storage to plan. You point it at a log file over SSH and read the result in the terminal, or let it follow a growing log and serve a live HTML page on the network. It is packaged for Debian and Ubuntu, Fedora, Arch, Gentoo, openSUSE and the BSD ports trees, installs from Homebrew on macOS, runs on Windows through Cygwin or WSL, and upstream also publishes an official Docker image.

Use Cases

• Checking how a site is doing today from a shell, without opening a browser or a hosted dashboard.
• Watching a log grow in real time while you push a release, to see exactly what starts hitting the server.
• Security triage — spotting brute-force attempts, scanner user agents and sudden request bursts while reading the same report as ordinary traffic.
• Auditing crawler behaviour, including how much of your bandwidth goes to search bots, AI crawlers and Fediverse servers.
• Finding which endpoints are slow when the log format records response times.
• Producing a shareable static HTML report for a fixed window, such as a month, with no tracking script and no database.
• Generating a one-off report inside a container by piping a log file into the upstream Docker image.