Analysis of access logs using GoAccess

GoAccess is a console tool for visual analysis of site access logs. Its main application is to sort all entries in logs to display sorted and structured data and quickly view statistics.

GoAccess allows you to quickly view statistics on:

• site visits, including the number of unique visitors

• pages to which the most requests are made

• IP addresses from which most requests are made, including search bots

• network traffic, operating systems and browsers of visitors

• the number of requests to the site depending on the time of day

• and other…

This instruction is partially based on the following two: [where are the site log files] and [web-ssh connection]

So, if we have determined which log file we will view, open the ssh console window (it is desirable to expand it to the entire screen) and enter the command there along with the name of our own log file that we will analyze, for example:

 goaccess $HOME/logs/SITE_NAME.access.log

A window will open in which you will be asked to choose the log file format. At this step, press the Space key and then Enter . After downloading the log file, you will see a list of sorted data.

In the upper part, basic information will be displayed in English.

Basic information displayed here:

• Total Requests — Total number of requests to the site

• Unique Visitors — the total number of unique visitors

• Tx. Amount — used traffic

All other information will be grouped in blocks below. Each block will have its own number, for quick access to it through the keys on the keyboard.

Each block displays a separate list of data, namely:

1. Unique visitors per day — the number of unique site visitors, including search bots

2. Requested Files (URLs) — page requests

3. Static Requests — requests to static files

4. Not Found URLs (404s) — requests to pages that returned a 404 error

5. Visitor Hostnames and IPs — IP address of the visitor, his country in the host name

6. Operating Systems — operating systems of visitors

7. Browsers — internet browsers of visitors

8. Time Distribution — the number of requests depending on the time of day

9. Module No. 9 is disabled

10. Referrers URLs — where the visitor came from

11. Referring Sites — the site from which the visitor came

12. Keyphrases from Google — keywords that brought the user to the site

13. HTTP Status Codes — status codes returned by the server

14. Geo Location — countries of visitors

In addition to the basic information displayed by the block, it can be expanded to display additional information. This is, for example, what the expanded block #5 looks like, from which we can conclude that the main visitors to the site were Google search bots.

In general, the basic management of the utility can be reduced to a few keys:

• TAB — to move between separate information blocks

• ? (arrow to the right) — to expand the block and view additional information

• ?? (down and up arrows) — for scrolling information on the page

However, for full control of the utility, there is the following list of keyboard shortcuts:

• F5 — update information in the program window

• Q — backward action, or exit from the program

• O or Enter — expand the selected block

• 0-9 , SHIFT+0-9 — quick transition to the block by its number

• J - move the cursor down inside the block

• K — moving the cursor up inside the block

• CTRL+F — go to the next page inside the block

• CTRL+B — transition to a page back within a block

• SHIFT+TAB — move back between blocks

• S — sorting parameters in the selected block

• / — text search inside all blocks (regex is allowed)

• N — find the next search match