Analyzing Nginx Access Logs with GoAccess: A Step-by-Step Guide

Monitoring and analyzing web server traffic is crucial for maintaining performance, security, and user experience. GoAccess is a powerful open-source tool that provides real-time, interactive analytics for web server logs. In this article, I'll show you how to use GoAccess to generate insightful reports from Nginx access logs, complete with visual analytics.

?? What is GoAccess?

GoAccess is a terminal-based log analyzer that provides real-time monitoring and detailed reports for web traffic. It supports multiple log formats and can generate HTML reports with interactive visualizations.

?? Installing GoAccess

Ubuntu/Debian (including WSL2):

sudo apt update && sudo apt install goaccess -y        

CentOS/RHEL:

sudo yum install epel-release -y
sudo yum install goaccess -y        

macOS (via Homebrew):

brew install goaccess        

?? Analyzing Nginx Logs with GoAccess

1?? Locate Your Nginx Access Log File

By default, Nginx stores access logs at:

/var/log/nginx/access.log        

Or if you have multiple logs:

/var/log/nginx/access.log-YYYYMMDD.gz  # Compressed logs        

2?? Decompress Logs (if needed)

If your logs are compressed, decompress them first:

gunzip /var/log/nginx/access.log-YYYYMMDD.gz        

3?? Generate a Real-Time Report

Run GoAccess in interactive mode:

goaccess /var/log/nginx/access.log --log-format=COMBINED        

Press F1 for help and Shift+Q to quit.

4?? Generate an HTML Report

To generate a visual report:

goaccess /var/log/nginx/access.log -o report.html --log-format=COMBINED        

Then open it in your browser:

explorer.exe report.html  # For WSL2 users
xdg-open report.html  # For Linux
open report.html  # For macOS        

?? Example GoAccess Reports (Images)

Here are sample reports generated by GoAccess:

Traffic Overview

Visitor Locations

Top Requested URLs

?? Automate Reports with a Cron Job

To generate daily reports automatically, add this to your crontab:

crontab -e        

Add:

0 0 * * * goaccess /var/log/nginx/access.log -o /var/www/html/report.html --log-format=COMBINED        

This will generate a new report every midnight.

?? Why Use GoAccess?

? Real-time analysis (unlike static log parsers) ? Interactive web reports with graphs & tables ? Lightweight and fast processing ? Works with compressed logs ? No need for a database