GoAccess

HTTP stats from the logs your server already writes

GoAccess is an open source web log analyzer written in C. It reads the access logs a web server already writes and turns them into HTTP statistics: visitors, requested pages, status codes, referrers, browsers, bandwidth, time to serve. Results land either in a terminal dashboard refreshed every 200 ms or in an HTML report that GoAccess's own WebSocket server updates once a second, with JSON and CSV exports on the side. The site being measured stays untouched: there is no tracking script in its pages and no cookie on the visitor's machine.

The comparison of self-hosted web analytics tools sets GoAccess apart: it reads server logs and puts no script on the page.

Parses any log format and needs only ncurses

• Log formats: presets for Combined (Apache, Nginx) and Common (Apache), with or without a virtual host, W3C (IIS), Squid, Caddy's JSON logs, Traefik's CLF flavor, CloudFront, S3, Elastic Load Balancing, Application Load Balancer and Google Cloud Storage. Anything else can be described with --log-format, JSON included.
• One required dependency: ncurses. GeoIP and OpenSSL are optional.
• Single-file HTML report: it has no external assets, so it can go out as an email attachment.
• Bots in their own buckets: since 1.12, AI crawlers and Fediverse (ActivityPub) traffic each get a category of their own, apart from search engine crawlers.
• UTM campaigns: a panel splits traffic by source, medium, campaign, content and term, read from the requested URL.
• Large logs: multi-threaded parsing (--jobs) and incremental processing (--persist, --restore).

Old archives, live tails over SSH, bandwidth-hungry bots

• Going back through archived logs, compressed files included (zcat --force access.log* | goaccess -)
• Watching a remote server live from a local machine, with nothing installed on the server, through ssh -n and tail -f
• Spotting scanners, brute-force attempts and bots that eat bandwidth

Blind to browser events, aimed at sysadmins

Logs only see requests. GoAccess works from what the server records for each request: IP address, date, URL, status, size, referrer, user agent, time to serve. Whatever happens in the browser without reaching the server never shows up. Matomo, which can import logs too, spells out the gaps on its Log Analytics page: screen resolution, page titles, events, heatmaps, session recordings, form analytics. Umami collects its events through the script embedded in the page, from a data-umami-event attribute or a umami.track() call.

A visitor means one IP, one date, one user agent. That is how the man page defines a unique visitor, crawlers included unless --ignore-crawlers is set. With no cookie to tell them apart, two people behind the same address with the same user agent string count as one.

Anonymization only covers the report. --anonymize-ip zeroes the last octet of IPv4 addresses (192.168.20.100 becomes 192.168.20.0), and --anonymize-level goes up to 24 bits. Visitor counts are unaffected: the source code fingerprints visitors on the full address and masks it on output only. The log files keep whatever the server writes to them, so the privacy side is settled in the server's logging configuration first.

Built for operations. The README names system administrators, DevOps engineers and security professionals as its audience, and describes GoAccess as a command-line monitoring tool more than anything else. It runs on Unix-like systems; on Windows it needs Cygwin or the Linux subsystem. Data is held in memory, so physical RAM caps the dataset: the FAQ quotes roughly 400 million hits (74 GB of logs) parsed in 1 h 20 min with about 12 GB of RAM.

The live report opens a port. The WebSocket server listens on port 7890 on every interface unless --addr says otherwise. Under a Content Security Policy, the FAQ says the HTML report needs 'unsafe-inline' and 'unsafe-eval' in script-src.

Regular releases. Version 1.12 shipped on September 16, 2026, the fifth release that year. The README warns that the stock Debian or Ubuntu package is likely out of date and points to the project's own apt repository.