Release 8789: Configuration for GoAccess out of the box

In this release we have added configuration for GoAccess so it can handle Hypernode’s custom access log format out of the box. We’ve had the goaccess binary installed on Hypernode ever since December 2019 but considering Hypernode uses a custom json based log format for NGINX it was difficult to use. On Hypernode there are all kinds of nifty log parsing tools like hypernode-parse-nginx-log (also known as pnl), but those make compatibility with a tool like goaccess require some tinkering.

Now on Hypernode a sane configuration is deployed by default and you can simply pipe your access logs into goaccess as you’d expect. For example:

app@er5ami-hntesthypernode-magweb-cmbl:~$ cat /var/log/nginx/access.log | goaccess

This is achieved by a shell alias that pipes the logfile input through hypernode-parse-nginx-log in order to generate output that matches with the config in /etc/goaccess.conf. If you do not wish to use this alias you can still invoke the plain goaccess binary by running the command using the absolute path (like /usr/bin/goaccess).

GoAccess is a great tool to give you insight into what type of traffic is landing on your server. Its text-based user interfaces (TUI) is very cool. You can also pipe in older archived access logs like $ zcat /var/log/nginx/access.*gz | goaccess. Keep in mind that the more logs you pipe in the longer it can take to load the interface.

You can also use goaccess to generate a static site so you can analyze your logs using a web interface. Be careful not to expose this page to the world though. It might be prudent to use something like an IP allowlist or basicauth to shield it off.

$ echo -e "allow your_home_ip;\ndeny all;" > /data/web/nginx/server.allowlist
$ cat /var/log/nginx/access.log | goaccess -o /tmp/static_site.html
$ mv /tmp/static_site.html /data/web/public/index.html

Here’s an example of what that static site might look like:

GoAccess even has options for Real-time HTML output which use a WebSocket server for providing real-time data. That would probably be a bit difficult to set up using a public facing NGINX configuration but of course you can always bind a port on a local interface and TCP-forward it to your host using SSH. How to achieve that exactly is left as an exercise for the reader.