// the find
allinurl/goaccess
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.
GoAccess is a C-based web log analyzer that gives you real-time traffic stats either in an ncurses terminal dashboard or as a self-contained HTML report with WebSocket live updates. It parses Apache, Nginx, Caddy, CloudFront, and a dozen other formats, and it ships its own WebSocket server. The target user is a sysadmin or DevOps engineer who wants answers from a log file in seconds without standing up a full observability stack.
Single binary with one runtime dependency (ncurses) — you can drop it on any *nix box over SSH and be looking at traffic data in under a minute. The self-contained HTML report is genuinely useful: one file, no CDN calls, you can email it or drop it behind Nginx and it live-updates via WebSocket. Incremental log processing with inode tracking and timestamp deduplication means you can feed it rotating logs without re-parsing everything. Multi-threaded parsing with --jobs was added without breaking the single-threaded path, which is the right call for a tool that runs in environments you don't control.
The log format configuration is fiddly — date/time locale mismatches are the #1 support issue by a wide margin (200+ closed issues), and the error messages when it fails to match entries are not helpful enough to self-diagnose. No alerting or threshold notifications: you can see a spike in 500s but GoAccess won't tell you about it, so it's a viewer not a monitor. The on-disk persistence format is internal and undocumented — if the binary version changes, your persisted data may not load, which makes long-term incremental setups fragile. The HTML dashboard is good but the data model is flat; you can't drill into a URL and see its traffic broken down by country or time range the way you can in a real analytics product.