Learn how to install and configure GoAccess on AlmaLinux for real-time Nginx or Apache web log analysis.
Introduction
Monitoring web traffic is essential for every system administrator and developer managing live web servers. GoAccess is a powerful, open-source log analyzer that lets us visualize Nginx and Apache access logs in real-time via a terminal dashboard or a live HTML report. In this tutorial, we’ll walk through installing, configuring, and running GoAccess on an AlmaLinux server.
Prerequisites
Before we begin, let’s ensure we have the following in place:
- A AlmaLinux dedicated server or KVM VPS.
- A basic programming knowledge.
How to Install and Configure GoAccess on AlmaLinux for Real-Time Nginx/Apache Log Analysis
Step 1: Update the AlmaLinux System
Before we install anything, it’s best to ensure our system is up to date.
sudo dnf update -y
This updates all installed packages and avoids potential dependency issues during installation.
Step 2: Install EPEL and Required Repositories
GoAccess is not available in AlmaLinux’s default repositories, so we enable the EPEL (Extra Packages for Enterprise Linux) repository:
sudo dnf install epel-release -y
We also install dnf-plugins-core to manage additional repositories:
sudo dnf install dnf-plugins-core -y
Step 3: Install GoAccess
With the repository enabled, install GoAccess using:
sudo dnf install goaccess -y
Once installed, verify it:
goaccess --version
Step 4: Locate Our Web Server Logs
By default, Nginx and Apache store logs here:
- Nginx Access Logs: /var/log/nginx/access.log
- Apache Access Logs: /var/log/httpd/access_log
Make sure our web server is generating logs in the Common Log Format (CLF) or Combined Log Format, as GoAccess parses these formats.
To check the format:
sudo tail -f /var/log/nginx/access.log
Step 5: Run GoAccess in Real-Time (Terminal Dashboard)
To analyze the logs in real-time from our terminal, run:
sudo goaccess /var/log/nginx/access.log -o /usr/share/nginx/html/report.html --log-format=COMBINED --real-time-html
Or for Apache:
sudo goaccess /var/log/httpd/access_log -o /usr/share/nginx/html/report.html --log-format=COMBINED --real-time-html
This command:
- Parses access logs in Combined Log Format
- Outputs a real-time HTML report
- Enables live updating in the browser
Tip: Make sure /usr/share/nginx/html/ exists and is accessible by the web server (Apache or Nginx).
Step 6: Set Up a Real-Time HTML Dashboard
To view our live dashboard:
Ensure our server has a web server (like Nginx or Apache) running.
Access the report from a browser:
http://<our-server-ip>/report.html
This dashboard refreshes in real-time using WebSockets.
Step 7: Enable WebSocket Support (Optional but Recommended)
For real-time dashboards to auto-update, GoAccess needs WebSocket support. We can run it as a daemon:
sudo goaccess /var/log/nginx/access.log --log-format=COMBINED --real-time-html -o /usr/share/nginx/html/report.html --daemonize --ws-url=wss://<our-domain-or-ip>/report.html
If we’re using a domain, ensure HTTPS is enabled via Let’s Encrypt or another SSL provider.
Step 8: Automate GoAccess with Systemd (Optional)
To ensure GoAccess starts on boot and continues monitoring:
sudo nano /etc/systemd/system/goaccess.service
Paste the following content:
[Unit]
Description=GoAccess Real-Time Log Analyzer
After=network.target
[Service]
ExecStart=/usr/bin/goaccess /var/log/nginx/access.log --log-format=COMBINED --real-time-html -o /usr/share/nginx/html/report.html
Restart=always
[Install]
WantedBy=multi-user.target
Enable and start the service:
sudo systemctl daemon-reexec
sudo systemctl enable --now goaccess
Troubleshooting
If the service we have created fail with error Unable to set bind: Address already in use or something like that, means that GoAccess is trying to bind to a WebSocket port that’s already in use.
Solution: Fix "Address already in use" Error
Step 1: Check What Is Using the Port
GoAccess by default uses port 7890 for WebSocket connections.
Check if it’s already in use:
sudo lsof -i :7890
You’ll see something like:
goaccess 12345 root ... TCP *:7890 (LISTEN)
That means another GoAccess instance is already running.
Step 2: Kill the Existing GoAccess Process (if needed)
To stop it:
sudo killall goaccess
Or manually kill it using its PID (e.g., 12345):
sudo kill 12345
Now, restart goaccess.service:
systemctl restart goaccess.service
Unable to authenticate WebSocket error
If you got error Unable to authenticate WebSocket in browser it occurs because GoAccess uses WebSocket for real-time updates, and it expects the HTML report to load via HTTPS (not HTTP) and connect securely over WSS (WebSocket Secure).
Step 9: Secure Our Report (Optional)
Since the report is accessible via a public URL, we might want to restrict access:
- Use basic auth with .htpasswd
- Or enable IP whitelisting in Nginx/Apache config
Example (Nginx):
location /report.html {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}
Summary
By following this guide, we’ve transformed AlmaLinux into a powerful real-time analytics server for Nginx or Apache logs using GoAccess. This setup helps us monitor traffic spikes, detect suspicious activity, and understand how users interact with our websites—all in real-time, without complex dashboards.
In future tutorials, we can explore:
- Log rotation handling with GoAccess
- Multi-log analysis
- Email alert setup for suspicious traffic
Let’s keep monitoring smart, efficient, and secure.