👾 Server Access Logs with GoAccess

#security #webdev #learning #linux

Part 1: Self-hosting on Jetson Orin Nano

👽 Jetson Orin Nano Web Server Follow-up 👽

Cool! Now that the mini web server is up and running, how can I see web traffic easily? I discovered GoAccess recently, which is a free and open source tool for checking out server logs in real time. There are two way to view it. At first I was happy to just see nicely-parsed server logs in the terminal. Ahhhh, organization! It gives you a bunch of interesting stuff to look at.

Here is what the terminal view looks like:

You know, inviting traffic to a webserver invokes anxiety. Having half an idea of what is happening helps ease tension for sure. I was really excited to find this tool. You can open go access in the terminal to display different information with different views. I will leave the explaining to the official documentation found here: GoAccess Docs

But the web developer in me was super excited to find a very human-readable html version readily available. Using a reverse proxy through nginx, you can view all the stats on a web page locally. It also allows you to pick a theme and customize how the information is displayed. Be sure to check out the settings and chart options!

Here is what the html view produces:

goaccess html view — Stats for silly hoomins.

Idk about you, but this is my super exciting find for the day.

I think my next step is to connect an agent that reads the logs and alerts me on set parameters.

I'm interested to hear what tools all of you use to enhance web server monitoring?

What's the best agent for web analytics, in your opinion?

Top comments (1)

Rahul S • Jun 22

GoAccess real-time mode (the --real-time-html flag spins up a little WebSocket server so the dashboard updates live) is perfect for what you're after. One thing that'll jump out once you're on the open internet: a lot of that "traffic" isn't human — it's scanners hitting your raw IP for /wp-login.php, /.env and /.git/config within hours of going public, so the volume looks scarier than it actually is. GoAccess shows you volume and top paths but not intent, so for the alerting agent you're planning, a high 404-to-weird-path ratio per IP makes a cheap first rule, and enriching each source IP with a type/reputation lookup (datacenter vs residential vs known proxy) is what separates a real visitor from background noise. You can eyeball how any IP classifies at ipasis.com/scan while you tune your thresholds.