View Remote Server Logs Locally using GoAccess

How to use a locally installed copy of GoAccess to view a remote server's access logs

Since I removed Google Analytics I've had 0 visibility into my websites traffic, and I'd really like to at least see some stats like the page views.

My website is a mix of Nginx serving static files and forwarding dynamic pages to a python web server using Flask.
After a bit of searching I realised I could just use Nginx's access logs directly, rather than introducing anything new. GoAccess seemed to be the most recommended tool, but I wanted to avoid installing anything new on the server if I could help it, so I was really looking for a local tool.

Fortunately, it is possible to run GoAccess on your local machine and view the server logs remotely over SSH.

How To

First make sure the server logs are accessible to the user you will be SSH'ing in with, if they aren't then SSH in and fix the permissions first: sudo chmod -R +r /var/log/nginx/.

On macOS installing GoAccess is as simple as running:

brew install goaccess

Then to view a single log file you can ssh into the server, cat the log file and pipe the output directly to GoAccess on your local machine.

ssh USER@IP_ADDRESS 'cat /var/log/nginx/access.log' | goaccess -a --log-format=COMBINED

After a while nginx will compress the log files and start again so you end up with a directory looking like:

access.log        access.log.2.gz   access.log.3.gz
access.log.4.gz   access.log.5.gz   access.log.6.gz

There are now multiple log files, most of which are compressed.

To view all the log files you can run this command to uncompress them, and concatenate them together before feeding them into GoAccess.

ssh USER@IP_ADDRESS 'zcat -f /var/log/nginx/access.log*' | goaccess --log-format=COMBINED

More details about actually using GoAccess to navigate the logs you have opened can be found on GoAccess's website.