cmc/cleberg.net

 1#+date:        [2023-06-08 Thu 00:00:00]
 2#+title:       Nginx Traffic Analysis with GoAccess and GeoIP
 3#+description: Using GoAccess with MaxMind GeoIP to analyze Nginx traffic in real time.
 4#+slug:        goaccess-geoip
 5#+filetags:    :self-hosting:web:
 6
 7* Overview
 8
 9[[https://goaccess.io/][GoAccess]] is an open source real-time web log
10analyzer and interactive viewer that runs in a terminal in *nix systems
11or through your browser.
12
13* Installation
14
15To start, you'll need to install GoAccess for your OS. Here's an example
16for Debian-based distros:
17
18#+begin_src sh
19sudo apt install goaccess
20#+end_src
21
22Next, find any number of the MaxMind GeoIP database files on GitHub or
23another file hosting website. We're going to use P3TERX's version in
24this example:
25
26#+begin_src sh
27wget https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-City.mmdb
28#+end_src
29
30Be sure to save this file in an easy to remember location!
31
32* Usage
33
34In order to utilize the full capabilities of GoAccess and MMDB, start
35with the command template below and customize as necessary. This will
36export an HTML view of the GoAccess dashboard, showing all relevant
37information related to that site's access log. You can also omit the
38=-o output.html= parameter if you prefer to view the data within the CLI
39instead of creating an HTML file.
40
41With the addition of the GeoIP Database parameter, section
42=16 - Geo Location= will be added with the various countries that are
43associated with the collected IP addresses.
44
45#+begin_src sh
46zcat /var/log/nginx/example.access.log.*.gz | goaccess     \
47--geoip-database=/home/user/GeoLite2-City.mmdb             \
48--date-format=%d/%b/%Y                                     \
49--time-format=%H:%M:%S                                     \
50--log-format=COMBINED                                      \
51-o output.html                                             \
52/var/log/nginx/example.access.log -
53#+end_src