๐ง Linux Proxy Server ๆต้่จ้่ GoAccess ่ฆ่ฆบๅๅๆ
ๆฌ็ฏๆไฝ ๆ Squid Proxy ็ๆต้็ด้（access log）่ฝๆไบๅๅผๅ่กจๅ ฑ่กจ，ๅฟซ้็ๅบ ๅชๅฐ็จๆถ็ซฏๆต้ๆๅคง、็ฑ้็ถฒ็ซ、HTTP ็ๆ ็ขผ、ๅฐๅณฐๆๆฎต。ๅๆณๆก「่ฎ Squid ไปฅ Combined ๆ ผๅผ่ผธๅบ → ไบค็ตฆ GoAccess ่งฃๆ」็็ฉฉๅฎ่ทฏ็ท；ๅๆๆไพ ๅณๆ็ๆฟ（Real-Time HTML） ่ ๆฏๆฅ้ๆ ๅ ฑ่กจ ๅ ฉ็จฎ้จ็ฝฒๆนๅผ。
๐ฆ ไธ、ๅ็ฝฎๆขไปถ
- ๅทฒๅฏ็จ็ Squid ไปฃ็ไธปๆฉ（ๅปบ่ญฐๅ ๅฎๆ：ๅฎ่ฃ、ๅบๆฌ ACL、ๅๅๆธฌ่ฉฆ）。
- ็ณป็ตฑ：Ubuntu/Debian/RHEL/CentOS/Alma/Rocky ็ๅฏ。
- ๆฌ้：root ๆ sudo。
๐งพ ไบ、่ฎ Squid ็ข็「Combined」้ขจๆ ผๆฅ่ช
GoAccess ๅฐ COMBINED（Apache/Nginx ้็จ）ๆฏๆดๆๅฅฝ；ๆๅๆ Squid ็ access.log ่ผธๅบๆๆฅ่ฟ Combined ็ๆ ผๅผ，ๅพ็บ่งฃๆๆ็ๅ。
็ทจ่ผฏ /etc/squid/squid.conf（ๆๅฐๆ่ทฏๅพ）
# 1) ๅฎ็พฉไธๅๆฅ่ฟ Apache Combined ็ logformat
# %>a = client IP, %ui/%un = ident/user, %tl = local time,
# "%rm %ru HTTP/%rv" = method + URL + HTTP ็ๆฌ
# %>Hs = ๆ็ต็ๆ
็ขผ, %<st = ๅณ้ๅคงๅฐ, Referer/User-Agent ๅ่ช request header
logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h"
# 2) ไปฅ combined ๆ ผๅผ่ผธๅบๅฐๆฐๆช（้ฟๅ
ๅๅฐๆขๆ access.log）
access_log /var/log/squid/access_combined.log combined
# (ๅฏ็ๅญๅ็ๆ ผๅผไฝๅๆด)
# access_log /var/log/squid/access.log squid
้ๆฐ่ผๅ ฅ่จญๅฎ：
sudo squid -k reconfigure
# ๆ็ณป็ตฑๅ
sudo systemctl reload squid๐ ไธ、ๅฎ่ฃ GoAccess
Ubuntu / Debian
sudo apt update
sudo apt install -y goaccessRHEL / CentOS / Alma / Rocky（ๅปบ่ญฐๅ็จ EPEL）
sudo dnf install -y epel-release
sudo dnf install -y goaccess๐ ๅ、ๅฟซ้่ฉฆ่ท（็ต็ซฏ็ๅ ฑ่กจ）
# ไปฅ COMBINED ๆ ผๅผ่งฃๆ Squid ็ข็็ๆฐๆช
sudo goaccess /var/log/squid/access_combined.log \
--log-format=COMBINED \
--date-format=%d/%b/%Y --time-format=%T็ซ้ขๅฐ้กฏ็คบ็ธฝ่ฆฝ、็ฑ้ URL、็จๆถ็ซฏ IP、ๆๆฎตๅไฝ、HTTP ็ๆ ็ญ。
๐ ไบ、่ผธๅบ HTML ๅ ฑ่กจ（้ๆ ๆช）
# ็ข็ไธๆฌกๆง HTML ๅ ฑ่กจ
sudo mkdir -p /var/www/html/reports
sudo goaccess /var/log/squid/access_combined.log \
--log-format=COMBINED \
--date-format=%d/%b/%Y --time-format=%T \
-o /var/www/html/reports/proxy-report.html็จ็่ฆฝๅจ้ๅ http(s)://<ไฝ ็ไผบๆๅจ>/reports/proxy-report.html ๅณๅฏๆฅ็。
๐ก ๅ ญ、ๅณๆๅ่กจๆฟ（Real-Time HTML）
้่ฆ WebSocket ๆๅๆ็บ้คต่ณๆ。ไปฅไธไปฅ「ๅ็ซฏ Nginx / ๅพ็ซฏ GoAccess」็คบไพ：
1) ็ดๆฅๅๅ GoAccess ๅณๆๅพ็ซฏ（ๅธธ้ง）
sudo goaccess /var/log/squid/access_combined.log \
--log-format=COMBINED \
--date-format=%d/%b/%Y --time-format=%T \
--real-time-html \
-o /var/www/html/reports/proxy-rt.html \
--daemonize2) （ๅฏ้ธ）Nginx ๅๅไปฃ็ WebSocket（่ฅ่ตฐ 80/443 ๅฐๅค）
# /etc/nginx/conf.d/goaccess.conf
server {
listen 80;
server_name _;
location /reports/ {
root /var/www/html;
}
# GoAccess ๅ
งๅปบ WS ้ ่จญ :7890（้ไพๅฏฆ้้กฏ็คบ่ชฟๆด）
location /ws/ {
proxy_pass http://127.0.0.1:7890/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
sudo nginx -t && sudo systemctl reload nginx⏰ ไธ、ๆฏๆฅ่ชๅๅฏๅบ（systemd ็）
็ขๅบ ๆฏๅคฉไธไปฝ้ๆ HTML，ๅฉๆผ็ๅญ่ๅไบซ。
ๅปบ็ซ service ่ timer
# /etc/systemd/system/goaccess-report.service
[Unit]
Description=Daily GoAccess Report (Squid Combined)
After=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/bin/goaccess /var/log/squid/access_combined.log \
--log-format=COMBINED \
--date-format=%d/%b/%Y --time-format=%T \
-o /var/www/html/reports/proxy-report-$(date +%%F).html
# /etc/systemd/system/goaccess-report.timer
[Unit]
Description=Run GoAccess daily at 02:10
[Timer]
OnCalendar=*-*-* 02:10:00
Persistent=true
RandomizedDelaySec=90
[Install]
WantedBy=timers.target
# ๅฅ็จ่ๅ็จ
sudo systemctl daemon-reload
sudo systemctl enable --now goaccess-report.timer
systemctl list-timers --all | grep goaccess๐บ ๅ ซ、（ๅฏ้ธ）ๅ ไธๅฐ็ไฝ็ฝฎ็ตฑ่จ
่ฅ็ทจ่ญฏ/ๅฅไปถๆฏๆด GeoIP2，ๅฏๅ ๅ ฅๅๅธ/ๅๅฎถ็ถญๅบฆ。
# ไปฅ Debian/Ubuntu ็บไพ
sudo apt install -y geoipupdate
# ๅๅพ MaxMind ๅธณ่/้้ฐๅพ่จญๅฎ /etc/GeoIP.conf，ๅๆดๆฐ่ณๆๅบซ
sudo geoipupdate
# ๆๅฎ่ณๆๅบซ（่ทฏๅพไพ็ผ่ก็ไธๅ）
sudo goaccess /var/log/squid/access_combined.log \
--log-format=COMBINED \
--date-format=%d/%b/%Y --time-format=%T \
--geoip-database=/usr/share/GeoIP/GeoLite2-City.mmdb \
-o /var/www/html/reports/proxy-report-geo.html๐งน ไน、้ฑ็ง่ๅป่ญๅฅๅ（ๅไบซๅๅปบ่ญฐ）
- ๅปๅฐพ็ขผๅ IP：ๅไบซๅไปฅๆๅพไธๆฎต้ฎ็ฝฉ（ไพ：
192.168.1.xxx）。 - ๆ้คๅ
ง้จ็ถฒๅ：GoAccess ๆฏๆด
--ignore-panelๆๅ ่กไปฅgrep -v้ๆฟพ。 - ไฟ็ๅๅงๆช：ๅ ฑ่กจๅฏๅ ฌ้，ๅๅงๆฅ่ชๅ ็ๅ ง้จ。
็ฏไพ：้ฎ็ฝฉๆๅพไธๆฎต IP ๅ้คต็ตฆ GoAccess
awk '{sub(/\.[0-9]+(\]| )/,".xxx"$1); print}' /var/log/squid/access_combined.log \
> /var/log/squid/access_combined_masked.log
goaccess /var/log/squid/access_combined_masked.log \
--log-format=COMBINED -o /var/www/html/reports/proxy-report-masked.html๐งฏ ๅ、ๅธธ่ฆ้ฏ่ชคๆๆฅ
- ๆ้/ๆฅๆ็กๆณ่งฃๆ：็ขบ่ช
--date-format=%d/%b/%Y --time-format=%T่ๆฅ่ช็[10/Nov/2025:13:47:20 +0700]้ขจๆ ผไธ่ด。 - ๅ ฑ่กจ็ฉบ็ฉบ็：ๆชขๆฅ
access_combined.logๆฏๅฆๆๆฐ่กๅฏซๅ ฅ，ๆๆฏๅฆไฝฟ็จไบ้ฏ่ชค็ๆชๅ。 - ๅณๆๅ ฑ่กจ็กๆดๆฐ：็่ฆฝๅจ Console ็็ WS ๆฏๅฆ่ขซๆ；ๅฟ ่ฆๆ่จญๅฎๅไปฃๆ้ๆพ 7890。
- ๆฌ้ๅ้ก：่ฎ
goaccess่ฝ่ฎๅ/var/log/squid，ๆไปฅsudoๅท่ก。
๐งญ ่กๅๆธ ๅฎ
✅ ่ชฟๆด squid.conf ่ฎ access_combined.log ็ๆ ✅ ๅฎ่ฃ GoAccess ไธฆๆธฌ่ฉฆ็ต็ซฏๅ ฑ่กจ ✅ ็ขๅบ HTML ๅ ฑ่กจ，ๆพๅฐ /var/www/html/reports/ ✅ （ๅฏ้ธ）ๅ็จ --real-time-html ๅณๆ็ๆฟ ✅ （ๅฏ้ธ）ๅปบ็ซ systemd timer ๆฏๆฅ่ชๅๅฏๅบ
๐ ็ต่ช
ไปฅ Combined ๆฅ่ชๆ ผๅผ + GoAccess ็ๆนๅผ，่ฝๅจไธๆดๅๆๅๆ ธๅฟๆถๆงไธ，ๅฟซ้ๆๆๅฏ่ฆๅๆต้็ธฝ่ฆฝ；ๆญ้ systemd ๅฎๆ ๆ ๅณๆๅ่กจๆฟ，ๆฅๅธธ็ถญ้่็ฐๅธธๆๆฅๆๆด็ด่ฆบ。
๐ฌ ไบๅ็่จๅผๅฐ
้็ฏๆๅนซๅฐไฝ ๅ？ไฝฟ็จ็ๆฏ ๅณๆ็ๆฟ ้ๆฏ ๆฏๆฅๅ ฑ่กจ ๅข？็่จๅไบซไฝ ็้จ็ฝฒๆนๅผ่้ๅฐ็ๅ，ๆๆๆๅธธ่ฆๅ้กๆด็ๅฐๆๆซ FAQ！
๐ ๅปถไผธ้ฑ่ฎ
- Linux Proxy Server ๅปบ็ฝฎๆๅญธ（Squid ๅฎ่ฃ่่จญๅฎๆๅ）
- Linux Log ่ชๅๅ：GoAccess + Fail2Ban（็ฏไพ）
- Linux ้ฒ็ซ็่ Fail2Ban：systemd ๆๅๅ
— WWFandy・ไธป้ก็ญ่จ
ๆฒๆ็่จ:
ๅผต่ฒผ็่จ