Again, if I remember correctly, it was able to make reports for AWS Cloudfront logs, which was actually useful.
It probably depends a lot on your setup. I’ve been running GoAccess from a crontab on some of my sites for a couple of years. It was a bit fiddly to get the correct combination of Nginx logs, forwarding real IP from HAProxy, and getting it to show with GeoIP in generated GoAccess HTML reports, but once I got it working satisfactorily it’s been working well since. The only part that is missing in my GoAccess reports is the ASN of the clients. I don’t remember if that’s because ASN mappings are a paid GeoIP database feature or if I simply ignored that part or what, but I do have countries and municipalities correct (I can tell because for example on one of the sites the most frequent visitor is a client machine that I own, and it shows up accordingly prominently with the country and municipality where that client machine is located).
I serve the generated GoAccess HTML reports from Nginx itself with a simple .htaccess file providing username and hashed password and Nginx using that file with HTTP Basic Auth. Since the only person that looks at those reports is myself, and the sites use TLS, I don’t need anything more advanced than HTTP Basic Auth to protect access to the GoAccess HTML reports.
And I suppose that in today’s world an LLM would probably be able to do most of the config writing for a setup such as mine for all of the above parts.
For ad hoc analytics these tools are very nice, but for long-term stats they run into timeouts, because the backend needs a lot of time to collect the data and build the reports for ~1 month or a quarter — or am I wrong about that?
What I'm seeing matches the observations of the other commenters here exactly: most of the "users" are bots harvesting pages and PDFs. My solution for getting at the real users is GoatCounter.