Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Log an HTTP Header in Apache2 Access Logs

I have a website running behind Cloudflare, which is a reverse-proxy. This means that I only ever get one or two IP addresses in my access logs.

However, Cloudflare does provide the visitor IP address in the request headers, which I assume I can log instead of the standard one in an access log.

I know how to use CustomLog, but is there a way to save an HTTP header in an Apache access log?

Thanks.

like image 582
Alfo Avatar asked Sep 03 '12 13:09

Alfo


People also ask

Are HTTP headers logged?

Header values are not logged by default to safeguard potentially sensitive information. In some cases, it may be useful to make sure that a particular test run uses the correct value. You can enable logging using Log header value in the plan edit screen. Save and run the plan, execution logs will show header value.

How do I access Apache access logs?

You can access Apache logs from var/log/log_type. For example, you can access Apache logs from the Apache Unix/Linux server by looking in the following directories: /var/log/apache/access. log.

How do I change the Apache access log format?

The CustomLog directive is what controls the location and format of the Apache access log file. This directive can be placed in the server configuration file ( /etc/apache2/apache2. conf ) or in your virtual host entry. Note that defining the same CustomLog directive in both files may cause problems.

What is httpd access log?

What are Apache Access Logs? As mentioned above, the Apache access log is one of several log files produced by an Apache HTTP server. This particular log file is responsible for recording data for all requests processed by the Apache server.


1 Answers

Aye - have a look at the docs - http://httpd.apache.org/docs/2.2/mod/mod_log_config.html specifically the entry for

%{Foobar}i  

Which will net you:

The contents of Foobar: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers) affect this. If you're interested in what the request header was prior to when most modules would have modified it, use mod_setenvif to copy the header into an internal environment variable and log that value with the %{VARNAME}e described above.

So one would usually add some entry like "... %{X-Forwarded-For-IP}i to the CustomLog entry.

Replace 'X-Forwarded-For-IP' to whateever your cloudflare service gets you (which usually is something like ''"CF-Connecting-IP"''); e.g.

 LogFormat "%v %{CF-Connecting-IP}i (via cloudflare:%h) %l %u %t \"%r\" %>s %b" cloudflare
 CustomLog "|rotatelog.. etc" cloudflare

With regard to the 'transferlog' -- see the note near TransferLog Directive -- that it picks up the most recent defined version.

Dw.

like image 120
Dirk-Willem van Gulik Avatar answered Oct 06 '22 00:10

Dirk-Willem van Gulik