Getting IP in X-Forwarded-For field logged in

If you run a cluster of servers in a reverse proxy situation then you must have encountered this where you want to log the actual IP of request coming in forwarded via the Reverse Proxy server.This IP is in X-Forwarded-For field of header.




You can define some custom log with your apache vhost configuration

LogFormat "%{X-Forwarded-For}i %a %D %>s %B" resp
CustomLog /var/log/apache2/resp.log resp

To be able to record or observe your desired format of logs.


On one of my machines I had done this mistake apache2.conf where I have commented out the wrong line

LogFormat " %{X-Forwarded-For}i %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
#LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

one line with keyword combined at the end is hashed.That was a mistake having a CustoLog Format with keyword combined at 2 lines had created problem.I am not sure why it had not worked the time when I was writing.Since I am already running 12-13 websites on this one which is a part of a larger cluster so mentioning it (keyword combined ) in 2 different lines
was causing trouble in other vhosts.Only one place is sufficient to log in apache2.conf.
How ever you should define some thing in your vhost files also.
You can do some thing similar in the vhost file

<virtualhost *:80>
        ServerAdmin webmaster@localhost

        ServerName 
        ProxyRequests off
       <Proxy * >
       Order deny,allow
        Allow from all
       </Proxy>

        DocumentRoot /var/www
        <directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>
  ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn


        CustomLog /var/log/apache2/access.log combined
        CustomLog /var/log/apache2/resp.log resp

</VirtualHost>

Now note the combined keyword here at the end.The log format in apache2.conf corresponding to keyword combined and resp gets mapped here.

<virtualhost *:80>
        ServerAdmin webmaster@localhost

        ServerName 
        ProxyRequests off
       <Proxy * >
       Order deny,allow
        Allow from all
       </Proxy>

        DocumentRoot /var/www
        <directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>
  ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn


        CustomLog /var/log/apache2/access.log combined
        CustomLog /var/log/apache2/resp.log resp

        CustomLog /var/log/apache2/access.log myformat
        LogFormat "%{X-Forwarded-For}i  %D %t %T %v %O %b %A %B" myformat
</VirtualHost>

Now note the last 2 lines this way you can have your formats if you do not want to mess with apache2.conf.

Some useful information which you can capture in logs is
%{X-Forwarded-For}i IP of user coming behind a proxy
%v server name for which request is coming if you have multiple websites this helps
%T time taken to serve requests in seconds and if you want in microseconds then use
%D
%{User-agent}i user-agent refers to client browser
%t the time at which server recieved request (English Date Format)

Someuseful links
1) http://ubuntuforums.org/showpost.php?p=9394344&postcount=9
2) http://httpd.apache.org/docs/2.0/mod/mod_log_config.html