You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by "Gretton, Liam" <li...@leicester.ac.uk> on 2024/10/19 09:50:25 UTC
[users@httpd] mod_remoteip and ErrorLogFormat
httpd 2.4.57-11 on Rocky 9 here.
I've been trying to get ErrorLogFormat to log the client IP address rather than that of my proxy's, but it doesn't seem to work. For LogFormat it is working as expected.
My suspicion is that mod_remoteip doesn't actually modify core's %a format string, yet the documentation for ErrorLogFormat specifically mentions it:
https://httpd.apache.org/docs/2.4/mod/core.html#errorlogformat
%{c}a Underlying peer IP address and port of the connection (see the mod_remoteip module)
mod_remoteip's documentation also states that it modifies core's %a directive.
I know I can use the connection ID (%L) to provide a marker for matching error log entries with access log entries, but just being able to see the client IP would be much more helpful.
Here are my sanitised log entries, access log then error log. 333.444.555.666 is the client IP, coming through the proxy 192.168.1.100.
J69TyXBo7cc vhost.local 333.444.555.666 - - 2024-10-19_10:10:09 "GET /favicon.ico HTTP/1.1" 404 266 https://referer.local "Firefox/131.0"
J69TyXBo7cc vhost.local 192.168.1.100:39838 2024-10-19 10:10:09.766591 info 15282 core core.c(4920):] [AH00128: File does not exist: /path/to/favicon.ico
...and my log formats:
LogFormat "%L %v %a %l %u %{%F_%T}t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" log_vhost
ErrorLogFormat "%-L %-v %-a %-{cu}t %-l %-P %-m %-F: %-E %-M"
Is there something I'm doing incorrectly or does mod_remoteip not actually work for ErrorLogFormat's %a specifier?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] mod_remoteip and ErrorLogFormat
Posted by "Gretton, Liam" <li...@leicester.ac.uk>.
I am a bit of a muppet. My reason for using mod_remoteip was to be able to get client IPs into the error logs, but I've just discovered that the %i format specifier is available to ErrorLogFormat, so I can use X-Forwarded-For directly there.
As mod_remoteip seems to remove X-Forwarded-For as well, that's likely to cause problems on its own for some of our older applications. So in this case I don't need to bother with mod_remoteip at all anyway.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] mod_remoteip and ErrorLogFormat
Posted by "Gretton, Liam" <li...@leicester.ac.uk>.
On 20 October 2024 18:05, Daniel Ferradal Márquez wrote:
> What is your "RemoteIpHeader" setting? You have to specify it for mod_remoteip to work.
>
> Have you made sure you are getting that header from the front-end with the correct client ip?
RemoteIPHeader is set to X-Forwarded-For.
It's working as expected for the access log with %a, just not for the error log.
access log is handled by mod_log, but error logging is handled by core, which makes me wonder if core doesn't honour mod_remoteip.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_remoteip and ErrorLogFormat
Posted by Daniel Ferradal Márquez <df...@apache.org>.
On 19/10/24 11:50, Gretton, Liam wrote:
> httpd 2.4.57-11 on Rocky 9 here.
>
> I've been trying to get ErrorLogFormat to log the client IP address rather than that of my proxy's, but it doesn't seem to work. For LogFormat it is working as expected.
>
> My suspicion is that mod_remoteip doesn't actually modify core's %a format string, yet the documentation for ErrorLogFormat specifically mentions it:
>
> https://httpd.apache.org/docs/2.4/mod/core.html#errorlogformat
>
> %{c}a Underlying peer IP address and port of the connection (see the mod_remoteip module)
>
> mod_remoteip's documentation also states that it modifies core's %a directive.
>
> I know I can use the connection ID (%L) to provide a marker for matching error log entries with access log entries, but just being able to see the client IP would be much more helpful.
>
> Here are my sanitised log entries, access log then error log. 333.444.555.666 is the client IP, coming through the proxy 192.168.1.100.
>
> J69TyXBo7cc vhost.local 333.444.555.666 - - 2024-10-19_10:10:09 "GET /favicon.ico HTTP/1.1" 404 266 https://referer.local "Firefox/131.0"
>
> J69TyXBo7cc vhost.local 192.168.1.100:39838 2024-10-19 10:10:09.766591 info 15282 core core.c(4920):] [AH00128: File does not exist: /path/to/favicon.ico
>
> ...and my log formats:
>
> LogFormat "%L %v %a %l %u %{%F_%T}t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" log_vhost
>
> ErrorLogFormat "%-L %-v %-a %-{cu}t %-l %-P %-m %-F: %-E %-M"
>
> Is there something I'm doing incorrectly or does mod_remoteip not actually work for ErrorLogFormat's %a specifier?
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
What is your "RemoteIpHeader" setting? You have to specify it for mod_remoteip to work.
Have you made sure you are getting that header from the front-end with the correct client ip?
---
Daniel
Help at #httpd in Libera.chat
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org