Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to determine whether the server (Apache 2) is returning the full contents of a page along with its correct header or not. I have a PHP-script that is executed successfully, but the browser is getting only half of the html content, it's simply cut off.

The client infrastructure is pretty complicated, using Novell BorderManager Proxys and stuff. To ensure the server is doing its job fine I want to log both header and body of the reponse.

How can I achieve this? I looked into the mod_log_config module of apache (which is already installed and ready to be used), but honestly I didn't quite manage to configure it to output header and body somewhere.

edit: I managed to log the header with

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{HEADER_NAME}o\"" common2

CustomLog /var/log/apache2/response.log common2

But unfortunately the mod_log_config formats don't support the whole content body.

Update: I stumpled accross mod_dumpio which seems to do exactly that, but I can't get it to work so far :-(

Can anyone help?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

You can do this via mod_security: Keyword "audit logging": http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/07-logging.html

share|improve this answer
    
Thanks, but the documentation says "Available audit log parts: [...] G – RESERVED for the actual response body, not implemented yet." –  acme Dec 21 '10 at 11:30
    
You can use E or I because I linked an old doc. Newer is here: modsecurity.org/documentation/modsecurity-apache/2.5.12/… –  weeheavy Dec 21 '10 at 12:30
    
I added this to httpd.conf: SecAuditEngine On SecAuditLog /var/log/apache2/sec.log SecAuditLogParts ABEFGHZ. I get some debugging infos, so it seems to work, but the response body is not shown. –  acme Dec 21 '10 at 14:49
add comment

in case you do not get any response body in your logs when using "Intended Response Body (E)"; eg.:

SecAuditLogParts ABCEFHZ

Make sure you also have activated the rule engine:

SecRuleEngine On

and check your settings for:

SecRequestBodyAccess On
SecResponseBodyAccess On
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.