Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have five servers running Ubuntu (LAMP). One of them (called Server1) receves all incomming requests from the internet, and uses VirtualHosts and mod_proxy to deliver the correct request to the correct server on the LAN.

My problem is that in all the logs on my backend servers, all requests are logged as incomming from Server1's IP.

Why is this, and how do I fix it?

share|improve this question

1 Answer 1

This is why the good people at Squid invented X-Forwarded-For.

On your proxying servers, the header should be added to requests already; mod_proxy takes care of this.

On the backend server, modify your existing logging configuration to remove the remote host (%h) and add the contents of that header (%{X-Forwarded-For}i). For instance:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
CustomLog logs/access_log common_forwarded
share|improve this answer
1  
Just remember that X-Forwarded-For can contain multiple IP addresses, so you may find the log has multiple entries (if the client has already had the request proxied somewhere en route for example). –  EightBitTony May 17 '12 at 21:44
1  
@EightBitTony Yup, thanks for mentioning that. If that's a problem (breaking a log parsing tool, for instance), it's nothing that RequestHeader unset X-Forwarded-For can't fix, dropping the data sent by the en route proxy. –  Shane Madden May 17 '12 at 22:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.