Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address.

I would appreciate if someone can help.

The following is an example of logfile where mod_security is logging 127.0.0.1 instead of clients ip address.

2012/08/29 14:18:13 [info] 206862#0: [client 127.0.0.1] ModSecurity: Access denied with code 403 (phase 2). Pattern match ...

share|improve this question

2 Answers 2

At least with Apache, issues can occur with redirects/rewrites to a vhost served by the same server such that logs report a foreign request arrived from localhost. Perhaps there is something similar going on in this situation. In the case where this bad logging behavior was observed, a server configuration change was possible that corrected the issue. It involved some restructuring of the server configuration. Possibly this was related to a site defined in httpd.conf that was then moved down into a vhost .conf, but unfortunately, that situation arose and was resolved without capturing the essence of the changes. Could this, or something similar, be a factor in your situation?

share|improve this answer
up vote 0 down vote accepted

@kbulgrien: Not really, because NGINX is capturing its own logs correctly.

I had to do a work-around for this issue. I created a RequestDeny block where I forwarded requests which were 403 denied by mod_security. In this block I formated the logs the way I wanted, that way it was easy for me to capture the ip address of the rejected request.

I know it is better to have mod_security write its logs correctly, but when you dont know a better way to do it may help and so it did for me :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.