Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address.

I would appreciate if someone can help.

The following is an example of logfile where mod_security is logging instead of clients ip address.

2012/08/29 14:18:13 [info] 206862#0: [client] ModSecurity: Access denied with code 403 (phase 2). Pattern match ...

share|improve this question

At least with Apache, issues can occur with redirects/rewrites to a vhost served by the same server such that logs report a foreign request arrived from localhost. Perhaps there is something similar going on in this situation. In the case where this bad logging behavior was observed, a server configuration change was possible that corrected the issue. It involved some restructuring of the server configuration. Possibly this was related to a site defined in httpd.conf that was then moved down into a vhost .conf, but unfortunately, that situation arose and was resolved without capturing the essence of the changes. Could this, or something similar, be a factor in your situation?

share|improve this answer
up vote 0 down vote accepted

@kbulgrien: Not really, because NGINX is capturing its own logs correctly.

I had to do a work-around for this issue. I created a RequestDeny block where I forwarded requests which were 403 denied by mod_security. In this block I formated the logs the way I wanted, that way it was easy for me to capture the ip address of the rejected request.

I know it is better to have mod_security write its logs correctly, but when you dont know a better way to do it may help and so it did for me :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.