Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SOAP web service I am providing on a apache web server. There are 6 different clients (IPs) that request data and 3 of them are hitting the wrong domain. I am trying to find a way to log which domain name the requests are coming from.


ServerA is the primary

ServerB is the backup - the domain the web service is on - a seperate domain that server seperate content on ServerB

ServerA is standalone for now with its own IP and DNS from This works for everyone.

ServerB is a backup for the web service, but it already hosts

I added entries into the apache configuration file like:

<VirtualHost *:443>


DocumentRoot /var/www/html/

CustomLog logs/access_log_domain2443 common
ErrorLog logs/ssl_error_log_domain2443
LogLevel debug

SSLEngine on

... etc SSL directives ...


I have these for both 80 and 443 for domain1 and domain2 with domain1 being second.

The problem is when we switch DNS for domain1 from ServerA to ServerB, 3 out of the 6 clients show up in the debug logs as hitting instead of and fail their web service request because is first in the apache configuration file and catching all requests that don't match other virtualhosts, namely

I don't know if they are hitting, (although I added entries for both) or using the external IP address or something else. Is there a way to see which URL they are hitting not just the page request or someother way to see why the first domain is catching traffic meant for the second listed domain?

In the meantime, I've put higher in the apache configuration than Now it catches the requests for all clients and works, however I don't know what it is catching and would like to make the first entry again with a correct entry for, for however they are hitting it.

Thank you for your help! Andrew

share|improve this question
Are the clients using Windows XP with IE? That won't support SNI. – gparent Dec 5 '12 at 23:04
This is very possible @gparent I didn't realize what you were saying until I ran into the answer I linked below. Thank you! – apuschak Apr 1 '13 at 19:36

Did you check your apache access.log, Try this to get more detailed log:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
CustomLog log/access_log combined

For more details : Hope it helped you

share|improve this answer
Thank you, sorry this has been a while but I couldn't get it to work and now the issue has come up again. I did try the custom logging and thought I didn't set it up right. I just tried the specific CustomLog logs/referer_log "%{Referer}i -> %U" and I get: - -> /somephp.php The requested URL is missing. Even if I just hit the URL myself, I get the request for favicon.ico in the log but no URL just dashes. Does anyone know why this would be missing on a CentOS server with apache? Thanks! – apuschak Apr 1 '13 at 14:32
I've gotten it to work with CustomLog logs/443host_log "%{Host}i" which is not on the apache logs documentation page. It gives me the URL the xml web services are hitting, which are all the same and match my ServerName. So it still doesn't explain why the service works when this domain is first and doesn't work when the domain is second in the configuration. – apuschak Apr 1 '13 at 18:28
Still poking around, I find SNI a possibility.… looking at @Michael-Hampton's answer. Its very possible 3 clients are running older systems that do not support it, such as Windows XP and that explains why they hit the first domain but other clients get to the correct domain with the VirtualHost. I'll leave it at this for now and try to think of a way to test if this is the case. – apuschak Apr 1 '13 at 19:14
Huh? I have nothing to do with this answer. – Michael Hampton Apr 1 '13 at 19:17
referencing your answer about Server Name Indication on the question… since it may be related. – apuschak Apr 1 '13 at 19:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.