Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently logging the contents of the X-Forwarded-For header using a CustomLog declaration in Apache. The problem is that every proxy and load balancer along the request path will add its IP to this header, too. I need a way to intelligently pick out the true client IP from this header and log it with CustomLog.

Here's an example:

Let's say Joe User is browsing your site from his home and has a public IP of 1.2.3.4. Let's say that your site uses Akamai as a CDN with IP 2.3.4.5 and your origin servers are all load balanced behind a load balancer that has an IP of 3.4.5.6. If you log X-Forwarded-For to your logs, you'll end up with something like this:

X-Forwarded-For: 1.2.3.4, 2.3.4.5, 3.4.5.6

The first IP (1.2.3.4) is usually what you're interested in but I'm not sure how to extract it within the CustomLog format.

It gets even more difficult when a corporate proxy server is involved. You might end up with something like this:

192.168.12.4, 1.2.3.4, 2.3.4.5, 3.4.5.6

In this case, 1.2.3.4 is what you really want to log because 192.168.12.4 is just some private IP on some corporate LAN and tells you nothing about the true location of this visitor.

How can I extract this IP and log it with the rest of the stuff?

The only approach I can think of right now is to pipe all of this through a custom filter program that extracts the first IP (unless it's in a private subnet) and logs that.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.