1

I am trying to record the a client ip stored in the X-Forwarded-For http header in the Apache access logs but having no luck and have been pulling my hair out for hours. I've tried a ton of different things - nothing seems to work!

First I tried:

# Fields to record
LogFormat "(%{X-Forwarded-For}i) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

# Log locations
CustomLog "/var/log/httpd/access.log" combined env=!dontlog

I also tried

# Fields to record
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

# Log locations
CustomLog "/var/log/httpd/access.log" combined env=!dontlog

I also tried:

RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 192.168.1.10


# Fields to record
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

# Log locations
CustomLog "/var/log/httpd/access.log" combined env=!dontlog

This is on CentOS8

httpd -v
Server version: Apache/2.4.37 (centos)
Server built:   Sep 15 2020 15:41:16

Remote IP module is installed and I assume enabled?

 httpd -M | grep remoteip
 remoteip_module (shared)

I know the X-Forwarded-For header is being sent because I did a tcpdump:

    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
    Connection: keep-alive
    Cookie: _fbp=fb.1.1599523605116.597747458; __qca=P0-681804816-1599523605211; _ga=GA1.2.489007183.1600273387; _gid=GA1.2.315615129.1604091772; LB=1460283402.20480.0000; _dc_gtm_UA-34638206-1=1; _gat_UA-34638206-1=1
    Upgrade-Insecure-Requests: 1
    Pragma: no-cache
    Cache-Control: no-cache
    X-Forwarded-For: 69.165.232.76
    X-Forwarded-Proto: http

Case/spelling is identical to what I've put in my conf. So why do I keep getting the load balancers IP instead of the actual client IP?

I know I'm editing the right file because if I break the file by putting gibberish in it apache won't load.

I'm at my wits end. Someone please help :)

4
  • 2
    The “combined” name is probably defined somewhere else too, what happens when you use a different name for your custom log format ?
    – Bob
    Oct 30, 2020 at 21:33
  • That sort of helped. Requests from external IPs now show up properly in the log, However requests from Internal IPs still show the load balancer IP instead of the actual internal source ip.
    – Brad
    Oct 30, 2020 at 21:40
  • Actually I got it working. The key was to use a different name instead of combined and also I used %{X-Forwarded-For}i instead of %a. @HermanB if you want to propose that as the answer I'll give you credit :)
    – Brad
    Oct 30, 2020 at 21:45
  • Thank you so much! I was pulling my hair out!
    – Brad
    Oct 30, 2020 at 21:48

1 Answer 1

0

For the benefit of others here's what worked for us:

 # Fields to record - use X-Forward-For instead of client IP so that we get the actual clients IP
 LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" mycustom

 # Log locations
 CustomLog "/var/log/httpd/access.log" mycustom env=!dontlog
 ErrorLog "/var/log/httpd/error.log"

The key as mentioned in the comments above:

  • You can't use combined as its either reserved or used elsewhere in the apache config

  • You need to use %{X-Forwarded-For}i NOT %a or %h

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .