3

I need to modify the LogFormat in Apache in order to add the X-Forwarded-For header and log clients' real IPs. I attempted to edit that in httpd.conf file but I then found two separate parts for the LogFormat. So I'm not sure if they are duplicate, whether should I remove any of them or not, and I don't know which of them to edit, or should I edit them all. I need some advice for this.

Here is the first part:

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    CustomLog "logs/access_log" common

    <IfModule logio_module>
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

    </IfModule>

</IfModule>

The second part:

<IfModule mod_log_config.c>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    LogFormat "%{Referer}i -> %U" referer
    LogFormat "%{User-agent}i" agent

    CustomLog logs/access_log common

</IfModule>

I don't know what is the difference between first and second part. I can see two lines are duplicate in the two parts. So, which part should I edit? Is it safe to remove the duplicate lines from one part and keep the other? Can I combine non-duplicated lines in one part? Thank you.

| improve this question | | | | |
2

The IfModule directive is to take the configuration only if the module was loaded. To check which modules are loaded you can use

  • httpd -M -f path-to-config-file using linux
  • and httpd -t -D DUMP_MODULES using windows

Example

[root@apachesrv bin]# httpd -M -f conf/httpd-vserver.conf
Loaded Modules:
 core_module (static)
 ...
 log_config_module (shared)
 ...
 proxy_http_module (shared)
 schema_module (shared)
Syntax OK

In this case you can see I am using the log_config_module so it will take (on my case) the config

<IfModule log_config_module>
  LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
  LogFormat "%h %l %u %t \"%r\" %>s %b" common

  CustomLog "logs/access_log" common

  <IfModule logio_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio    
  </IfModule>    
</IfModule>

In order to catch the information you need you need to configure a log with something like:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Forwarded-For}i\"" combinedcustomized

And then change your access log to:

CustomLog logs/access.log combinedcustomized

EDIT:

On the apache doc you have the list of available parameters to log http://httpd.apache.org/docs/2.4/mod/mod_log_config.html

| improve this answer | | | | |
  • Under windows you can use httpd -t -D DUMP_MODULES to list all loaded moduels. – surfmuggle Nov 1 '19 at 20:37
0

According to apache docs both sections are equivalent:

Description:    Logging of the requests made to the server
Status: Base
Module Identifier:  log_config_module
Source File:    mod_log_config.c

Remove (or comment out) the one you don't feel like you'll be using otherwise you'll be having all sorts of headaches later if for some reason you'll change their order (thus priority).

| improve this answer | | | | |
0

On my centos 7.4 i only have the

<IfModule log_config_module>

directive in httpd.conf and the log_config_module is loaded through the /etc/httpd/conf.modules.d/00-base.conf config file

I only changed this line to make it work. (but you will change the log format because of a new row for client ip)

LogFormat "%h %{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

There is a more "elegant" way to do do it (by replacing the proxy ip with client ip if the x-forwarded-for field is present) but i cannot get it to work (only the proxy ip is showed)

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combied
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
CustomLog "logs/access_log" combined env=!forwarded
CustomLog "logs/access_log" proxy env=forwarded
| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.