I'm trying to get to investigate some weird traffic hitting my Apache web server but the traffic isn't being logged at all by the server. On the firewall that sits between the server and the internet, I am seeing packets coming and going to the web server. What has me scratching my head is that I've searched every httpd log and I'm not finding the incoming request. The request is coming in on port 80 and what I'm expecting to happen once Apache receives it is to bump the request to https (I have a log set to record this traffic). I'm also usually expecting to then see it in logs for the specific vhosts but not surprised because the first logger didn't show anything. The other thing that I've noticed is that all the incoming requests are from really low port numbers (<500).
3 Answers
Unless you specify the debug or trace[1-8] level in Apache httpd with the LogLevel directive, the server will almost exclusively log HTTP protocol requests (and some start-up messages and of course errors) but nothing that happens at the lower levels.
On the default LogLevel httpd will not log every TCP connection, (telnet to port 80 and close the connection after it is established and nothing will be logged) also nothing from the SSL/TLS handshake(s) gets logged by default (an exhaustive check by SSL Labs will usually only result in a handful of log events) etc. etc.
Online servers are continuously scanned/probed/attacked so unless those probes actually try to speak HTTP (i.e. the usual suspects such as the GET /wp-login.php request) very little, if anything gets logged by Apache httpd.
What do you have in this section of your virtual host configurations?
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
LogLevel info
LogLevel info ssl:warn #(ssl.conf)
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
See if those are enabled and then try forcing more information by changing info or warn to one of the more verbose levels.
Which OS/Distro are you using? What does the server's firewall see?
You can use mod_forensics if you need excessive logging on your server, but it's not recommended on production server.
