When an Apache web server is placed behind a load balancer, Apache may record the load balancer\u2019s IP address instead of the actual client IP address in the access logs. This can make troubleshooting, monitoring, and security analysis difficult.<\/p>\n\n\n\n
This guide explains how to configure Apache 2.4 to log the original client IP address<\/strong> received through the Before starting, ensure you have:<\/p>\n\n\n\n By default, apache logs the IP address where the request comes from. Consider a scenario where webserver(in our post, we deals with apache) behind load balancer either EC2 load balancer or haproxy load balancer,etc., where the request will come to load balancer and loadbalancer transfer the request to webserver.<\/p>\n If you view the apache access log, we will be only seeing private IP address of a loadbalancer something similar below.<\/p>\n 172.31.xx.xx – – [04\/Jan\/2017:13:35:00 +0000] “GET \/ HTTP\/1.1” 301 588 “-” “Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36” \u00a0<\/p>\n It will be hard to find out where the origin IP address comes from incase if the logs has private IP address. Here comes the post explain on how to log remote IP address on access.log<\/em><\/p>\n In a webserver, we may have a single domain or multiple domains. You can use the same procedure incase if \u00a0we want to enable custom log for each domains.<\/p>\n Lets find how many\u00a0LogFormat\u00a0<\/em>available on your webserver.<\/p>\n LogFormat “%v:%p %h %l %u %t \\”%r\\” %>s %O \\”%{Referer}i\\” \\”%{User-Agent}i\\”” vhost_combined<\/span> In the above output, the highlighted are various format logs available that we can use.<\/p>\n Now, we have to findout which logformat the domain is using. We assumes that the domain configuration\u00a0\/etc\/apache2\/sites-enabled\/000-default.conf.<\/em><\/p>\n CustomLog ${APACHE_LOG_DIR}\/access.log combined<\/span><\/p>\n<\/blockquote>\n In the above example,\u00a0combined\u00a0<\/em> log is used. So, in the\u00a0access.log\u00a0<\/strong>file will be in format of\u00a0“%h %l %u %t \\”%r\\” %>s %O \\”%{Referer}i\\” \\”%{User-Agent}i\\”” as mentioned above.<\/p>\n Now, we are going to create a new logformat and add it for domain configuration. Open the file \/etc\/apache2\/apache2.conf\u00a0<\/em>and append the following line on the\u00a0Logformat\u00a0<\/em>section<\/p>\n LogFormat “%{X-Forwarded-For}i %h %l %u %t \\”%r\\” %s %b \\”%{Referer}i\\” \\”%{User-agent}i\\”” combined-forwarded<\/span><\/p>\n<\/blockquote>\n Note down the variable(combined-forwarded) that you are using while setting up new logformat. We will be using this variable while setting up custom log.<\/p>\n %{X-Forwarded-For} – This is a\u00a0custom HTTP request header was developed by the squid development team, the X-Forwarded-For header\u00a0read the IP address and pass it along upstream in the http request.<\/p>\n Open the domain configuration and modify the custom log section to use newly created logformat.<\/p>\nX-Forwarded-For<\/code> HTTP header, along with the load balancer IP address.<\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
X-Forwarded-For<\/code> header.<\/li>\n\n\n\nIMPLEMENTATION<\/h2>\n\n\n
\n
172.31.xx.xx – – [04\/Jan\/2017:13:35:00 +0000] “GET \/ HTTP\/1.1” 301 588 “-” “Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36”<\/p>\n
\nAssumption:<\/strong><\/h5>\n
\n
Implementation:<\/h5>\n
grep LogFormat \/etc\/apache2\/apache2.conf<\/code><\/p>\n\n
LogFormat “%h %l %u %t \\”%r\\” %>s %O \\”%{Referer}i\\” \\”%{User-Agent}i\\”” combined<\/span>
LogFormat “%h %l %u %t \\”%r\\” %>s %O” common<\/span>
LogFormat “%{Referer}i -> %U” referer<\/span>
LogFormat “%{User-agent}i” agent<\/span><\/p>\n<\/blockquote>\ngrep CustomLog \/etc\/apache2\/sites-enabled\/000-default.conf<\/code><\/p>\n\n
vi \/etc\/apache2\/apache2.conf<\/code><\/p>\n\n