Forum Discussion

MK_62657's avatar
MK_62657
Icon for Nimbostratus rankNimbostratus
Feb 13, 2008

XforwardedFor not working properly for IBM HTTP Server/Apache

Hello:

 

 

Anyone load balancing IBM_HTTP_SERVER/1.3.26.2 (Apache/1.3.26) and using the X-Forwarded-For option to obtain the source IP information?

 

 

I set it up as per the article SOL4816. Enabled the X-Forwarded-For option in the profile, used the iRule and added the following lines to the httpd.conf file as noted in the article.

 

 

LogFormat "%v %{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" X-Forwarded-For

 

CustomLog /usr/HTTPServer/logs/access_log X-Forwarded-For

 

 

The problem is it is getting the source IP but not in the correct location. Following is the output from the access_log.

 

 

10.100.7.220 - - [31/Jan/2008:16:28:50 -0800] "GET /local/resources/file/eb00be45c628e36/scripts.js HTTP/1.1" 304 0

 

sampleapp.domain 10.41.200.31 - - [31/Jan/2008:16:28:50 -0800] "GET /local/resources/file/eb00be45c628e36/scripts.js HTTP/1.1" 304 0

 

 

In this 10.41.200.31 is my source IP which I expect to be listed as the first field. However it the first filed comes out as the IP of the F5 appliance 10.100.7.220 and the source IP is inserted somewhere in the middle. Is there anyway to bring it to the first filed so taht the log is useful to run reports?

 

 

Thanks

 

MK

 

application delivery
dev
devops
iRules
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 13, 2008
    Hi,

     

     

    The second line looks like it matches the LogFormat directive you've posted per the apache doc for mod_log_config (Click here). I'm not sure how you're getting the first line though.

     

     

    If you take a look at the apache doc you can find the definitions for the abbreviations. The first field is the canonical name of the web server, followed by the value of the x-forwarded-for header value, the remote logname, etc. If you want the XFF header value logged first, you should be able to move the %{X-Forwarded-For} to the beginning of the field list.

     

     

    Can you give this a shot?

     

     

    Aaron