Forum Discussion
MK_62657
Nimbostratus
NimbostratusXforwardedFor not working properly for IBM HTTP Server/Apache
Hello:
Anyone load balancing IBM_HTTP_SERVER/1.3.26.2 (Apache/1.3.26) and using the X-Forwarded-For option to obtain the source IP information?
I set it up as per the article SOL4816. Enabled the X-Forwarded-For option in the profile, used the iRule and added the following lines to the httpd.conf file as noted in the article.
LogFormat "%v %{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" X-Forwarded-For
CustomLog /usr/HTTPServer/logs/access_log X-Forwarded-For
The problem is it is getting the source IP but not in the correct location. Following is the output from the access_log.
10.100.7.220 - - [31/Jan/2008:16:28:50 -0800] "GET /local/resources/file/eb00be45c628e36/scripts.js HTTP/1.1" 304 0
sampleapp.domain 10.41.200.31 - - [31/Jan/2008:16:28:50 -0800] "GET /local/resources/file/eb00be45c628e36/scripts.js HTTP/1.1" 304 0
In this 10.41.200.31 is my source IP which I expect to be listed as the first field. However it the first filed comes out as the IP of the F5 appliance 10.100.7.220 and the source IP is inserted somewhere in the middle. Is there anyway to bring it to the first filed so taht the log is useful to run reports?
Thanks
MK
1 Reply
hoolioCirrostratus
Hi,
The second line looks like it matches the LogFormat directive you've posted per the apache doc for mod_log_config (Click here). I'm not sure how you're getting the first line though.
If you take a look at the apache doc you can find the definitions for the abbreviations. The first field is the canonical name of the web server, followed by the value of the x-forwarded-for header value, the remote logname, etc. If you want the XFF header value logged first, you should be able to move the %{X-Forwarded-For} to the beginning of the field list.
Can you give this a shot?
Aaron
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
