XforwardedFor not working properly for IBM HTTP Server/Apache

Hi,

 

 

The second line looks like it matches the LogFormat directive you've posted per the apache doc for mod_log_config (Click here). I'm not sure how you're getting the first line though.

 

 

If you take a look at the apache doc you can find the definitions for the abbreviations. The first field is the canonical name of the web server, followed by the value of the x-forwarded-for header value, the remote logname, etc. If you want the XFF header value logged first, you should be able to move the %{X-Forwarded-For} to the beginning of the field list.

 

 

Can you give this a shot?

 

 

Aaron