Re: mod_remoteip and ErrorLogFormat

On 19/10/24 11:50, Gretton, Liam wrote:
> httpd 2.4.57-11 on Rocky 9 here.
>
> I've been trying to get ErrorLogFormat to log the client IP address rather than that of my proxy's, but it doesn't seem to work. For LogFormat it is working as expected.
>
> My suspicion is that mod_remoteip doesn't actually modify core's %a format string, yet the documentation for ErrorLogFormat specifically mentions it:
>
> https://httpd.apache.org/docs/2.4/mod/core.html#errorlogformat
>
> %{c}a 	Underlying peer IP address and port of the connection (see the mod_remoteip module)
>
> mod_remoteip's documentation also states that it modifies core's %a directive.
>
> I know I can use the connection ID (%L) to provide a marker for matching error log entries with access log entries, but just being able to see the client IP would be much more helpful.
>
> Here are my sanitised log entries, access log then error log. 333.444.555.666 is the client IP, coming through the proxy 192.168.1.100.
>
> J69TyXBo7cc vhost.local 333.444.555.666 - - 2024-10-19_10:10:09 "GET /favicon.ico HTTP/1.1" 404 266 https://referer.local "Firefox/131.0"
>
> J69TyXBo7cc vhost.local 192.168.1.100:39838 2024-10-19 10:10:09.766591 info 15282 core core.c(4920):] [AH00128: File does not exist: /path/to/favicon.ico
>
> ...and my log formats:
>
> LogFormat "%L %v %a %l %u %{%F_%T}t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" log_vhost
>
> ErrorLogFormat "%-L %-v %-a %-{cu}t %-l %-P %-m %-F: %-E %-M"
>
> Is there something I'm doing incorrectly or does mod_remoteip not actually work for ErrorLogFormat's %a specifier?
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
What is your "RemoteIpHeader" setting? You have to specify it for mod_remoteip to work.

Have you made sure you are getting that header from the front-end with the correct client ip?

---
Daniel
Help at #httpd in Libera.chat