X-Forwarded-For (XFF) for apache logs?

Avatar
Greg Schuler
I've seen reference to the X-Forwarded-For field being supported for IIS.
Do you also support this for Apache logs?
I've tried to use this as a custom log format:

%t %h [XFF: %{X-Forwarded-For}i] %{HOST}i \"%r\" %>s %b %Ts \"%{Referer}i\" \"%{User-Agent}i\"

..and it doesn't seem to parse out the client IP address correctly. Nor does it report on client browser type.
Replies 4
Avatar
0
Michael
The X-Forwarded-For field is supported in Apache logs too.

Could you send a sample log from your site to us at support@weblogexpert.com so we'll check what configuration can be used with the log format?
Avatar
0
Michael
I have received the sample, thank you. The problem with the IP occurs because the field the XFF: string, as the program expects only header value to be logged. You can replace the [XFF: %{X-Forwarded-For}i] field in log format settings in your web server with value [%{X-Forwarded-For}i] or \"%{X-Forwarded-For}i\" to fix the issue. Unfortunately it's not possible to fix it by changing settings in WebLog Expert.

I have also got correct browser statistics when analyzing the logs, maybe you analyzed a different log or with different settings when you got no statistics on browsers, you should recheck it.
Avatar
0
Greg Schuler
So you are saying in order for WebLog Expert to parse my logs that if my current apache log format configuration string looks like this:

LogFormat "%t %h [XFF: %{X-Forwarded-For}i] %{HOST}i \"%r\" %>s %b %Ts \"%{Referer}i\" \"%{User-Agent}i\""

...that I need to change it to look like this:

LogFormat "%t %h [%{X-Forwarded-For}i] %{HOST}i \"%r\" %>s %b %Ts \"%{Referer}i\" \"%{User-Agent}i\""

?
Avatar
0
Michael
It is better to change it to the following format (with quotes as delimiters for the X-Forwarded-For field):

LogFormat "%t %h \"%{X-Forwarded-For}i\" %{HOST}i \"%r\" %>s %b %Ts \"%{Referer}i\" \"%{User-Agent}i\""