0

I'm logging x-forwarded-for with the %{X-FORWARDED-FOR}i formatter. However, there are times when the X-Forwarded-For header is getting CSV'd (based on a client's setup):

X-Forwarded-For: 66.66.66.66, 123.123.123.123

Which shows up in the log file as the above CSV'd IP's.

Is there any way to configure Apache so that I'm only logging the left-most IP address? It's the only one I ever care about.

1 Answer 1

1

Yes. You can do it using a regex to extract the left-most IP:

SetEnvIf X-Forwarded-For "^(\d{1,3}+\.\d{1,3}+\.\d{1,3}+\.\d{1,3}+).*" XFFCLIENTIP=$1

Note the use of $1 to set the XFFCLIENTIP environment variable to hold the contents of the first group in the regex (in the parentheses) Then you can define a log format that uses the variable: this example is one we use internally at nearmap.com, so it logs extra information, but the bit you want is the %{XFFCLIENTIP}e at the beginning. Note the env=XFFCLIENTIP at the end of the line, which means this format is only used if the environment variable is set.

CustomLog /var/log/apache2/access.log "%{XFFCLIENTIP}e \"%{session}C\" \"%{nearmapuid}C\" %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" env=XFFCLIENTIP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .