Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm logging x-forwarded-for with the %{X-FORWARDED-FOR}i formatter. However, there are times when the X-Forwarded-For header is getting CSV'd (based on a client's setup):

X-Forwarded-For: 66.66.66.66, 123.123.123.123

Which shows up in the log file as the above CSV'd IP's.

Is there any way to configure Apache so that I'm only logging the left-most IP address? It's the only one I ever care about.

share|improve this question

1 Answer 1

Yes. You can do it using a regex to extract the left-most IP:

SetEnvIf X-Forwarded-For "^(\d{1,3}+\.\d{1,3}+\.\d{1,3}+\.\d{1,3}+).*" XFFCLIENTIP=$1

Note the use of $1 to set the XFFCLIENTIP environment variable to hold the contents of the first group in the regex (in the parentheses) Then you can define a log format that uses the variable: this example is one we use internally at nearmap.com, so it logs extra information, but the bit you want is the %{XFFCLIENTIP}e at the beginning. Note the env=XFFCLIENTIP at the end of the line, which means this format is only used if the environment variable is set.

CustomLog /var/log/apache2/access.log "%{XFFCLIENTIP}e \"%{session}C\" \"%{nearmapuid}C\" %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" env=XFFCLIENTIP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.