Read more

Apache: Log the original client IP when your site sits behind a reverse proxy

Henning Koch
January 03, 2011Software engineer at makandra GmbH

When your site is mapped into the URL-space of another server using mod_proxy, ProxyPass and ProxyPassReverse, all requests in your Apache logs are logged with the IP address of the proxying server. The IP address of the original client doing the request is not logged, making it difficult to trace problems and run statistics.

Short answer

Illustration UI/UX Design

UI/UX Design by makandra brand

We make sure that your target audience has the best possible experience with your digital product. You get:

  • Design tailored to your audience
  • Proven processes customized to your needs
  • An expert team of experienced designers
Read more Show archive.org snapshot

There is no easy way to fix this. Use the log of the proxying server instead, which logs the original client IPs you're looking for.

Long answer

You can fix this for your access log, but not for your error log.

The proxying server adds a header X-Forwarded-For to every request. It includes the original client IP. You can include that header in your access log by using a custom log format:

# This is untested code:
LogFormat "%h (%{X-Forwarded-For}i) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_forwarded_for
CustomLog /var/www/project/log/access.log combined_with_forwarded_for

You cannot define a custom log format for your error log.

Posted by Henning Koch to makandra dev (2011-01-03 16:58)