Apache: Log the original client IP when your site sits behind a reverse proxy

Posted . Visible to the public.

When your site is mapped into the URL-space of another server using mod_proxy, ProxyPass and ProxyPassReverse, all requests in your Apache logs are logged with the IP address of the proxying server. The IP address of the original client doing the request is not logged, making it difficult to trace problems and run statistics.

Short answer

There is no easy way to fix this. Use the log of the proxying server instead, which logs the original client IPs you're looking for.

Long answer

You can fix this for your access log, but not for your error log.

The proxying server adds a header X-Forwarded-For to every request. It includes the original client IP. You can include that header in your access log by using a custom log format:

# This is untested code:
LogFormat "%h (%{X-Forwarded-For}i) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_forwarded_for
CustomLog /var/www/project/log/access.log combined_with_forwarded_for

You cannot define a custom log format for your error log.

Henning Koch
Last edit
License
Source code in this card is licensed under the MIT License.
Posted by Henning Koch to makandra dev (2011-01-03 15:58)