On Fri, Nov 26, 2010 at 01:39, Andrej van der Zee
<andrejvander...@gmail.com> wrote:
> Hi,
>
> I am looking for a way to deduct the concept of a "transaction" from
> the Apache log. What I mean is that I want to group HTTP requests that
> are sent by one particular client, for example when a user clicks a
> link in the browser. Then I want to be able to group all the HTTP
> requests that are the result of that one click (only taking account
> for requests that are going to our servers).
>
> Assuming that both client and server have the KeepAlive enabled, I
> though that maybe a custom Apache log-module could write the
> connection ID (if such a thing exists) to the log in order to
> distinguish different clients. Moreover, assuming that users wait for
> at least 1 second between clicks, I should be able to deduct
> transactions by grouping them on timestamps that fall within a second.
>
> The scheme with the connection ID, can it work, or am I misjudging
> something completely? Are there alternatives?
>
> Thank you,
> Andrej
>
request_rec->connection->id is a long int that is unique. It is built
from the process_id and thread_id of the apache thread that serves the
request. However, a client may open several connections to the server
during the same transaction, so I guess this does not help you much.
There's a module called unique_id. It creates a string that is stored
in the req->subprocess_env and can be logged with "%{UNIQUE_ID}e". It
encodes the request timestamp, the connection->id, the _server_ IP and
a random number. It does not encode the client IP or port. However, if
you combine it with the client-IP and client port that you can log as
well in the same log line, you could, probably, extract what you want
after some log-postprocessing.
Different clients behind a NAT router will use different ports.
However, based solely on ports, you won't be able to distinguish
between two different clients on one hand or one client that makes
several connections on the other hand. A method that is used by some
of my colleagues in order to distinguish between different clients
(but I don't know much about it, so I can't tell you more) is to
analyse the TCP header of the packet in order to extract the TCP
sequence numbers.
Sorin
