On 9/09/20 1:15 am, piyush.gaba wrote:
> Hi Matus,
>
> Thank you for your reply.
>
> I think my whole struggle is to get the desired output as:
> <ip>- - [17/Aug/2018:08:43:29 +0200] "GET /index1.html HTTP/1.1" 200 36 "-"
> "curl/7.29.0" unknown
>
> Which has "unknown" at the end because forwarded_for was set to "off".
>
> But now when I am working with squid 4.13 I am not getting the desired
> output, I am getting the output as,
> <ip> - - [08/Sep/2020:15:07:19 +0200] "GET /index1.html HTTP/1.1" 200 8 "-"
> "curl/7.29.0"
>
> Which does not have anything at the end, while the forwarded_for is set to
> "off".
>
> Please let me know if you have any advice to give for this logging problem.
>
> I am using below log format in my httpd file,
> LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\"
> \"%{User-Agent}i\"" combined
>
That LogFormat tells us the first column of the log file is the contents
of the X-Forwarded-For header. The first column of the log lines you
showed is "<ip>" - the value of XFF header is supposed to be one or more
IPs, so that looks like it is working.
Use the debug_options setting I gave you to *actually* see what is
happening. The Apache log is only showing you what values are _after_
the httpd process and all modules have done their modifications to the
HTTP input ... including replacing the transaction client-IP with any
value from XFF header.
Amos
_______________________________________________
squid-users mailing list
[email protected]
http://lists.squid-cache.org/listinfo/squid-users
