Ryfujk

How to properly claim credit for peer review?

When should a commit not be version tagged?

How can I be pwned if I'm not registered on that site?

Skis versus snow shoes - when to choose which for travelling the backcountry?

Whom do I have to contact for a ticket refund in case of denied boarding (in the EU)?

Can chords be played on the flute?

Are small insurances worth it

Why do members of Congress in committee hearings ask witnesses the same question multiple times?

If a druid in Wild Shape swallows a creature whole, then turns back to her normal form, what happens?

Replacement ford fiesta radiator has extra hose

How do I construct an nxn matrix?

Where was Karl Mordo in Infinity War?

Why does the 31P{1H} NMR spectrum of cis-[Mo(CO)2(dppe)2] show two signals?

It took me a lot of time to make this, pls like. (YouTube Comments #1)

I encountered my boss during an on-site interview at another company. Should I bring it up when seeing him next time?

I can't die. Who am I?

Understanding Kramnik's play in game 1 of Candidates 2018

What can I substitute for soda pop in a sweet pork recipe?

How to mitigate "bandwagon attacking" from players?

How do ISS astronauts "get their stripes"?

Pure Functions: Does "No Side Effects" Imply "Always Same Output, Given Same Input"?

How can I handle a player who pre-plans arguments about my rulings on RAW?

Sometimes a banana is just a banana

What am I? I am in theaters and computer programs

Configuring varnish to write an apache error log with IP addresses

Setting up monit to work with Varnish and nginxTidying up old apache logs managed by vloggerVarnish POST problem “9 FetchError c backend write error: 11” for application/x-www-form-urlencoded contentMod_pagespeed, Varnish and Apache cache issues after new code pushesfail2ban doesn't process jail even though regex matchesWeird varnish log output before crashingApache2 server (behind Zyxel USG 100 NAT/Firewall) with vhost does not log real clients ip addressesWeb server atack DDOSFail2Ban emails not showing extracts from Apache logfilesnginx - Is this a bad bot?

1

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs.

One of the problems I have is that all of the refernces to IP addresses in the log files are 127.0.0.1.

I solved this problem regarding the access.log by running the following command:

varnishncsa -a -w /var/log/varnish/access.log -D -P /var/run/varnishncsa.pid

Is it possible to do something similar for the logs that appear in: /var/log/apache/*_error.log?

Thanks

apache-2.2 ubuntu varnish fail2ban

share|improve this question

asked Dec 11 '14 at 15:37

richelliotrichelliot

1176

bumped to the homepage by Community♦ 1 hour ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

1

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs.

One of the problems I have is that all of the refernces to IP addresses in the log files are 127.0.0.1.

I solved this problem regarding the access.log by running the following command:

varnishncsa -a -w /var/log/varnish/access.log -D -P /var/run/varnishncsa.pid

Is it possible to do something similar for the logs that appear in: /var/log/apache/*_error.log?

Thanks

apache-2.2 ubuntu varnish fail2ban

share|improve this question

asked Dec 11 '14 at 15:37

richelliotrichelliot

1176

bumped to the homepage by Community♦ 1 hour ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs.

One of the problems I have is that all of the refernces to IP addresses in the log files are 127.0.0.1.

I solved this problem regarding the access.log by running the following command:

varnishncsa -a -w /var/log/varnish/access.log -D -P /var/run/varnishncsa.pid

Is it possible to do something similar for the logs that appear in: /var/log/apache/*_error.log?

Thanks

apache-2.2 ubuntu varnish fail2ban

share|improve this question

asked Dec 11 '14 at 15:37

richelliotrichelliot

1176

varnishncsa -a -w /var/log/varnish/access.log -D -P /var/run/varnishncsa.pid

share|improve this question

asked Dec 11 '14 at 15:37

richelliotrichelliot

1176

share|improve this question

asked Dec 11 '14 at 15:37

richelliotrichelliot

1176

asked Dec 11 '14 at 15:37

richelliotrichelliot

1176

asked Dec 11 '14 at 15:37

richelliotrichelliot

1176

1 Answer
1

active

oldest

votes

0

Add the following in to your /etc/varnish/default.vcl

sub vcl_recv {

  remove req.http.X-Forwarded-For;

  set req.http.X-Forwarded-For = client.ip;

}

Update your apache configuration to change your CustomLog to the following:

LogFormat "%{X-Forwarded-For}i %l %u %t "%r" %>s %b" varnishcombined

CustomLog /var/log/example.com-access_log varnishcombined

For more information, check this page: http://www.techinfobest.com/getting-real-client-ip-through-varnish/

share|improve this answer

edited Oct 23 '15 at 13:01

Eirik H

11519

answered Dec 12 '14 at 4:54

fukawi2fukawi2

4,38731745

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This enables IP logging for the apache access logs. I already have this part working. I need the apache ERROR logs to record the IP address. Can the solution you provided be tweaked so it works with the error logs?
  
  – richelliot
  Dec 12 '14 at 10:42
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Richelliot I don't believe so, unless you're running Apache 2.4 which has the ErrorLogFormat directive.
  
  – fukawi2
  Dec 12 '14 at 21:39
  
  
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f651908%2fconfiguring-varnish-to-write-an-apache-error-log-with-ip-addresses%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

0

Add the following in to your /etc/varnish/default.vcl

sub vcl_recv {

  remove req.http.X-Forwarded-For;

  set req.http.X-Forwarded-For = client.ip;

}

Update your apache configuration to change your CustomLog to the following:

LogFormat "%{X-Forwarded-For}i %l %u %t "%r" %>s %b" varnishcombined

CustomLog /var/log/example.com-access_log varnishcombined

For more information, check this page: http://www.techinfobest.com/getting-real-client-ip-through-varnish/

share|improve this answer

edited Oct 23 '15 at 13:01

Eirik H

11519

answered Dec 12 '14 at 4:54

fukawi2fukawi2

4,38731745

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This enables IP logging for the apache access logs. I already have this part working. I need the apache ERROR logs to record the IP address. Can the solution you provided be tweaked so it works with the error logs?
  
  – richelliot
  Dec 12 '14 at 10:42
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Richelliot I don't believe so, unless you're running Apache 2.4 which has the ErrorLogFormat directive.
  
  – fukawi2
  Dec 12 '14 at 21:39
  
  
  

  
  
  
  

add a comment | 

0

Add the following in to your /etc/varnish/default.vcl

sub vcl_recv {

  remove req.http.X-Forwarded-For;

  set req.http.X-Forwarded-For = client.ip;

}

Update your apache configuration to change your CustomLog to the following:

LogFormat "%{X-Forwarded-For}i %l %u %t "%r" %>s %b" varnishcombined

CustomLog /var/log/example.com-access_log varnishcombined

For more information, check this page: http://www.techinfobest.com/getting-real-client-ip-through-varnish/

share|improve this answer

edited Oct 23 '15 at 13:01

Eirik H

11519

answered Dec 12 '14 at 4:54

fukawi2fukawi2

4,38731745

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This enables IP logging for the apache access logs. I already have this part working. I need the apache ERROR logs to record the IP address. Can the solution you provided be tweaked so it works with the error logs?
  
  – richelliot
  Dec 12 '14 at 10:42
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Richelliot I don't believe so, unless you're running Apache 2.4 which has the ErrorLogFormat directive.
  
  – fukawi2
  Dec 12 '14 at 21:39
  
  
  

  
  
  
  

add a comment | 

Add the following in to your /etc/varnish/default.vcl

sub vcl_recv {

  remove req.http.X-Forwarded-For;

  set req.http.X-Forwarded-For = client.ip;

}

Update your apache configuration to change your CustomLog to the following:

LogFormat "%{X-Forwarded-For}i %l %u %t "%r" %>s %b" varnishcombined

CustomLog /var/log/example.com-access_log varnishcombined

For more information, check this page: http://www.techinfobest.com/getting-real-client-ip-through-varnish/

share|improve this answer

edited Oct 23 '15 at 13:01

Eirik H

11519

answered Dec 12 '14 at 4:54

fukawi2fukawi2

4,38731745

sub vcl_recv {

  remove req.http.X-Forwarded-For;

  set req.http.X-Forwarded-For = client.ip;

}

LogFormat "%{X-Forwarded-For}i %l %u %t "%r" %>s %b" varnishcombined

CustomLog /var/log/example.com-access_log varnishcombined

share|improve this answer

edited Oct 23 '15 at 13:01

Eirik H

11519

answered Dec 12 '14 at 4:54

fukawi2fukawi2

4,38731745

edited Oct 23 '15 at 13:01

Eirik H

11519

edited Oct 23 '15 at 13:01

Eirik H

11519

answered Dec 12 '14 at 4:54

fukawi2fukawi2

4,38731745

answered Dec 12 '14 at 4:54

fukawi2fukawi2

4,38731745