X-Forwarded-For: Apache 1.2x

-----BEGIN PGP SIGNED MESSAGE-----

I'm trying to have our apache 1.2x server use the Squid default
"x-forwarded-for" information in our logging (i hate showing all our
customers coming from the proxy rather than their specific POP's).

Squid 1.1 pumps out the following header (according to the SQUID FAQ) and
i quote from the faq here:

- ----------
Squid adds its own request header called "X-Forwarded-For"
   which looks like this:

        X-Forwarded-For: 128.138.243.150, unknown, 192.52.106.30

   Entries are always IP addresses, or the word unknown if the address
   could not be determined or if it has been disabled with the
   forwarded_for configuration option.
- ----------
 
Ok, so it sounds more like an apache issue, i know i know. I figured one
of you guys already did this, so I'm asking. With Apache, did you modify
the source or did you just use a custom log entry like the following taken
from the Apache Archives:

       %{Header}o The contents of Header: header line(s) in the reply

so in this case it would be this line in the httpd.conf for apache:

customlog /log/log.txt %H{X-Forwarded-For}

My problem, is that, I really want to have apache do the following:

"If "X-Forwarded-For" present, then replace "from-client-host-ip" with
"X-Forwarded-For" for all logging routines".

Using my custom log above is not goign to cut it for me, because of our
external www log processing which needs to have just one loging of hte
client-ip, not one for hte "from" and one for the "X-Forwarded-For" to
sift through.

Anyone already solved this, or am I better to start hacking the source on
apache?

Adam Wills Global 2000 Communications
Director of Networking Systems 1840 Western Ave.
sysadmin@global2000.net Albany, NY, 12203
http://www.global2000.net (518) 452-1465

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNhJDkK7yaLQI4biZAQH01QP/a4nasaiweLvPDW5ObhXvMgfLxN0VYTib
ZEWrtMYV6wrA/2WAPhkmtMdoxoLl+QYut5qljDCxeiAyfize5w4cFD9aqBuphpj0
0t2xVd1n4GOfvxAR91ojYEl4s+sRSZ5uT9Cgg+6WZ7ra38xWTj5RhRgVHUq6VNYW
A/VQ7ThOiVg=
=HrIN
-----END PGP SIGNATURE-----
Received on Wed Sep 30 1998 - 07:44:57 MDT