title: AWStats and X-Forwarded-For link: https://onemoretech.wordpress.com/2013/03/25/awstats-and-x-forwarded-for/ author: phil2nc description: post_id: 4546 created: 2013/03/25 13:39:05 created_gmt: 2013/03/25 17:39:05 comment_status: closed post_name: awstats-and-x-forwarded-for status: publish post_type: post

AWStats and X-Forwarded-For

We just love our F5 BigIP LTM's. Problem is that whenever we put one in front of a web server logging incoming clients gets complicated. But there's always a way. Did an article on this some time ago, but with the addition of AWStats into the mix things had to be changed around a bit. The only real difference is that forwarded address ("%{X-Forwarded-For}i") gets switched in for the default remote server address ("%h", which is always going to be the BigIP interface that's routing traffic to the web server). Here's an example:

# LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined

The original LogFormat definition has been commented out, the new one inserted just below it. Note this particular change affects only the definition for the "combined" log type format (which is the default format AWStats is set up for).

Copyright 2004-2019 Phil Lembo