A No Nonsense Blog

To keep the ‘one post per year’ tradition alive, heres one for 2011!

Logging the right IP with Lighttpd when behind reverse proxies

When you use a reverse proxy like haproxy, varnish, nginx, squid or cloudflare, lighttpd will log the IP of the reverse proxy instead of the user’s IP

While the lighttpd wiki page says

mod_accesslog: In order to see the “real” ip address in access log, you’ll have to load mod_extforward after mod_accesslog

That didn’t work for me even though I get the proper IP within my application.

With google, I found this

accesslog.format = “%{X-Forwarded-For}i %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”"

To get that to work with Cloudflare, just use %{CF-Connecting-IP}i instead of %{X-Forwarded-For}i

accesslog.format = “%{CF-Connecting-IP}i %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”"

You could just use that or set your own custom logging format [https://redmine.lighttpd.net/wiki/lighttpd/Docs:ModAccessLog]

[Using ExtForward with Cloudflare]
——

Lighttpd Remote Logging

Now the remote logging with syslog-ng.
rsyslog had been broken on one of my servers for quite some time and was using up 200%+ cpu for some reason. I came across syslog-ng while looking for an alternative. If you have multiple webservers for a site, its nice to have all the logs in one place

Easy to install on ubuntu with:

sudo apt-get install syslog-ng

You’ll need to do that on all the clients (systems we’re logging from) and the server (the system we’re logging to)

On the server edit /etc/syslog-ng/syslog-ng.conf and add ‘udp(ip(0.0.0.0) port(514));’ to the source s_src part so it looks like this

source s_src { unix-dgram(“/dev/log”); internal();
file(“/proc/kmsg” program_override(“kernel”));
udp(ip(0.0.0.0) port(514));
};

and add this to the bottom of the file

destination lighttpd { file(“/var/log/lighttpd.log”); };
log { source(s_src); filter(f_lighttpd); destination(lighttpd); };
filter f_lighttpd { program(lighttpd); };

And on the clients, at the end of  the /etc/syslog-ng/syslog-ng.conf file, add this

destination remote { udp(“[IP-Address-Of-Remote-Host]” port(514)); };
filter f_lighttpd { program(lighttpd); };
log { source(s_src); filter(f_lighttpd); destination(remote); };

restart syslog-ng with

sudo /etc/init.d/syslog-ng restart

on all clients and server, and it should start logging on the server to /var/log/lighttpd.log

Credits: http://www.ruby-forum.com/topic/94465

————————————–
Duplicate logs in /var/log/syslog
If the httpd logs are going into both /var/log/lighttpd and /var/log/syslog
find ‘filter f_syslog3′ in /etc/syslog-ng/syslog-ng.conf
and replace the whole line with

filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug) and not filter(f_lighttpd); };

do the same for the line with ‘filter f_daemon’

filter f_daemon { facility(daemon) and not filter(f_debug) and not filter(f_lighttpd); };

And restart syslog-ng

See you in 2012