[squid-users] Forwarded-for functionality(squid)

[Amos Jeffries]

On 9/09/20 1:15 am, piyush.gaba wrote:
> Hi Matus,
> 
> Thank you for your reply.
> 
> I think my whole struggle is to get the desired output as:
> <ip>- - [17/Aug/2018:08:43:29 +0200] "GET /index1.html HTTP/1.1" 200 36 "-" "curl/7.29.0" unknown
> 
> Which has "unknown" at the end because forwarded_for was set to "off".
> 
> But now when I am working with squid 4.13 I am not getting the desired output, I am getting the output as,
> <ip> - - [08/Sep/2020:15:07:19 +0200] "GET /index1.html HTTP/1.1" 200 8 "-" "curl/7.29.0"
> 
> Which does not have anything at the end, while the forwarded_for is set to "off".
> 
> Please let me know if you have any advice to give for this logging problem.
> 
> I am using below log format in my httpd file,
> LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
> 

That LogFormat tells us the first column of the log file is the contents
of the X-Forwarded-For header. The first column of the log lines you
showed is "<ip>" - the value of XFF header is supposed to be one or more
IPs, so that looks like it is working.

Use the debug_options setting I gave you to *actually* see what is
happening. The Apache log is only showing you what values are _after_
the httpd process and all modules have done their modifications to the
HTTP input ... including replacing the transaction client-IP with any
value from XFF header.


Amos