AWStats and X-Forwarded-For

We just love our F5 BigIP LTM’s. Problem is that whenever we put one in front of a web server logging incoming clients gets complicated. But there’s always a way.

Did an article on this some time ago, but with the addition of AWStats into the mix things had to be changed around a bit.

The only real difference is that forwarded address (“%{X-Forwarded-For}i”) gets switched in for the default remote server address (“%h”, which is always going to be the BigIP interface that’s routing traffic to the web server).

Here’s an example:

# LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined

The original LogFormat definition has been commented out, the new one inserted just below it. Note this particular change affects only the definition for the “combined” log type format (which is the default format AWStats is set up for).

This entry was posted in System Administration on by .

About phil

My name is Phil Lembo. In my day job I’m an enterprise IT architect for a leading distribution and services company. The rest of my time I try to maintain a semi-normal family life in the suburbs of Raleigh, NC. E-mail me at philipATlembobrothersDOTcom. The opinions expressed here are entirely my own and not those of my employers, past, present or future (except where I quote others, who will need to accept responsibility for their own rants).