User Post
8:16 am March 3, 2009
Frédéric
Guest
Hi,
I found in the changelog.txt file (http://awstats.sourceforge.net/docs/awstats_changelog.txt ) that a patch exists to support host_proxy tag in LogFormat for Apache LogFormat containing %{X-Forwarded-For}i. (AWStats v6.9)
But I didn't find documentation about that.
Where is the patch, and how to use it???
Any idea?
Cheers, Frédéric
9:03 am March 3, 2009
Jean-Luc
Admin
posts 1043
Hi,
My understanding is that the patch is built-in in AWStats 6.9.
If you are having trouble with this version of AWStats and %{X-Forwarded-For}i , paste here your LogFormat definition (as in the AWStats config file) and a few lines from your log file.
8:09 am March 12, 2009
Frédéric
Guest
Hi Jean-Luc,
I give you here the logFormat and a few lines from one of my logs
LogFormat="%host_proxy %l %u %t \\"%r\\" %>s %b"
logfile 111.11.11.123, 123.11.11.321 – - [19/Sep/2008:11:16:25 +0200] "GET http://www.myWeb.com/PT/glossa…..age001.jpg HTTP/1.0" 200 11723 111.11.11.123, 123.11.11.321 – - [19/Sep/2008:11:16:25 +0200] "GET http://www.myWeb.com/PT/glossa…..age003.jpg HTTP/1.0" 200 21038 111.11.11.123, 123.11.11.321 – - [19/Sep/2008:11:16:25 +0200] "GET http://www.myWeb.com/PT/glossa…..age005.gif HTTP/1.0" 200 1045 111.11.11.123, 123.11.11.321 – - [19/Sep/2008:11:16:25 +0200] "GET http://www.myWeb.com/PT/glossa…..age008.jpg HTTP/1.0" 200 21644 111.11.11.123, 123.11.11.321 – - [19/Sep/2008:11:16:25 +0200] "GET http://www.myWeb.com/PT/glossa…..age010.jpg HTTP/1.0" 200 67967 999.99.99.123 – - [19/Sep/2008:16:36:17 +0200] "GET http://www.myWeb.com/secondLev…..screen.css HTTP/1.0" 304 - 999.99.99.123 – - [19/Sep/2008:16:36:17 +0200] "GET http://www.myWeb.com/secondLev…..n_full.css HTTP/1.0" 304 - 999.99.99.123 – - [19/Sep/2008:16:36:18 +0200] "GET http://www.myWeb.com/images/im…..GEID=15281 HTTP/1.0" 304 - 22.22.222.105, 444.55.666.5, 987.654.32.71 – - [23/Sep/2008:02:02:17 +0200] "GET http://www.myWeb.com/images/im…..GEID=67378 HTTP/1.0" 200 12345 22.22.222.105, 444.55.666.5, 987.654.32.71 – - [23/Sep/2008:02:02:47 +0200] "GET http://www.myWeb.com/images/im…..GEID=69717 HTTP/1.0" 200 1234 22.22.222.105, 444.55.666.5, 987.654.32.71 – - [23/Sep/2008:02:03:25 +0200] "GET http://www.myWeb.com/lt/2228/d…..chome.html HTTP/1.0" 200 123456 22.22.222.105, 444.55.666.5, 987.654.32.71 – - [23/Sep/2008:02:03:36 +0200] "GET http://www.myWeb.com/images/im…..GEID=72706 HTTP/1.0" 200 1478
I tested it. I got no error. The problem is the following: the client IP address I have to analyse is the LAST IP, while AWStats analyses the first one…
How to reverse the order???
Thanks for your help
Frédéric
9:18 am March 12, 2009
Jean-Luc
Admin
posts 1043
Frédéric,
I have no previous experience with the %host_proxy tag. The way it is parsed by AWStats is apparently defined in line 8676 of awstats.pl :
$PerlParsingFormat .= "(.+?)(?:, .*)*";
I am afraid I have no idea how this could be edited to pick up the last IP address.
10:08 am March 13, 2009
Frédéric
Guest
I found a solution:
$PerlParsingFormat .= "(?:(?:(?:\\\\d+\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+),\\\\s)*(\\\\d+\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+))";
And it works…