Thanks Tom. I can see opportunity to use %a instead of %h in log
format. However, we are using the same (%h) since long with
HostnameLookups Off but never had seen such entries in access logs
(*/* instead of IP)
Also, i am using 'common' log format for access log. please find below
config from my server -
LogFormat "%h %l %{foo}i %t \"%r\" %>s %b" common
CustomLog "logs/access_log" common
Please let me know if you have any idea about those entries in logs.
Thanks
On Wed, Apr 25, 2012 at 12:14 PM, Tom Evans <[email protected]> wrote:
> On Wed, Apr 25, 2012 at 4:54 PM, Ishita Kapadiya <[email protected]> wrote:
>> Hi All,
>>
>> I am using apache 2.2.22.
>>
>> We are seeing some weird behavior in Apache access logs. I have
>> following line in httpd.conf -
>>
>> LogFormat "%h %l %i %t \"%r\" %>s %b" common
>>
>> now the log should look like - 64.39.111.58 - - [25/Mar/2012:11:08:48
>> -0400] "GET /abc.html HTTP/1.1" 200 251 (all looks good so far)
>>
>> The problem - even though i can see such logs in 90% of the cases
>> there are lots of entries similar to -
>>
>> */* - - [25/Mar/2012:11:08:48 -0400] "GET /abc.html HTTP/1.1" 200 251
>> */200 - - [25/Mar/2012:11:08:48 -0400] "GET /abc.html HTTP/1.1" 200 251
>>
>> Note that the first field...
>>
>> I have set HostnameLookups Off in my config.
>> Can anyone tell what could be the reason for such entries or at least
>> what such entries mean?
>>
>> Thanks!
>>
>
> Are you sure this is the format being applied? LogFormat simply
> defines a format, it doesn't necessarily need to be used.
>
> Another possibility is that you have two CustomLog directives pointing
> at the same file but with different formats.
>
> I also don't understand why you are using %h (remote host) with host
> lookups turned off. If you want the remote IP address, why not use %a
> (remote IP address).
>
> BTW, your use of %i is meaningless. %i is used to extract a header;
> you never specify a header name, eg '%{FOOBAR}i'. %i by itself will
> always result in a '-'.
>
> Cheers
>
> Tom
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
