Logging Destination Port

pcburakq

Verified User
Joined
Feb 6, 2015
Messages
6
Hello!

I can see logs on /var/log/httpd/domains/domain.name.log does not log remote port information or destination port information.

I would like to have Apache or Litespeed (Enterprise) log destination port information to access and error logs.

However my research on how to do this does not seem to bear any fruit.

Would anyone kindly guide me to the right documentation?

Regards
 

Zhenyapan

Verified User
Joined
Feb 23, 2018
Messages
910
Location
UA
at httpd log you see request that come to ports that httpd listening.
so if you have nginx_apache nginx log will collect requests for 80 and 443 ports, and apache will collect from 8080 and 8081,
if you have just one - nginx or apache or litespeed- it will coollect just 80 and 443 (all listening ports defined in service configs)
each service listens it's owb ports, that's why they not included in logs. if you want to parse all traffic - use tcpdump or something else.
 

pcburakq

Verified User
Joined
Feb 6, 2015
Messages
6
Hello,

I'm more interested on remote ports. What local port is is a given and easy to figure, i would like DirectAdmin / Apache to log remote ports.

PHP can log remote port is you use
Code:
$_SERVER['REMOTE_PORT']
variable i see but how and where to implement this so my access logs, globally on the server, log the remote port is something i'm yet to figure.

Thanks in advance.
 

pcburakq

Verified User
Joined
Feb 6, 2015
Messages
6
I'd like to share my solution to you for directadmin servers that are running Apache and Litespeed,

They both use;

/etc/httpd/conf/httpd.conf

File for the web server settings.

You simply go to LogFormat directives.

And add that you want the remote port to be logged there.

As for me, i've changed these lines;

Code:
LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

And added;

Code:
[%h]:%{remote}p

Example is shown below;

Code:
LogFormat "[%h]:%{remote}p %a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "[%h]:%{remote}p %a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

After that simply restart your Apache or Litespeed.

Log Before;

Code:
1.1.1.1 - - [09/Dec/2021:07:30:14 +0300] "GET /wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17 HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36"

Log Now;

Code:
[1.1.1.1]:58105 1.1.1.1 - - [09/Dec/2021:07:30:14 +0300] "GET /wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17 HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36"

(Actual IP address has been masked with 1.1.1.1 for obvious purposes)

Have fun guys.
 
Top