Logging Destination Port

[pcburakq]

Hello!

I can see logs on /var/log/httpd/domains/domain.name.log does not log remote port information or destination port information.

I would like to have Apache or Litespeed (Enterprise) log destination port information to access and error logs.

However my research on how to do this does not seem to bear any fruit.

Would anyone kindly guide me to the right documentation?

Regards

 

[Zhenyapan]

at httpd log you see request that come to ports that httpd listening.
so if you have nginx_apache nginx log will collect requests for 80 and 443 ports, and apache will collect from 8080 and 8081,
if you have just one - nginx or apache or litespeed- it will coollect just 80 and 443 (all listening ports defined in service configs)
each service listens it's owb ports, that's why they not included in logs. if you want to parse all traffic - use tcpdump or something else.

 

[pcburakq]

Hello,

I'm more interested on remote ports. What local port is is a given and easy to figure, i would like DirectAdmin / Apache to log remote ports.

PHP can log remote port is you use

$_SERVER['REMOTE_PORT']

variable i see but how and where to implement this so my access logs, globally on the server, log the remote port is something i'm yet to figure.

Thanks in advance.

 

[pcburakq]

I'd like to share my solution to you for directadmin servers that are running Apache and Litespeed,

They both use;

/etc/httpd/conf/httpd.conf

File for the web server settings.

You simply go to LogFormat directives.

And add that you want the remote port to be logged there.

As for me, i've changed these lines;

LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

And added;

[%h]:%{remote}p

Example is shown below;

LogFormat "[%h]:%{remote}p %a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "[%h]:%{remote}p %a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

After that simply restart your Apache or Litespeed.

Log Before;

1.1.1.1 - - [09/Dec/2021:07:30:14 +0300] "GET /wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17 HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36"

Log Now;

[1.1.1.1]:58105 1.1.1.1 - - [09/Dec/2021:07:30:14 +0300] "GET /wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17 HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36"

(Actual IP address has been masked with 1.1.1.1 for obvious purposes)

Have fun guys.