![具有 X-Forwarded-For 的 tomcat 访问日志的 AWStats 日志格式](https://linux22.com/image/620463/%E5%85%B7%E6%9C%89%20X-Forwarded-For%20%E7%9A%84%20tomcat%20%E8%AE%BF%E9%97%AE%E6%97%A5%E5%BF%97%E7%9A%84%20AWStats%20%E6%97%A5%E5%BF%97%E6%A0%BC%E2%80%8B%E2%80%8B%E5%BC%8F.png)
以下 tomcat 访问日志的 AWStats 日志格式应该是什么?
我尝试了这些格式,但外部 IP 地址没有进入 AWStats 报告。
LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %referer %other %other"
LogFormat="%other %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %host_proxy"
tomcat阀门设置:
pattern="%h %l %{USER_ID}s %t "%r" %s %b "%{Referer}i" "%{User-Agent}i" "X-Forwarded-For=%{X-Forwarded-For}i" "JSESSIONID=%{JSESSIONID}c" %D"
日志条目:
127.0.0.1 - - [04/Nov/2013:13:39:55 +0000] "GET / HTTP/1.1" 200 12345 "https://www.google.com/url?some_url" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36" "X-Forwarded-For=real_ip, proxy_server_internal_ip" "JSESSIONID=-" 12345
答案1
$ echo $STR
127.0.0.1 - - [10/Nov/2013:04:14:03 +0000] "GET /XXXX/js/service.js HTTP/1.1" 200 656 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0" "X-Forwarded-For=75.67.17.69, 10.2.0.121" "JSESSIONID=YYYY" 2
$ echo $STR | perl -pe 's/X\-Forwarded\-For=([\d\.]+).*?\"/X-Forwarded-For=$1"/g'
127.0.0.1 - - [10/Nov/2013:04:14:03 +0000] "GET /XXXX/js/service.js HTTP/1.1" 200 656 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0" "X-Forwarded-For=75.67.17.69" "JSESSIONID=YYYY" 2
答案2
谢谢您的帮助。
又做了一个技巧,awstat 希望 host_proxy 日志为 75.67.17.69, 10.2.0.121,因此更改了 perl 命令,如下所示,将“X-Forwarded-For=75.67.17.69, 10.2.0.121”更改为“75.67.17.69, 10.2.0.121”,不带引号,并删除多余的空格。
perl -pe 's/"X-Forwarded-For=([\d.,\s]+).*?" /$1/g'
更改后,日志将提供给 awstat 进行处理。