最後更新: 2022-06-10

目錄

• forensic log
• Conditional Logs
• Debug with -X
• BufferedLogs

forensic log

一般的 Log - Access Log

The server access log records all requests processed by the server.

forensic 介紹

# Module: mod_log_forensic (Apache 2.4)

Logging is done before (after receiving the headers) and after processing a request,

    so the forensic log contains two log lines for each request.

* The format is fixed.

* If it cannot write its data, the child process exits immediately and may dump core

Before log: The plus character at the beginning indicates that this is the first log line of this request.

After log: The second line just contains a minus character and the ID again

Setting

/etc/httpd/conf.modules.d/log_forensic.conf

LoadModule  log_forensic_module modules/mod_log_forensic.so
ForensicLog /home/vhosts/datahunter.org/logs/forensic.log

service httpd reload

Test

curl -I https://MyDomain/my.php

+Forensic_ID|HEAD /my.php HTTP/1.1|Host:MyDomain|User-Agent:Amazon CloudFront|
      X-Amz-Cf-Id:UUID==|Connection:Keep-Alive|Via:2.0 UUID.cloudfront.net (CloudFront)|
      X-Forwarded-For:S.S.S.S|MyCustHeader:1
-Forensic_ID

Conditional Logs

# Mark requests from the loop-back interface

SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog

# Mark requests for the robots.txt file

SetEnvIf Request_URI "^/robots\.txt$" dontlog

# Log what remains

CustomLog logs/access_log common env=!dontlog

Debug with -X

Run httpd in debug mode.

Only one worker will be started and the server will not detach from the console.

BufferedLogs

Buffer log entries in memory before writing to disk (rather than writing them after each request)

# Default: Off
BufferedLogs On