后端Apache日志获取前端Nginx反向代理的真实IP地址

我会带着你远行 2022-05-30 09:57 224阅读 0赞

**php查看客户访问真实地址代码**

<?php
    function real_ip()
    {
        static $realip = NULL;
        if ($realip !== NULL)
        {
            return $realip;
        }
     
        if (isset($_SERVER))
        {
            if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
            {
                $arr = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
     
                /* 取X-Forwarded-For中第一个非unknown的有效IP字符串 */
                foreach ($arr AS $ip)
                {
                    $ip = trim($ip);
     
                    if ($ip != 'unknown')
                    {
                        $realip = $ip;
     
                        break;
                    }
                }
            }
            elseif (isset($_SERVER['HTTP_CLIENT_IP']))
            {
                $realip = $_SERVER['HTTP_CLIENT_IP'];
            }
            else
            {
                if (isset($_SERVER['REMOTE_ADDR']))
                {
                    $realip = $_SERVER['REMOTE_ADDR'];
                }
                else
                {
                    $realip = '0.0.0.0';
                }
            }
        }
        else
        {
            if (getenv('HTTP_X_FORWARDED_FOR'))
            {
                $realip = getenv('HTTP_X_FORWARDED_FOR');
            }
            elseif (getenv('HTTP_CLIENT_IP'))
            {
                $realip = getenv('HTTP_CLIENT_IP');
            }
            else
            {
                $realip = getenv('REMOTE_ADDR');
            }
        }
        preg_match("/[\d\.]{7,15}/", $realip, $onlineip);
        $realip = !empty($onlineip[0]) ? $onlineip[0] : '0.0.0.0';
        return $realip;
    }
    echo real_ip();
    ?>

**nginx配置文件cat test.test.net.conf**

log_format  test.test.net  '$remote_addr - $remote_user [$time_local] $request' '$status $body_bytes_sent $http_referer' '$http_user_agent $http_x_forwarded_for $upstream_cache_status';
    server
        {
            listen       5555;
            server_name test.test.net;
    
            location / {
    
                proxy_connect_timeout 600s;
                proxy_read_timeout  600s;
                proxy_send_timeout  600s;
    
                proxy_buffer_size   32000k;
                proxy_buffers       1000 64000k;
                proxy_busy_buffers_size 128000k;
                proxy_temp_file_write_size 512000k;
     proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://test.test.net:60081;
    
            }
    
            access_log  /usr/local/nginx/logs/test.test.net-access.log  test.test.net;
    
    }

**apache配置httpd.conf**

**添加****%\{X-FORWARDED-FOR\}i**

**Apache日志配置文件中定义了两种打印格式，分别为combined格式和common格式。**

**本人使用combined格式**

<IfModule log_config_module>
        #
        # The following directives define some format nicknames for use with
        # a CustomLog directive (see below).
        #
        LogFormat "%h ClinetIp:%{X-FORWARDED-FOR}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        LogFormat "%h %l %u %t \"%r\" %>s %b %{X-FORWARDED-FOR}i" common
    
        <IfModule logio_module>
          # You need to enable mod_logio.c to use %I and %O
          LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
        </IfModule>
    
        #
        # The location and format of the access logfile (Common Logfile Format).
        # If you do not define any access logfiles within a <VirtualHost>
        # container, they will be logged here.  Contrariwise, if you *do*
        # define per-<VirtualHost> access logfiles, transactions will be
        # logged therein and *not* in this file.
        #
        CustomLog "logs/access_log" common
    
        #
        # If you prefer a logfile with access, agent, and referer information
        # (Combined Logfile Format) you can use the following directive.
        #
        #CustomLog "logs/access_log" combined
    </IfModule>

**虚拟机配置**

<VirtualHost *:60081>
        ServerAdmin systemadmin@test.net
        ServerName test.test.net
        DocumentRoot /home/w/html/test
        ErrorLog "/home/w/html/test/test.test.net-error_log" CustomLog "/home/w/html/test/test.test.net-access_log" combined </VirtualHost>

访问页面返回日志

网关IP:192.168.15.100

客户访问IP:192.168.15.101

192.168.15.100 ClinetIp:192.168.15.101 - - [12/Feb/2018:21:39:05 -0500] "GET / HTTP/1.0" 200 17 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0.3 Safari/604.5.6"

--------------------

## Apache日志格式 ##

#### 日志格式 ####

Apache日志配置文件中定义了两种打印格式，分别为combined格式和common格式。

combined格式：

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

common格式：

LogFormat "%h %l %u %t \"%r\" %>s %b" common

声明使用了combined日志格式和写入的文件名。

CustomLog "/var/log/apache2/access_log" combined

#### 字段说明 ####

<table style="float:left;width:310px;height:656px;"> 
 <thead> 
  <tr> 
   <th>字段格式</th> 
   <th>含义</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>%a</td> 
   <td>remote_ip</td> 
  </tr> 
  <tr> 
   <td>%A</td> 
   <td>local_ip</td> 
  </tr> 
  <tr> 
   <td>%B</td> 
   <td>size</td> 
  </tr> 
  <tr> 
   <td>%b</td> 
   <td>size</td> 
  </tr> 
  <tr> 
   <td>%D</td> 
   <td>time_taken_ms</td> 
  </tr> 
  <tr> 
   <td>%h</td> 
   <td>remote_host</td> 
  </tr> 
  <tr> 
   <td>%H</td> 
   <td>protocol</td> 
  </tr> 
  <tr> 
   <td>%l</td> 
   <td>ident</td> 
  </tr> 
  <tr> 
   <td>%m</td> 
   <td>method</td> 
  </tr> 
  <tr> 
   <td>%p</td> 
   <td>port</td> 
  </tr> 
  <tr> 
   <td>%P</td> 
   <td>pid</td> 
  </tr> 
  <tr> 
   <td>“%q”</td> 
   <td>url_query</td> 
  </tr> 
  <tr> 
   <td>“%r”</td> 
   <td>request</td> 
  </tr> 
  <tr> 
   <td>%s</td> 
   <td>status</td> 
  </tr> 
  <tr> 
   <td>%&gt;s</td> 
   <td>status</td> 
  </tr> 
  <tr> 
   <td>%t</td> 
   <td>time</td> 
  </tr> 
  <tr> 
   <td>%T</td> 
   <td>time_taken</td> 
  </tr> 
  <tr> 
   <td>%u</td> 
   <td>remote_user</td> 
  </tr> 
  <tr> 
   <td>%U</td> 
   <td>url_stem</td> 
  </tr> 
  <tr> 
   <td>%v</td> 
   <td>server_name</td> 
  </tr> 
  <tr> 
   <td>%V</td> 
   <td>canonical_name</td> 
  </tr> 
  <tr> 
   <td>%I</td> 
   <td>bytes_received</td> 
  </tr> 
  <tr> 
   <td>%O</td> 
   <td>bytes_sent</td> 
  </tr> 
  <tr> 
   <td>“%{User-Agent}i”</td> 
   <td>user_agent</td> 
  </tr> 
  <tr> 
   <td>“%{Referer}i”</td> 
   <td>referer</td> 
  </tr> 
 </tbody> 
</table>

####     ####

#### 日志样例 ####

192.168.1.2 - - [02/Feb/2016:17:44:13 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "http://localhost/x1.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36"