Loadbalanced WildFly 8.2.1: no client ip in access.log

[stephan_b]

How do I configure WildFly so it will put the real client ip address in the access.log file?

My load balancer sets x-forwarded-for, and calls to request.getRemoteAddr() give me the correct ip address.

The only thing consistently logging the address of the load balancer instead of the real client ip is my access.log file.

I have configured WildFly like this:

<server name="default-server">

                <ajp-listener name="ajp" socket-binding="ajp"/>

                <http-listener name="default" socket-binding="http" proxy-address-forwarding="true"/>

                <host name="default-host" alias="localhost">

                    <location name="/" handler="welcome-content"/>

                    <access-log pattern="common" directory="${jboss.server.log.dir}" prefix="access"/>

                    <filter-ref name="server-header"/>

                    <filter-ref name="x-powered-by-header"/>

                </host>

            </server>

What am I missing?

[stephan_b]

Any thoughts? My load balancer is properly setting X-Forwarded-For. I confirmed the header and getRemoteAddr() with this quick jsp iteration:

        <table style="border: 1px;padding: 4px;border-spacing: 0px;">

            <%

                Enumeration eNames = request.getHeaderNames();

                while (eNames.hasMoreElements()) {

                    String name = (String) eNames.nextElement();

                    String value = normalize(request.getHeader(name));

            %>

            <tr><td><%= name%></td><td><%= value%></td></tr>

            <%

                }

            %>

            <tr><td>IP:</td><td><%= request.getRemoteAddr()%></td></tr>

        </table>

Why is my access.log file still showing the ip address of my load balancer?

To confirm: when I stop sending x-forwarded for on the load balancer, the header disappears from the above table, and request.getRemoteAddr() starts to report the address of the load balancer. The only thing not working seems to be the access log file.

[jaikiran]

stephan_b  wrote:

                    <access-log pattern="common" directory="${jboss.server.log.dir}" prefix="access"/>

The "common" pattern states[1] that it logs the remote host name (not IP address), so I'm not sure if that's what is the reason why you aren't seeing the right values here. Can you try using an explicit pattern which includes %a as part of it, instead of common/combined patterns?

On an unrelated note, 8.2.1 of WildFly is too old and no longer being maintained. Better to upgrade to a latest version of WildFly (15.x as of now)

[1] undertow/AccessLogHandler.java at 1.1.x · undertow-io/undertow · GitHub

[stephan_b]

I should have mentioned that I tried that as well. I tried the pattern that matches "common", but swapped out the host for %a:

<access-log pattern="%a %l %u %t &quot;%r&quot; %s %b" directory="${jboss.server.log.dir}" prefix="access"/>

Unfortunately upgrading is not an option at the moment. The software I am running on top of WildFly is only supported up to 8.2.1.

It's a big issue, and we've made the vendor aware. Their next major release will support 11, but it isn't due for another few months.

However, this doesn't seem like it should be rocket science or any sort of off one-off request.

Anyone with a reverse proxy or load balancer would run into this issue. It's probably a setting somewhere.

[jaikiran]

This looks like it was fixed as part of [UNDERTOW-918] Improve access logging output for Remote host (%h) and Remote IP (%a) - JBoss Issue Tracker  (the fix isn't part of WildFly 8.2.1)

[stephan_b]

Doesn't that just apply to ajp? My F5 uses http.

[jaikiran]

stephan_b  wrote:

Doesn't that just apply to ajp? My F5 uses http.

The bug report talks about AJP but looking at the fix, it's actually more generic and should apply to cases like yours.