Logging cookie info in access logs

Forum Moderators: phranque

Message Too Old, No Replies

Logging cookie info in access logs

dfresh4130

4:42 pm on Apr 3, 2009 (gmt 0)

I'm trying to come up with a solution to have the cookies logged inside the apache access logs. I'm running version 6.0.2.23 and it's sending traffic to a Websphere 6.0 app server list based on the plugin-cfg.xml file. I came across this link at the apache site: [httpd.apache.org...] and tried implementing it, but I don't get any other input in my access log files for it. These are my current lines in the httpd.conf I'm using and when I added the %{cookie}n it just gave a null value in that area of the logs. Can anyone help me figure out how to get the info from the cookies output into the access logs? It'd be even better if I could somehow just get a single piece of the cookie logged, but I don't know if that's possible. Thanks

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%a¦%l¦%{clientid}i¦%t¦%U¦%q¦%>s¦%b¦%D¦%H¦%m¦" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
LogFormat "%{clientid}i" client

jdMorgan

5:18 pm on Apr 3, 2009 (gmt 0)

"%{cookie}n" would designate a "note" from another module. Have you tried "%{Cookie}i" to specify the HTTP Cookie request header?

Jim

dfresh4130

5:29 pm on Apr 3, 2009 (gmt 0)

That worked. Thanks!

Do you know if there's a way for me to parse a specific value out of the cookie itself? I need to get the cloneid which is the value in between the : and ; right before LTPA token.

99.99.999.999¦-¦999@999abc.com¦JSESSIONID_JAS=0000dRkgENvc12dfYk4CfpbHCol:1330btt3o; LtpaToken

jdMorgan

5:59 pm on Apr 3, 2009 (gmt 0)

You could use mod_rewrite to set an environment variable after extracting the clone id value using a regular-expressions pattern-match.

Based on your description of the cookie format:


RewriteCond %{HTTP_COOKIE} ^[^:]*:([^;]+)
RewriteRule ^.*$ - [E=LogCloneId:%1]

The pattern in this RewriteCond will skip over everything in the cookie until it finds a colon, then put all characters after that colon into the variable %1 until it finds a semi-colon or the end of the cookie string. The RewriteRule will then put that extracted value into the environment variable "LogCloneId" for all requested URLs.

With that in place, you can modify your log format to log the environment variable "%{LogCloneId}e"

If you are not already using mod_rewrite, be aware that you must set the Option FollowSymLinks or SymLinksIfOwnerMatch, and you must precede your mod_rewrite code with the directive "RewriteEngine on". See Apache core "Options" directive, and Apache mod_rewrite "RewriteEngine" directive.

Jim

dfresh4130

6:10 pm on Apr 3, 2009 (gmt 0)

Works perfectly! Thanks!

dfresh4130

4:03 pm on Apr 10, 2009 (gmt 0)

Ok, this was working great and then we had to put in some redirect changes last night. Not sure if it broke or the copy of httpd.conf we went off of or if the code changed the cookie. Below is a line from one of the logs with the full cookie in it as now the LogCloneId value isn't catching the real clone id. The clone id value for this example is 131gg942i.

NN.NN.NNN.NNN¦-¦NNN@NNN.com¦$Version=1;JSESSIONID_JAS=0000mHksCwuHBN-KXrHkwoJ64dr:131gg942i;
LtpaToken=PKN5XR1yZSttXhlvDiy49ILry1Me0M2EbQLzD6fFg0qTbnahaCNfMrroCSW9Q7fBmlnk3xzitImfmk EF8HRORsPS/11zyRk
p57dGY55JnbkkL6MgWffBU8uJzh6zKmpt95FuCj5tP2ikkURa6GJquNlfbXHHOIpmpA+XDPgInxVb/VF/kz9ZFv 2FiLAhHsvwWmNyxxbE/GwxlksA0vtVqPOALUNIOzUtHJO06asTN4d6gtX1qPd9DO422bHCicmrb9a5XhHZP1P1E dFFaD0+fYBdLmWjmzfRCTujDGF9DV6oXiwYw
hXUXcz9m/B2aCb3tSm9dozgJ4zZREcTwgQ98B/qE7BjSN6Ea1HuoPaH4r4QbKAfrh6zyY0ocyRWlBUY;pmjsessi onid=aIOeyivFQ-L9
¦${LogCloneId}e¦[10/Apr/2009:10:51:12 -0500]¦/NNN/NN_1_NNNNNN000K802N9R3F4Q3000/images/NNN/buttons
/Btn_Cancel_unselected.png¦¦200¦807¦284¦HTTP/1.1¦GET¦

My current httpd.conf entries look like this that were originally working except that I added the %{Cookie}i so I could capture some of the cookies as they are now:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
#LogFormat "%h %l %u %t \"%r\" %>s %b" common
#LogFormat "%a¦%l¦%{clientid}i¦%t¦%U¦%q¦%>s¦%b¦%D¦%H¦%m¦" common
LogFormat "%a¦%l¦%{clientid}i¦%{Cookie}i¦${LogCloneId}e¦%t¦%U¦%q¦%>s¦%b¦%D¦%H¦%m¦" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
LogFormat "%{clientid}i" client

#LogFormat "%t \"%r\" status=%>s bytes=%b pid=%P Cookie=%{Cookie}i Set-Cookie=%{Set-Cookie}o" cookie_filter

Note: Can't remember for sure if that last LogFormat line was really commented out or not.

RewriteCond %{HTTP_COOKIE} ^[^:]*:([^;]+)
RewriteRule ^.*$ - [E=LogCloneId:%1]

Any help on this is much appreciated!

[edited by: jdMorgan at 6:44 pm (utc) on April 11, 2009]

[edited by: eelixduppy at 5:33 pm (utc) on April 13, 2009]
[edit reason] Disabled smileys in code, fixed horizontal scroll. [/edit]

dfresh4130

5:38 pm on Apr 10, 2009 (gmt 0)

Figured it out. My master copy had the LogFormat line with a $ before {LogCloneId}i instead of a %. Thanks

jdMorgan

6:43 pm on Apr 11, 2009 (gmt 0)

Always make a backup copy before modifying your server config files -- whether httpd.conf or .htaccess. You will live a longer and happier life... :)

Jim