Configuring apache raw log files

[maccas]

Hi, all of a sudden by raw log files have started resolving, i.e what use to be 194.176.*.* - - [date] is now dhcp12345.****.com - - [date] any ideas why and how to turn it back to ip addresses only?

[jdMorgan]

The most likely cause is that you have enabled Reverse-DNS lookups through the use of mod_access or mod_rewrite directives which examine %{REMOTE_HOST}. The directives may in fact have been in place for a long time, but just recently were executed due to a particular request -- Which you will find in the log file just before the "mode switched" from showing IP addresses to showing hostnames.

There are several things you can do:

Remove the REMOTE_HOST checking code in your configuration and .htaccess files.
Set HostnameLookups to Off.
Change the log file format using mod_log_config so that it always logs IP addresses, instead of the default, which will log hostnames if they are available due to the effects of the previous two items in this list.

In all cases, you'll have to restart the server before the logging format will revert to showing IP addresses.

Jim

[maccas]

Well after emailing my host back and forward we figured out that if I removed this from my .htaccess file my raw log files went back to ip addresses

order allow,deny
deny from .someip.
deny from .someip.
deny from .someip.
deny from .someip.
deny from .someip.*
allow from all

We still don't no why or why it started happening all of a sudden though as that has been in my .htaccess file for months.

[jdMorgan]

The reason is as I stated above -- Using those directives triggers Apache to do reverse-DNS lookups, which it then logs. This is standard, documented Apache behaviour.

Jim

[edited by: jdMorgan at 1:22 pm (utc) on Mar. 21, 2007]