Apache: can ErrorLog be made to log also hostnames instead of IP addresses?

Question

Having different Apache servers in a low-load intranet with almost only DHCP clients, we need to log hostnames instead of IP addresses. As the DHCP environment is quite dynamic, any later attempt to remap IPs to hostnames would most likely yield false results.

Though we have "HostnameLookups On", only the access log is obediently logging hostnames, but the ErrorLog doesn't.

Reading about ErrorLogFormat, I notice there's no %h, but just %a (meaning "client IP address & port").

So is there really no way to have apache also logging hostnames in the error log...?

score 2 · Accepted Answer · answered Dec 05 '13 at 16:32

Not native with the ErrorLog Directive.

What I would do is write a script that does the resolving for you and pipe the ErrorLog through that. In your apache config something like this:

Errorlog "|/usr/local/bin/errorlog_resolver.pl"

And then a sample Perl script:

#!/usr/bin/perl -w
# errorlog_resolver.pl

# Give apache ErrorLog on STDIN, outputs them with numeric IP addresses
# in the likely (host) field converted to hostnames (where possible).

# based on clf_lookup.plx from "Perl for Web Site Management"
# http://oreilly.com/catalog/perlwsmng/chapter/ch08.html
#

use strict;
use Socket;

open LOGFILE, ">>/tmp/my_error_log" or die "Couldn't open file: $!";
my %hostname;

while (<>) {
    my $line = $_;
    my($day, $month, $dayn, $hour, $year, $err, $client, $host, $rest) = split / /, $line, 9;
    if ( $client ~~ "[client" ) {
    # remove the ] trailing the likely ip-address.
      my $chr = chop($host);

      if ($host =~ /^\d+\.\d+\.\d+\.\d+$/) {
        # looks vaguely like an IP address
        unless (exists $hostname{$host}) {
            # no key, so haven't processed this IP before
            $hostname{$host} = gethostbyaddr(inet_aton($host), AF_INET);
        }
        if ($hostname{$host}) {
            # only processes IPs with successful lookups
            $line = "$day $month $dayn $hour $year $err $client $hostname{$host}\($host\)\] $rest)";
        }
      }
    }
    print LOGFILE $line;
}

Thanks - good to know, though - and of course special kudos for the script!! — Christian, Dec 05 '13 at 18:08

Apache: can ErrorLog be made to log also hostnames instead of IP addresses?

1 Answers1