From: André Malo This module provides for forensic logging of client
requests. Logging is done before and after processing a request, so the
forensic log contains two log lines for each request.
- The forensic logger works very strict, which means:
CoreDumpDirectory
configuration).In order to evaluate the log output there's a script
- check_forensic
, which can be found in the support directory
- of the distribution.
The check_forensic
script, which can be found in the
+ distribution's support directory, may be helpful in evaluating the
+ forensic log output.
In order to identify each request, a unique request ID is assigned.
- This forensic id can be cross logged in the normal transfer log using the
+ This forensic ID can be cross logged in the normal transfer log using the
%{forensic-id}n
format string. If you're using
- mod_unique_id
its generated ID will be used.
mod_unique_id
, its generated ID will be used.
The first line logs the forensic ID, the request line and all received
headers, separated by pipe characters (|
). A sample line
@@ -86,13 +86,13 @@
The plus character at the beginning indicates that this is first log line of this request. The second line just contains a minus character and - the id again:
+ the ID again:
-yQtJf8CoAB4AAFNXBIEAAAAA
The check_forensic
script gets as its argument the name
+
The check_forensic
script takes as its argument the name
of the logfile. It looks for those +
/-
ID pairs
and complains if a request was not completed.
The ForensicLog
directive is used to
- log requests to the server for a forensic analysis. Each log entry
- gets assigned unique id which can be associated with the request
+ log requests to the server for forensic analysis. Each log entry
+ is assigned a unique ID which can be associated with the request
using the normal CustomLog
- directive. mod_log_forensic
leaves a note called
- forensic-id
which can be added to the transfer log by
+ directive. mod_log_forensic
creates a token called
+ forensic-id
, which can be added to the transfer log
using the %{forensic-id}n
format string.
The argument, which specifies the location to which