Varnish Logging (v3.x, 4.x) of real OR x-forwarded-for IPs behind a load balancer or proxy

varnishlog.md

Varnish Logging (v3.x+) of real OR x-forwarded-for IPs behind a load balancer or proxy

This works under init.d on CentOS. Some modification be required to file locations for other distributions or systemd.

In your /etc/varnish/default.vcl file:

Before all else:

    import std;

At the top of vcl_recv():

    std.collect(req.http.x-forwarded-for);
    if (req.http.x-forwarded-for) {
            std.log("ip:" + req.http.x-forwarded-for);
    } else {
            std.log("ip:" + client.ip);
    }

Create a file /etc/sysconfig/varnishncsa

    # Configuration file for varnishncsa
    #
    # /etc/init.d/varnishncsa expects the variable $DAEMON_OPTS to be set from this
    # shell script fragment.
    #

    LOGFORMAT="%{VCL_Log:ip}x %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\""
    DAEMON_OPTS="-a -w $logfile -D -P $pidfile -F \"${LOGFORMAT}\""