Varnish access log client IP's the same

[Harris, Shirley A.]

Hello,

Everything was working then about a month ago the Varnish access log
started showing 2.2.2.2 and 2.2.2.3 as almost all the client IP
addresses. 

 

The client IP as Varnish sees it is now set up to show in Apache's
access log, but the problem seems to be that Varnish still sees the IP
addresses as 2.2.2.2 or 2.2.2.3.

 

What could be causing this?

 

This is Varnishncsa:

2.2.2.2 - - [06/Jun/2012:14:37:49 -0400] "GET http://XXXXX HTTP/1.1" 200
5793 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;
+http://www.google.com/bot.html)"

2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET http://XXXXX HTTP/1.1" 200
5171 "-" "Mozilla/5.0 (compatible; YandexBot/3.0;
+http://yandex.com/bots)"

2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET http://XXXXX HTTP/1.1" 200
7584 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0;
+http://www.baidu.com/search/spider.html)"

2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET http://XXXXX HTTP/1.1" 200
5171 "-" "Mozilla/5.0 (compatible; YandexBot/3.0;
+http://yandex.com/bots)"

2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET http://XXXXX HTTP/1.1" 200
7584 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0;
+http://www.baidu.com/search/spider.html)"

 

This is the Apache access log with the Varnish client IP:

2.2.2.2, 2.2.2.2 - - [06/Jun/2012:14:34:33 -0400] "GET
/Collections/folklife/audio.cfm HTTP/1.1" 301 29 "-" "Mozilla/5.0
(Windows NT 5.1; CT2228257_3.13.0.6; rv:12.0) Gecko/20100101
Firefox/12.0"

2.2.2.2, 2.2.2.2 - - [06/Jun/2012:14:34:34 -0400] "GET /audio/ HTTP/1.1"
200 8158 "-" "Mozilla/5.0 (Windows NT 5.1; CT2228257_3.13.0.6; rv:12.0)
Gecko/20100101 Firefox/12.0"

2.2.2.3, 2.2.2.3 - - [06/Jun/2012:14:34:34 -0400] "POST
/Collections/folklife/search_adv_002.cfm HTTP/1.1" 301 3 "-"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

2.2.2.2, 2.2.2.2 - - [06/Jun/2012:14:34:34 -0400] "POST
/Collections/SpanishLandGrants/index.cfm HTTP/1.1" 301 3 "-"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

2.2.2.3, 2.2.2.3 - - [06/Jun/2012:14:34:34 -0400] "GET
/collections/folklife/ HTTP/1.1" 200 19388 "-" "Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT 5.1)"

 

Apache LogFormat:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\"
\"%{User-Agent}i\"" combined

 

Default.vcl:

sub vcl_recv {

     remove req.http.X-Forwarded-For;

     set req.http.X-Forwarded-For = client.ip;

     if (req.restarts == 0) {

        if (req.http.x-forwarded-for) {

            set req.http.X-Forwarded-For =

                req.http.X-Forwarded-For + ", " + client.ip;

        } else {

            set req.http.X-Forwarded-For = client.ip;

        }

     }

...

 

Thanks,

Shirley

 




Florida is headed in the right direction! View Florida's Jobs Growth Chart: http://www.flgov.com/photoview/jobcreationchart.jpg 
The Department of State is leading the commemoration of Florida's 500th anniversary in 2013. For more information, please go to www.fla500.com. 
The Department of State is committed to excellence. Please take our Customer Satisfaction Survey: http://survey.dos.state.fl.us/index.aspx?email=Shirley.Harris@DOS.MyFlorida.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.varnish-cache.org/lists/pipermail/varnish-misc/attachments/20120606/46b09762/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jobgrowthchart_sm.jpg
Type: image/jpeg
Size: 4544 bytes
Desc: jobgrowthchart_sm.jpg
URL: <https://www.varnish-cache.org/lists/pipermail/varnish-misc/attachments/20120606/46b09762/attachment.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: vivafl45.png
Type: image/png
Size: 1592 bytes
Desc: vivafl45.png
URL: <https://www.varnish-cache.org/lists/pipermail/varnish-misc/attachments/20120606/46b09762/attachment.png>