<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word"><head><META content="text/html; charset=utf-8" http-equiv="Content-Type">
<meta content="text/html; charset=utf-8" http-equiv=Content-Type><meta content="Microsoft Word 14 (filtered medium)" name=Generator><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><BODY>
<DIV><div class=WordSection1><p class=MsoNormal>Hello,<o:p></o:p></p><p class=MsoNormal>Everything was working then about a month ago the Varnish access log started showing 2.2.2.2 and 2.2.2.3 as almost all the client IP addresses. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The client IP as Varnish sees it is now set up to show in Apache’s access log, but the problem seems to be that Varnish still sees the IP addresses as 2.2.2.2 or 2.2.2.3.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>What could be causing this?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This is Varnishncsa:<o:p></o:p></p><p class=MsoNormal>2.2.2.2 - - [06/Jun/2012:14:37:49 -0400] "GET <a href="http://XXXXX">http://XXXXX</a> HTTP/1.1" 200 5793 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"<o:p></o:p></p><p class=MsoNormal>2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET <a href="http://XXXXX">http://XXXXX</a> HTTP/1.1" 200 5171 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"<o:p></o:p></p><p class=MsoNormal>2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET <a href="http://XXXXX">http://XXXXX</a> HTTP/1.1" 200 7584 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"<o:p></o:p></p><p class=MsoNormal>2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET <a href="http://XXXXX">http://XXXXX</a> HTTP/1.1" 200 5171 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"<o:p></o:p></p><p class=MsoNormal>2.2.2.3 - - [06/Jun/2012:14:37:50 -0400] "GET <a href="http://XXXXX">http://XXXXX</a> HTTP/1.1" 200 7584 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This is the Apache access log with the Varnish client IP:<o:p></o:p></p><p class=MsoNormal>2.2.2.2, 2.2.2.2 - - [06/Jun/2012:14:34:33 -0400] "GET /Collections/folklife/audio.cfm HTTP/1.1" 301 29 "-" "Mozilla/5.0 (Windows NT 5.1; CT2228257_3.13.0.6; rv:12.0) Gecko/20100101 Firefox/12.0"<o:p></o:p></p><p class=MsoNormal>2.2.2.2, 2.2.2.2 - - [06/Jun/2012:14:34:34 -0400] "GET /audio/ HTTP/1.1" 200 8158 "-" "Mozilla/5.0 (Windows NT 5.1; CT2228257_3.13.0.6; rv:12.0) Gecko/20100101 Firefox/12.0"<o:p></o:p></p><p class=MsoNormal>2.2.2.3, 2.2.2.3 - - [06/Jun/2012:14:34:34 -0400] "POST /Collections/folklife/search_adv_002.cfm HTTP/1.1" 301 3 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"<o:p></o:p></p><p class=MsoNormal>2.2.2.2, 2.2.2.2 - - [06/Jun/2012:14:34:34 -0400] "POST /Collections/SpanishLandGrants/index.cfm HTTP/1.1" 301 3 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"<o:p></o:p></p><p class=MsoNormal>2.2.2.3, 2.2.2.3 - - [06/Jun/2012:14:34:34 -0400] "GET /collections/folklife/ HTTP/1.1" 200 19388 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Apache LogFormat:<o:p></o:p></p><p class=MsoNormal>LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Default.vcl:<o:p></o:p></p><p class=MsoNormal>sub vcl_recv {<o:p></o:p></p><p class=MsoNormal> remove req.http.X-Forwarded-For;<o:p></o:p></p><p class=MsoNormal> set req.http.X-Forwarded-For = client.ip;<o:p></o:p></p><p class=MsoNormal> if (req.restarts == 0) {<o:p></o:p></p><p class=MsoNormal> if (req.http.x-forwarded-for) {<o:p></o:p></p><p class=MsoNormal> set req.http.X-Forwarded-For =<o:p></o:p></p><p class=MsoNormal> req.http.X-Forwarded-For + ", " + client.ip;<o:p></o:p></p><p class=MsoNormal> } else {<o:p></o:p></p><p class=MsoNormal> set req.http.X-Forwarded-For = client.ip;<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal>…<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal>Shirley<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></DIV>
<TABLE CELLPADDING="0" STYLE="width: 600px; padding:0px ">
<TR>
<TD STYLE="padding-top:0px; vertical-align:top; ">
<TABLE>
<TR> <TD>
<P STYLE="font-family: Arial, Verdana, Geneva, sans-serif; color:#1f497d; font-weight:bold; font-size: 13px;">Florida is headed in the right direction!<SPAN></SPAN><BR><SPAN STYLE="font-family: Arial, Verdana, Geneva, sans-serif; color:#1f497d; font-weight:bold; font-size: 10px; font-style:italic; ">Click to Enlarge</SPAN>
</P></TD></TR>
<TR>
<TD>
<A HREF="http://www.flgov.com/photoview/jobcreationchart.jpg"><IMG ALT=" " BORDER="0" HEIGHT="75" SRC="cid:jobgrowthchart_sm.jpg@2dbfe5a6.596242ad" WIDTH="106"></A></TD></TR>
</TABLE>
</TD>
<TD STYLE="vertical-align:bottom;">
<TABLE>
<TR><TD STYLE="border: 1px solid #990033; padding-top:0px;">
<TABLE>
<TR><TD>
<A HREF="http://www.fla500.com/"><IMG ALIGN="left" ALT="VivaFlorida500" BORDER="0" HEIGHT="45" SRC="cid:vivafl45.png@50d175e5.0c694afa" STYLE=" padding:5px;" WIDTH="39"></A>
</TD><TD>
<P STYLE="font-family: Arial, Verdana, Geneva, sans-serif; font-size:8.5pt; padding-top: 5px;">The Department of State is leading the commemoration of Florida's 500th anniversary in 2013. For more information, please go to <A HREF="http://www.fla500.com/">www.fla500.com</A>.</P>
</TD>
</TR></TABLE>
</TD></TR>
<TR><TD>
<P STYLE="font-family: Arial, Verdana, Geneva, sans-serif; font-size:8.5pt; padding-top: 0em; text-align:center; color:#1f497d;">The Department of State is committed to excellence. <BR>Please take our <A HREF="http://survey.dos.state.fl.us/index.aspx?email=Shirley.Harris@DOS.MyFlorida.com">Customer Satisfaction Survey</A>.<BR>
</P>
</TD></TR></TABLE>
</TD></TR></TABLE>
<BR>
<BR>
<FONT FACE="Arial, Verdana" SIZE="1"></FONT><P></P>
<FONT SIZE="+0"></FONT>
<P></P>
<P></P>
<P></P><P></P></BODY></HTML>