Apache logs show normal IP addresses, not Cloudflare, without mod_remoteips. Why is this?

So we have an apache server setup which is routing our DNS through Cloudflare–we can confirm that our traffic is indeed going through Cloudflare. However, we have not setup mod_remoteips on our server yet. Looking at our apache logs, we can see that the IPs are indeed the IP addresses of the clients visiting the website, and not Cloudflare IPs as expected. We are running a Wordpress site, so not sure if that makes any difference here.

It’s interesting and I was just wondering why this is the case… Does it have to do with “how” we set up Cloudflare on our end? Any ideas?


What is the value of the LogFormat directive?

Not sure exactly, but from a bit of searching, I found this in our apache conf:

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedvhost
    <IfModule logio_module>
        LogFormat "%v %{%s}t %I .\n%v %{%s}t %O ." bytesvhost
    LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b" common
    LogFormat "%{Referer}i -> %U" referer
    LogFormat "%{User-agent}i" agent

Here’s a sample output from the log file, hiding the user agent and IP below.

XX.XX.XX.XX - - [27/Oct/2021:18:32:07 -0400] "GET / HTTP/2.0" 200 19703 "-" "User Agent String Goes Here"

At a glance, none of the LogFormat directives match the sample output you provided.

There will be a CustomLog somewhere that references the log file you are looking at, and on the end of that line it will tell you which named LogFormat you are using.

Regardless, what I was looking for is not present. It looks like you are using a shared CPanel based hosting provider. Some will deploy mod_remoteips globally. You should check your hosts documentation, or ask in their support channels if they deploy mod_remoteips on their build.

1 Like

It looks like we have it installed?

Running find / -name ModCloudflare.pm in whm’s terminal outputs the following:

Thanks for the help, Michael!

1 Like

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.