Need to get remote ip of one who is accessing the web application

Question

I am trying to log website visitor application in tomcat logs I have tried adding below lines of code in server.xml

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%{X-Forwarded-For}i %h %F %l %u %t &quot;%r&quot; %s %b"/>

I am getting the below output in the tomcat log.

• 192.168.1.149 15 - - [24/Jul/2020:16:24:16 +0200] "GET /geonetwork/srv/eng/shib.user.login.noforward HTTP/1.0" 200 50

I need to get remote IP of one who is accessing the application

Answer 1

There are 2 scenario, your tomcat is not behind any load balancer or proxy or behind one. If your tomcat is not behind proxy or load balancer, it's already correct. For more precaution, maybe add %a so it can grab the remote ip address as stated in Access_Log_Valve

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%{X-Forwarded-For}i %h %F %l %u %t &quot;%r&quot; %s %b" />

To

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%{X-Forwarded-For}i %a %h %F %l %u %t &quot;%r&quot; %s %b" />

If you want to use %h for Remote host name, please set enableLookups="true" at connector

<!-- Define a non-SSL HTTP/1.1 Connector on port 8180 -->
<Connector port="8080" 
....
    enableLookups="true"
      ....
/>

But in any case that the tomcat is behind proxy or load balancer, add more configuration like this:

<Valve className="org.apache.catalina.valves.RemoteIpValve" />

<Valve className="org.apache.catalina.valves.AccessLogValve" ....

The proxy default ip addresses that used by RemoteIpValve:

• 127.0.0.0/8
• 169.254.0.0/16
• 10.0.0.0/8
• 192.168.0.0/16

And maybe if your proxy is not listed here, add internalproxies configuration to catch the proxy:

<Valve className="org.apache.catalina.valves.RemoteIpValve" 
  internalProxies="172.16.0.10|172.16.0.11" />