Best way to log POST data in Apache?

user_49324 0
Viewed 152729

Imagine you have a site API that accepts data in the form of GET requests with parameters, or as POST requests (say, with standard url-encoded, &-separated POST data). If you want to log and analyze API calls, the GET requests will be easy, because they will be in the apache log. Is there a simple way to get the POST data in the apache log as well?

(Of course we could log the POST data explicitly in the application, but I'd like to have an configuration-level way that let me not worry about it in code.)

apache-config logging apache
10 Answers

Use Apache's mod_dumpio. Be careful for obvious reasons.

Note that mod_dumpio stops logging binary payloads at the first null character. For example a multipart/form-data upload of a gzip'd file will probably only show the first few bytes with mod_dumpio.

Also note that Apache might not mention this module in httpd.conf even when it's present in the /modules folder. Just manually adding LoadModule will work fine.

user_2684190

You can use [ModSecurity][1] to view POST data.

Install on Debian/Ubuntu:

$ sudo apt install libapache2-mod-security2

Use the recommended configuration file:

$ sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Reload Apache:

$ sudo service apache2 reload

You will now find your data logged under /var/log/apache2/modsec_audit.log

$ tail -f /var/log/apache2/modsec_audit.log
--2222229-A--
[23/Nov/2017:11:36:35 +0000] 
--2222229-B--
POST / HTTP/1.1
Content-Type: application/json
User-Agent: curl
Host: example.com

--2222229-C--
{"test":"modsecurity"}
user_32652840

Not exactly an answer, but I have never heard of a way to do this in Apache itself. I guess it might be possible with an extension module, but I don't know whether one has been written.

One concern is that POST data can be pretty large, and if you don't put some kind of limit on how much is being logged, you might run out of disk space after a while. It's a possible route for hackers to mess with your server.

user_565410

I would do it in the application, actually. It's still configurable at runtime, depending on your logger system, of course. For example, if you use Apache Log (log4j/cxx) you could configure a dedicated logger for such URLs and then configure it at runtime from an XML file.

Assaf_112080

You can also use mod DumpIO, activate it, and load from your Apache Log Conf. Define log name as postdata name, and load to AccessLog statement

#AccessLog /path/to/your/log/abc.access.log combine

AccessLog /path/to/your/log/abc.access.log postdata

user_80895160

Enable mod_dumpio

  • for Debian-based OS

    sudo a2enmod dump_io

  • for RedHat-based OS

    nothing to do, it is enabled by default

Add mod_dumpio to your virtual host configuration

<VirtualHost *:8080>
  ServerName  localhost

  ErrorLog "/var/log/httpd/error.log"
  CustomLog "/var/log/httpd/access.log" combined

  DumpIOInput On
  DumpIOOutput On
  LogLevel dumpio:trace7    
</VirtualHost>

Restart Apache

user_179684680

You can also use the built-in forensic log feature.

user_6561320
Related