If you are using nginx as reverse proxy on your cpanel server through the Engintron plugin, you will need to make some changes to the apache configuration to log the real visitor’s IP instead of the server’s own IP address.
Engintron will install the mod_remoteip during installation and properly make the changes to the apache LogFormat. But the changes don’t seem to persist.
Engintron also provides a “Restore Nginx IP forwarding in Apache” option to restore apache log files through the WHM panel, but the settings are lost when apache rebuilds its configuration at a later time. I have noticed this happening quite often.
For cPanel 74.0.4 and later, you can now make the changes through the WHM GUI. Refer instructions at the end of the post.
So, to make your changes permanent, you’ll have to do the following:
Assuming you are using EasyApache 4, copy the ea4_main.default file to a new file named ea4_main.local. Next time cpanel rebuilds apache configuration, it will use this file instead. This has precedence over the .default file.
# cd /var/cpanel/templates/apache2_4 # cp ea4_main.default ea4_main.local
Make the following changes to the ea4_main.local file
Look for the lines:
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
And replace it with
LogFormat "%a %l %u %t \"%r\" %>s %b" common
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
Basically, you are replacing %h with %a. Then do a rebuild of the apache config and restart the apache service.
# /scripts/rebuildhttpconfig # /scripts/restartsrv_apache
Now, your changes will be saved permanently and you’ll get the real visitor’s IP on your log files instead of the server’s IP.
Update (August 2018) : With the release of cPanel 74.0.4 (EA4), you can directly change the Apache LogFormat from within cPanel/WHM.
To change your LogFormat, you can go to Apache Configuration > Global Configuration and replace %h with %a as shown below:
Once you have saved the changes, you can click on the Rebuild Configuration and Restart Apache button to have the changes come into effect.
You can then delete the /var/cpanel/templates/apache2_4/ea4_main.local file if you have created it before the update.
I have tested that the changes remain after Apache and Engintron updates. Do let me know in the comments if it doesn’t work.