Tuesday, March 22, 2016

Enable forensic log in Apache within AWS Beanstalk

1) Change (or Uncomment) the line in file /etc/httpd/conf/httpd.conf
#LoadModule log_forensic_module modules/mod_log_forensic.so
to
LoadModule log_forensic_module modules/mod_log_forensic.so

2) Update /etc/httpd/conf.d/elasticbeanstalk.conf to include the line
ForensicLog /var/log/httpd/forensic_log 

3) Update /etc/httpd/conf.d/elasticbeanstalk.conf to add %{forensic-id}n at the end
LogFormat "%h (%{X-Forwarded-For}i) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{forensic-id}n"
This step is optional and help with forensic id correlation with access log.

4) Stop apache, check no http process is out there using ps-ef | grep http and start apache
/usr/sbin/apachectl stop
ps -ef | grep http (check for no http process)
/usr/sbin/apachectl start

2 comments: