Wrong IP address in Apache logfile - not fixed by MU24 patch

[Baxil]

Hi there,

We're running Plesk 12.0.18 on Ubuntu 14.04 LTS and are troubleshooting a site problem that made us realize that the only IP address showing up in the apache logs is the server address. Searching the KB, this appears to be the nginx problem described in http://kb.odin.com/en/123537 . However, that article says that it was fixed with microupdate #24. Our system has update #67. This doesn't appear to specifically be a MU67 problem as the IP issue appears to date at least as far back as July.

Per http://kb.odin.com/en/9294 , I tried using the following to reapply all patches:
/usr/local/psa/admin/sbin/autoinstaller --select-product-id plesk --select-release-current --reinstall-patch --install-component base

That completed successfully. No change after restarting both affected services, or rebooting the server.

Is anyone else having problems with the MU#24 nginx patch not applying? We haven't touched nginx's configuration, and I have very little experience with it so I'm not even sure what to look for in its config. How would I be able to manually verify in its config and/or code if the patch was properly applied? And/or, what other problems might cause this same symptom?

Log file sample:

1.2.3.4 - - [05/Oct/2015:15:09:21 -0700] "POST /wp-login.php HTTP/1.0" 200 4131 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
1.2.3.4 - - [05/Oct/2015:15:09:56 -0700] "POST /wp-login.php HTTP/1.0" 200 1921 "http://www.oneofourdomains.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0"
1.2.3.4 - - [05/Oct/2015:15:19:53 -0700] "GET / HTTP/1.0" 200 5250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Version/8.0.8 Safari/600.8.9"
1.2.3.4 - - [05/Oct/2015:15:19:53 -0700] "GET /wp-content/themes/theme992/style.css HTTP/1.0" 200 5609 "http://oneofourdomains.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Version/8.0.8 Safari/600.8.9"​

[All of the "1.2.3.4" entries above are our server's IP address, and the requests came from other sources.]

 

[Baxil]

As a self-followup to this, I've now tried some further research and am no closer to resolving the problem.

http://talk.plesk.com/threads/plesk-12-over-nginx-problem-with-ip-address.306061/#post-763787 suggests changing the Apache configuration for the mod_remoteip module to add "RemoteIPHeader X-Real-IP". /etc/apache2/plesk.conf.d/server.conf looked like this:

<IfModule mod_remoteip.c>
RemoteIPInternalProxy (our public ipv4 address) (our ipv6 address) (the machine's other IPs)
RemoteIPHeader X-Forwarded-For
</IfModule>​

I changed it to the following and reloaded Apache:

<IfModule mod_remoteip.c>
RemoteIPInternalProxy (our public ipv4 address) (our ipv6 address) (the machine's other IPs)
# changing per http://talk.plesk.com/threads/plesk-12-over-nginx-problem-with-ip-address.306061/#post-763787 to fix logging problem
# RemoteIPHeader X-Forwarded-For
RemoteIPHeader X-Real-IP
</IfModule>​

No difference; the logs still come in with our server's IP address as the requesting host.

 

[IgorG]

I hope this thread will help - http://talk.plesk.com/threads/access-logs-on-12-5-logging-destination-ip-not-remote-ip.335296

 

[Baxil]

Igor, thank you for the link.

You were correct, the RPAF module was not listed in the output of apachectl -M. I attempted to activate it with mizar's instructions in the thread http://talk.plesk.com/threads/remote_addr-wrong-ip.335028/, and it failed with this error message:

Output of config test was:
apache2: Syntax error on line 140 of /etc/apache2/apache2.conf: Syntax error on line 1 of /etc/apache2/mods-enabled/rpaf.load: API module structure 'rpaf_module' in file /usr/lib/apache2/modules/mod_rpaf.so is garbled - expected signature 41503234 but saw 41503232 - perhaps this is not an Apache module DSO, or was compiled for a different Apache version?

So that's at least a starting point!