4

I frequently see that logging the IP of the user is advised. I thought of attaching this information to the session record in the database but IP can change during the lifetime of a session. And if the user prefers to keep the session open, session may never be renewed.

So, is it best practice to log each and every web request coming from the client?

Improve this question
2
  • 4
    Your webserver is almost certainly doing this already, it's only worth logging this yourself at an application level if you really need that data for something.
    – iainpb
    Commented Jan 5, 2017 at 13:15
  • 1
    It's common practice to do this, but not for security reasons. Webmasters are usually very interested in knowing which of their pages get how many views by what kind of people. That's because this is the main metric by which their success is measured. Creating those statistics is only possible to do when you log every http request. And if you do that anyway, you can also use that data for security purposes.
    – Philipp
    Commented Jan 5, 2017 at 14:53

1 Answer 1

Reset to default
2

This is totaly application dependent. As @iain pointed out, your webserver almost certainly logs all requests. E.g. if you use apache, than you can find the logs in the /log/ folder in the apache directory.

application-dependent: if you have tons of requests, you may face problems keeping your logs for a extended amount of time. Check your webservers config for the logging-policy.

here is an example of how apache commonly logs requests:

64.242.88.10 - - [07/Mar/2004:16:05:49 -0800] "GET /twiki/bin/edit/Main/Double_bounce_sender?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12846
64.242.88.10 - - [07/Mar/2004:16:06:51 -0800] "GET /twiki/bin/rdiff/TWiki/NewUserTemplate?rev1=1.3&rev2=1.2 HTTP/1.1" 200 4523
64.242.88.10 - - [07/Mar/2004:16:10:02 -0800] "GET /mailman/listinfo/hsdivision HTTP/1.1" 200 6291
64.242.88.10 - - [07/Mar/2004:16:11:58 -0800] "GET /twiki/bin/view/TWiki/WikiSyntax HTTP/1.1" 200 7352

the lines are formated like this, though it varies depending on the logformat you configured:

IP -- [DATE] "REQUESTSTRING" HTTPRETURNCODE SIZEINBYTES

(check out this for more information on the format of the logs)

hope i have helped

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .