如何判断用户通过域名还是IP访问AWS EC2上的httpd站点？

Great question! The default Apache HTTP Server (httpd) access log format you're seeing doesn't include the Host header—this is exactly the detail you need to distinguish between users accessing via your domain (e.g., example.com) and your EC2 instance's static IP (e.g., 1.2.3.4). Here's how to fix this:

Why your current log doesn't show this #

The log line you shared uses Apache's default combined log format, which focuses on the client IP, request line, status code, referrer, and user agent—but it doesn't capture the Host header that the client sends (which contains the domain/IP they used to reach your site). The /site/path part is just the resource path requested, not the full URL or Host.

Fix 1: Modify Apache's log format to include the Host header #

You can update your httpd configuration to log the Host header, so future entries will show exactly what users used to access your site:

1. Open your Apache main configuration file (typically /etc/httpd/conf/httpd.conf) or a site-specific config in /etc/httpd/conf.d/.
2. Locate the LogFormat directive for the combined format. It looks like this:

   LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
   

3. Edit this line to add %{Host}i (which captures the Host header) to the format. For example, create a new named format:

   LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Host}i\" \"%{Referer}i\" \"%{User-Agent}i\"" combined_with_host
   

4. Find the CustomLog directive that references the combined format, and update it to use your new format:

   CustomLog "/var/log/httpd/access_log" combined_with_host
   

5. Restart Apache to apply the changes:

   sudo systemctl restart httpd
   # Or for older systems: sudo service httpd restart
   

After this, new log entries will include the Host value (domain or IP) that the client used. For example, a log line might look like:

1.2.3.4 - user [18/Apr/2018:06:20:18 -0300] "GET /site/path HTTP/1.0" 200 0 "example.com" "-" "USERAGENT"

Or if accessed via IP:

1.2.3.4 - user [18/Apr/2018:06:20:18 -0300] "GET /site/path HTTP/1.0" 200 0 "1.2.3.4" "-" "USERAGENT"

Fix 2: Check existing logs (if applicable) #

If you need historical data (before modifying the log format), there's no way to get the Host header from your existing /var/log/httpd/access_log entries—they weren't captured. You won't find this info in other default Apache logs either, unless you had additional logging modules enabled (like mod_logio, but that's not standard for this use case).

内容的提问来源于stack exchange，提问作者Benjamin Smith