How will my HTTP server logs be affected?
Guardian has the ability to intercept failed requests, like "404 Not Found: /nofile.txt" and replace them with successful responses, like "200 OK /custom.html". How will the normal HTTP server logs record these requests? Will the record the initial failed request, the subsequent successful request, or both?
The answer may vary by web server, by logging type, and by the "reaction-type" Filter Rules used in Guardian. The most common scenarios are listed below. In cases where the web server doesn't retain full information, remember that Guardian maintains its own error log with detailed information.
Logging by Microsoft IIS
IIS records all requests as being made to the Perl CGI handler instead of to the actual file that was requested. The HTTP response code is recorded as the response code transmitted by the script, which may override the original.
Here is an example of a failed request for a /favicon.ico file in the IIS default log, without Guardian present:
2001-09-02 17:55:48 127.0.0.1 - 127.0.0.1 80 GET /favicon.ico - 404 270 376 lothlorien.xav.com Mozilla/4.0 - -
Here is the same request, with Guardian in place. For this request, Guardian replaced the "404 Not Found" response with a "200 Okay" response, and actually sent an ICO stream to the client. IIS transmitted the new response header and data stream as expected. It logged only the resulting Perl CGI request to /guardian/ag.pl and the 200-series success response; it did not log the original error request that triggered the Perl CGI script. The middle full URL field that shows "favicon.ico" is the query string field:
2001-09-02 17:55:48 127.0.0.1 - 127.0.0.1 80 GET /guardian/ag.pl 404;http://lothlorien.xav.com/guardian/something/favicon.ico - 200 270 376 lothlorien.xav.com Mozilla/4.0 - -
"How will my HTTP server logs be affected?" http://www.xav.com/scripts/guardian/help/1003.html