[apache 1.3.x] logging *entire* request header set?

Hey all,

I've got some servers running various Apache 1.3.x instances, most with
PHP 4 installed as a module. I'm looking to find a way to log the
entire client request (at least a smattering of pages) starting with
the request line and including all of the headers.

I know with CGI programs I can get the headers from the environment,
and I've found a way with PHP to access the headers as an array, but
both of these lose the header order.

Anyone have ideas?

Elijah
------
has been logging the reordered headers for lack of something better

Eli the Bearded <*@eli.users.panix.com> writes:
> I know with CGI programs I can get the headers from the environment,
> and I've found a way with PHP to access the headers as an array, but
> both of these lose the header order.
>
> Anyone have ideas?

For debugging purposes I've generally done that with the junkbuster
proxy. If it's for production you probably want to find something
less kludgy.

In comp.infosystems.www.servers.unix,
Paul Rubin <http://phr.cx@NOSPAM.invalid> wrote:
> Eli the Bearded <*@eli.users.panix.com> writes:
> > I know with CGI programs I can get the headers from the environment,
> > and I've found a way with PHP to access the headers as an array, but
> > both of these lose the header order.
> > Anyone have ideas?
> For debugging purposes I've generally done that with the junkbuster
> proxy. If it's for production you probably want to find something
> less kludgy.

I don't want to stick a proxy in front of my website for capturing the
incoming traffic. For capturing stuff from my own browser I have used
proxies, but now favor Firefox's Live HTTP Headers plugin (at mozdev).

I'd like to be able to capture all headers for things like web robots
and exploit attempts.

Elijah
------
doing it in apache makes it easier to capture non-ErrorDocument handled errors

Eli the Bearded <*@eli.users.panix.com> writes:
> I'd like to be able to capture all headers for things like web robots
> and exploit attempts.

If you're going to capture and record incoming passwords and
authentication cookies, you may be creating worse exploits (in
the form of the log file itself becoming a juicy target) than you're
solving. You have to be careful with this kind of thing.