Purpose

Since all requests to Jira nodes in Data Center come through the load balancer, Tomcat will log the load balancer IP in the access logs by default. 

This limitation makes troubleshooting web requests in Data Center difficult. 

It is possible for Tomcat to log the value from X-Forwarded-For header sent by the load balancer via Tomcat's RemoteIpValve. Note this will add a minor overhead as Tomcat will have to parse all HTTP headers. 

Solution

1. Add the following attribute to the existing access log valve in server.xml: 

   requestAttributesEnabled="true"

   The valve will look similar to the following: 

               <Valve className="org.apache.catalina.valves.AccessLogValve"
                      requestAttributesEnabled="true"
                      pattern="%a %{jira.request.id}r %{jira.request.username}r %t "%m %U%{sanitized.query}r %H" %s %b %D "%{sanitized.referer}r" "%{User-Agent}i" "%{jira.request.assession.id}r""/>

2. Add a new RemoteIpValve to server.xml above the AccessLogValve:

               <Valve
                      className="org.apache.catalina.valves.RemoteIpValve"
                      remoteIpHeader="x-forwarded-for"
                      remoteIpProxiesHeader="x-forwarded-by"/>

     If the proxy has a routable IP or a class B private network address space (172.16.0.0/12), it is necessary to add the internalProxies property to the RemoteIpValve to reflect the proxy IP addresses via regular expression. For example:
   

   internalProxies="172\.16\.0\.10|172\.16\.0\.11"

   More information on configuring these settings can be found in Tomcat's RemoteIpValve documentation.

   
   

3. Restart Jira.