cPanel domlogs/Webserver Access logs are showing only local server IP addresses

This happens when we have a reverse proxy Nginx->Apache set up on the server. To be precise, when the Apache based website is behind the reverse proxy(Nginx). In such cases, we may see the accessing IPs on the website access logs as server’s local IP address itself. This behavior is because the reverse proxy or load balancer acts as client to Apache and the Apache sees the internal IP address on its website access log. This doesn’t help an administrator to track down real client IP addresses that access from the outside world.

We can use mod_rpaf module in this case for the Apache.

My machine here is a Centos/cPanel system.

cd /root

Now compile it

cd mod_rpaf-master/
apxs -i -c -n mod_rpaf-2.0.c

Finally, add the module to install Mod_rpaf on cPanel

LoadModule rpaf_module modules/
<IfModule mod_rpaf-2.0.c>
RPAFenable On
RPAFsethostname On
RPAFproxy_ips xx.xx.xx.xx

Restart Apache to apply the changes:

service httpd restart

A good replacement for mod_rpaf is mod_remoteip which can be installed via Easyapache itself on the cPanel servers.

Apachebooster – For speedy webserver

ApacheBooster is a integration of nginx and varnish, this Plugin will reduce the server load spike and memory usage. Also the plugin will provide the maximum performance of your websites.


Varnish Cache is a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 – 1000x, depending on your architecture. A high level overview of what Varnish does can be seen in the video attached to this web. Varnish performs really, really well. It is usually bound by the speed of the network, effectivly turning performance into a non-issue. We’ve seen Varnish delivering 20 Gbps on regular off-the-shelf hardware.


Nginx is known for its high performance, stability, rich feature set, simple configuration, and low resource consumption.

Unlike traditional servers, Nginx doesn’t rely on threads to handle requests. Instead it uses a much more scalable event-driven (asynchronous) architecture. This architecture uses small, but more importantly, predictable amounts of memory under load.


* cPanel WHM Integration
* Varnish Advanced Configuration
* Opt-out Domain List Served Directly by Apache
* VCL Script Compatibility

Installation Details

ApacheBooster Install instruction


tar -zxf apachebooster.tar.gz

cd apachebooster


ApacheBooster Uninstall instruction


tar -zxf apachebooster.tar.gz

cd apachebooster

sh uninstall

HTTP not working, but HTTPS does in NGINX

Found an issue regarding with http url of site is not working, but sametime https does. Here the Nginx works as a Front End Proxy on port 80 for Apache.

tcp 0 0 IP:80* LISTEN 2023/nginx
tcp 0 0 IP:80* LISTEN 2023/nginx
tcp 0 0 IP:80* LISTEN 2023/nginx
tcp 0 0 IP:8081 IP:38574 ESTABLISHED 24791/httpd

Troubleshoot part
Section 1:

I tried first to switch to apache as main as follows, to verify if is clearly an issue only with nginx but not apache.

* Took a backup of apache conf with current date.
* vi /usr/local/apache/conf/httpd.conf and set parameter ‘Listen’ to ‘Listen’ under the line “# Defined in /var/cpanel/cpanel.config: apache_port”. Also replaced all ‘8081’ entries to ’80’, along with NameVirtualHost and in the virtual host.
* vi /var/cpanel/cpanel.config and set parameter ‘apache_port=’ to ‘apache_port=’. Then execute the following script to make the changes in effect.

/usr/local/cpanel/whostmgr/bin/whostmgr2 –updatetweaksettings

* /etc/init.d/nginx stop
* /etc/init.d/httpd restart

Now apache would run as main webserver without any Front End proxy. Check the http url is loading fine or not. If it is working, the issue is regarding with nginx server.

Section 2:
* Check the nginx configuration for syntax errors.
root@host [~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
* Since I found the synax check is ok with nginx, turned by attention towards vhost entry for this domain in nginx.
* In the path, “/etc/nginx/vhosts” I could see vhost files for all domains but not the particular domain’s in question.
* I created one manually as follows:

root@host [~]# cat /etc/nginx/vhosts/
server {
error_log /var/log/nginx/vhost-error_log warn;
listen domainIP:80;
access_log /usr/local/apache/domlogs/ bytes_log;
access_log /usr/local/apache/domlogs/ combined;
root /home/cPanel_username/public_html;
location / {
location ~.*.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|
flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$ {
expires 1d;
try_files $uri @backend;
error_page 405 = @backend;
add_header X-Cache “HIT from Backend”;
proxy_pass http://domainIP:8081;
location @backend {
proxy_pass http://domainIP:8081;
location ~ .*.(php|jsp|cgi|pl|py)?$ {
proxy_pass http://domainIP:8081;
location ~ /.ht {
deny all;

* Now I tried to switch nginx back as Front proxy. Reverted the changes made in “/var/cpanel/cpanel.config”, “/usr/local/apache/conf/httpd.conf”.
* Then make sure you executed the command “/usr/local/cpanel/whostmgr/bin/whostmgr2 –updatetweaksettings” to make the changes in cpanel.config to be in effect. Then restart apache and start nginx.

You can see http url works as a charm 🙂

Please note that, next time when you face the same issue, you can directly go to section 2 for fast troubleshooting and closing the ticket.