Log Login Errors of IBM Connections with IBM HTTP Server

You can log login errors within IBM Http Server.

One way would be to get use SetEnvIf, but then you can’t get the querystring of the error page. When you type a wrong password the URL changes from https://connectionshost/application/login/ to https://connectionshost/application/login/?error=true.

SetEnvIf Request_URI "/login$" log

This set the environment variable to log, but when you read the Apache documentation you find:

The resource requested on the HTTP request line — generally the portion of the URL following the scheme and host portion without the query string. See the RewriteCond directive of mod_rewrite for extra information on how to match your query string

So we need a way to get ?error=true, with mod_rewrite we can access the query_string:

LoadModule rewrite_module modules/mod_rewrite.so
RewriteCond %{QUERY_STRING} "error=true"
RewriteRule (.*) $1 [E=log:yes] 
CustomLog "D:/IBM/HTTPServer/logs/loginpage.log" combined env=log

Now we can access the login page, type a wrong password and check the log:

192.168.110.190 - - [15/Apr/2014:10:40:15 +0200] "GET /homepage/login/?error=true HTTP/1.1" 200 2763 "https://cnxwin.stoeps.local/homepage/login/?error=true" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
192.168.110.190 - - [15/Apr/2014:11:00:49 +0200] "GET /communities/login?error=true HTTP/1.1" 200 2766 "https://cnxwin.stoeps.local/communities/login" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
192.168.110.190 - - [15/Apr/2014:11:00:56 +0200] "GET /blogs/login?error=true&lang=en_us HTTP/1.1" 200 2763 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"