Update the documentation for the %a and %{c}a logging format strings, and

    <tr><td><code>CONN_LOG_ID</code></td>

        <td>The error log id of the connection (see

            <directive module="core">ErrorLogFormat</directive>)</td></tr>

    <tr><td><code>CONN_REMOTE_ADDR</code></td>

        <td>The raw IP address of the remote host (see the

            <module>mod_remoteip</module> module)</td></tr>

    </table>

    <tr><td><code>%a</code></td>

        <td>Remote IP-address and port</td></tr>

    <tr><td><code>%{c}a</code></td>

        <td>Actual remote IP-address and port (see the

            <module>mod_remoteip</module> module)</td></tr>

    <tr><td><code>%A</code></td>

        <td>Local IP-address and port</td></tr>

    <tr><td><code>%a</code></td>

        <td>Remote IP-address.</td></tr>

    <tr><td><code>%{c}a</code></td>

        <td>Actual remote IP-address and port (see the

        <module>mod_remoteip</module> module)</td></tr>

    <tr><td><code>%A</code></td>

        <td>Local IP-address.</td></tr>

<modulesynopsis metafile="mod_remoteip.xml.meta">

<name>mod_remoteip</name>

<description>Replaces the apparent client remote IP address and hostname

for the request with the IP address list presented by a proxies or a load

balancer via the request headers.

<description>Replaces the apparent client remote IP address for the request

with the IP address list presented by a proxies or a load balancer via the

request headers.

</description>

<status>Base</status>

    purposes of authorization and logging, even where that remote host is

    behind a load balancer, front end server, or proxy server.</p>

    <p>The module replaces the apparent remote (client) IP/hostname for

    <p>The module overrides the apparent remote (client) IP for

    the request with the IP address reported in the request header

    configured with the <directive>RemoteIPHeader</directive> directive.</p>

    <p>Once replaced as instructed, this apparent IP address is then used

    for <module>mod_authz_host</module> features

    <directive module="mod_authz_host" type="section">Require host</directive>

    and <directive module="mod_authz_host" type="section">Require ip</directive>,

    for the <module>mod_authz_host</module>

    <directive module="mod_authz_host" type="section">Require ip</directive> feature,

    is reported by <module>mod_status</module>, and is recorded by

    <module>mod_log_config</module> <code>%a</code> and <code>%h</code>

    directives.  It also determines the machine probed for an inetd

    identity by <module>mod_ident</module> based on the

    <directive module="mod_ident">IdentityCheck</directive> configuration.</p>

    <module>mod_log_config</module> <code>%a</code> and <module>core</module>

    <code>%a</code> format strings. The original remote IP of the connection is

    available in the <code>%{c}a</code> format string.</p>

    <note type="warning">It is critical to only enable this behavior from

    intermediate hosts (proxies, etc) which are trusted by this server, since

    it is trivial for the remote client to impersonate another client.</note>

</summary>

<seealso><module>mod_authz_host</module></seealso>

<seealso><module>mod_status</module></seealso>

<seealso><module>mod_log_config</module></seealso>

<seealso><module>mod_ident</module></seealso>

<section id="processing"><title>Remote IP Processing</title>

    <p>mod_remoteip replaces the true remote_ip with the advertised remote_ip as

    provided by a proxy, for every evaluation of the client that occurs in the

    server, and resets the remote_host and remote_logname values to trigger a

    fresh dns or ident query of the remote IP address.</p>

    server.</p>

    <p>When multiple, comma delimited remote IP addresses are listed in the

    header value, they are processed in Right-to-Left order.  Processing

    halts when a given remote IP address is not trusted to present the

    preceeding IP address.  The header field is updated to this remaining

    preceding IP address.  The header field is updated to this remaining

    list of unconfirmed IP addresses, or if all IP addresses were trusted,

    this header is removed from the request altogether.</p>