# Ip addresses on log files

**URL:** <https://community.wowza.com/t/ip-addresses-on-log-files/95581>\
**Category:** Wowza Streaming Engine\
**Created:** [November 2, 2022, 5:34pm UTC](https://community.wowza.com/t/ip-addresses-on-log-files/95581 "2022-11-02T17:34:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_Love1](https://avatars.discourse-cdn.com/v4/letter/d/58956e/32.png) [@Dave\_Love1](https://community.wowza.com/u/Dave_Love1)\
**Post date:** [November 2, 2022, 5:34pm UTC](https://community.wowza.com/t/ip-addresses-on-log-files/95581/1 "2022-11-02T17:34:29Z")

</div>

Hi,

is there a way to trace the ip addresses of client requesting something not available on WSE instance?  
For example, on error log file I see the s request:

`WARN	server	comment	2022-11-02	13:03:35	-	-	-	-	-	1691453.676	-	-	-	-	-	-	-	-	Application folder ([install-location]/applications/-wvhttp-01-) is missing`

And this is what I see on access log file:

`2022-11-02	13:03:35	CET	comment	server	WARN	200	-	Application folder ([install-location]/applications/-wvhttp-01-) is missing	-	-	-	1691453.676	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-	-`

Application -wvhttp-01- doesn’t exists , but I’d like to know the ip address of the requester.  
I’d like to block bots or scripts that try to scan my server, asking some fake urls.

Why on the log files, if I request something not defined on WSE, my ip address is not traced?  
It’s traced only the good requests to the server, never the “bad” requests.

Kind regards,  
Dave

---

<div class="post-metadata">

**Author:** ![Connessione](https://avatars.discourse-cdn.com/v4/letter/c/43a26b/32.png) [@Connessione](https://community.wowza.com/u/Connessione)\
**Post date:** [November 4, 2022, 9:56am UTC](https://community.wowza.com/t/ip-addresses-on-log-files/95581/2 "2022-11-04T09:56:16Z")

</div>

Take a look at [this](http://community.wowza.com/t/logging-ip-addres-of-client-that-enters-to-manager/94484) post.

Another trick will be to actually create an app from live app called `-wvhttp-01-` and in java code trace the client’s address.

---

<div class="post-metadata">

**Author:** ![Dave\_Love1](https://avatars.discourse-cdn.com/v4/letter/d/58956e/32.png) [@Dave\_Love1](https://community.wowza.com/u/Dave_Love1)\
**Post date:** [November 4, 2022, 11:05am UTC](https://community.wowza.com/t/ip-addresses-on-log-files/95581/3 "2022-11-04T11:05:29Z")

</div>

Thank you,

I was thinking to add the live app and I’ll do it.  
But we have others request for “cam” “cam1” … and other names.  
I cannot add an app for each name.

---

<div class="post-metadata">

**Author:** ![Connessione](https://avatars.discourse-cdn.com/v4/letter/c/43a26b/32.png) [@Connessione](https://community.wowza.com/u/Connessione)\
**Post date:** [November 4, 2022, 12:56pm UTC](https://community.wowza.com/t/ip-addresses-on-log-files/95581/4 "2022-11-04T12:56:02Z")

</div>

If the requests are over HTTP/HTTPS you can perhaps try looking at OS level access logs ?

---

<div class="post-metadata">

**Author:** ![Dave\_Love1](https://avatars.discourse-cdn.com/v4/letter/d/58956e/32.png) [@Dave\_Love1](https://community.wowza.com/u/Dave_Love1)\
**Post date:** [November 4, 2022, 10:50pm UTC](https://community.wowza.com/t/ip-addresses-on-log-files/95581/5 "2022-11-04T22:50:00Z")

</div>

Do I have to log the firewall?  
I know that, using firewalld, I can log only the blocked requests, but not the good requests.  
Or is there another way?

---

<div class="post-metadata">

**Author:** ![Connessione](https://avatars.discourse-cdn.com/v4/letter/c/43a26b/32.png) [@Connessione](https://community.wowza.com/u/Connessione)\
**Post date:** [November 8, 2022, 12:17am UTC](https://community.wowza.com/t/ip-addresses-on-log-files/95581/6 "2022-11-08T00:17:57Z")

</div>

Try using something like tcpflow or something to monitor requests on the network interface.