Getting Started

Apache website

Prepare Apache request logs and install the Honeylog sender.

Use this guide when the website runs on Apache. The installation requires access to the server terminal and Apache configuration. If you do not manage those areas yourself, send this guide together with the private Honeylog installation page to your hosting provider or server administrator.

#Before you begin

The person completing the installation must be able to edit the Apache configuration, run commands with administrator permissions, and reload Apache. They also need the ingestion secret shown in Honeylog under Settings > Installation > Apache.

#Step 1: Prepare Apache to record visits

  1. In Honeylog, open the website, go to Settings > Installation, and choose Apache.
  2. Copy the Apache log format below without changing the order of its fields.
  3. Add LogFormat to the Apache configuration and add CustomLog to the virtual host used by this website.
  4. If the server uses Debian or Ubuntu, enable mod_logio with the first command shown below.
  5. Run the configuration check. Continue only if Apache reports Syntax OK.
  6. Reload Apache.

This configuration creates /var/log/apache2/honeylog_access.log, the file used by the Honeylog sender. If the website must use a different location, change the path here and use the same path in the Honeylog installation page.

Apache log format:

# Includes Cloudflare-compatible browser context headers and response time.
# On Debian/Ubuntu, enable mod_logio before reloading: sudo a2enmod logio
LogFormat "%a %{X-Forwarded-For}i %l %u [%{%d/%b/%Y:%H:%M:%S %z}t] \"%{Host}i\" \"%r\" %>s %B \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Requested-With}i\" \"%{Accept-Language}i\" \"%{Sec-Fetch-Dest}i\" \"%{Sec-Fetch-Mode}i\" \"%{Sec-Fetch-Site}i\" \"%{Sec-Fetch-User}i\" \"%{Sec-Purpose}i\" \"%{Purpose}i\" \"%{X-Moz}i\" \"%{Sec-Speculation-Tags}i\" %I %O %D" honeylog
CustomLog /var/log/apache2/honeylog_access.log honeylog

Validate and reload Apache:

sudo a2enmod logio
sudo apachectl configtest
sudo systemctl reload apache2

After the reload, open a public page on the website and confirm that Apache adds a new line to /var/log/apache2/honeylog_access.log. That confirms the log is ready for the sender.

#Step 2: Install the Honeylog sender

  1. In the private Honeylog installation page, save the correct website address and log file path.
  2. Copy the generated install command and run it in the server terminal.
  3. When the terminal asks for the Honeylog ingestion secret, paste the secret shown on the installation page and press Enter. The secret is hidden while you type.
  4. Wait for the command to finish without errors.

Install script:

Open install.sh

Install command:

The public example below uses SITE_DOMAIN as a placeholder. Run the personalized command shown under Settings > Installation > Apache in Honeylog.

read -rsp "Honeylog ingestion secret: " HONEYLOG_INGESTION_SECRET
echo
export HONEYLOG_INGESTION_SECRET
export CLIENT_BASE_URL='https://api.honeylog.io/clients'
export HONEYLOG_API_URL='https://api.honeylog.io/events'
export HONEYLOG_SITE_DOMAIN='SITE_DOMAIN'
export HONEYLOG_LOG_PATH='/var/log/apache2/honeylog_access.log'
export HONEYLOG_SITE_SCHEME='https'
export HONEYLOG_EVENT_NAME='pageview'
export HONEYLOG_SKIP_PATH_REGEX='\.(?:css|js|mjs|map|png|jpe?g|gif|svg|ico|webp|avif|woff2?|ttf|eot|otf|xml|txt)$'
export HONEYLOG_BATCH_SIZE='100'
export HONEYLOG_TIMEOUT_MS='10000'
export HONEYLOG_POLL_INTERVAL_SECONDS='30'
export HONEYLOG_LOG_MAX_SIZE='100M'
export HONEYLOG_LOG_ROTATE_COUNT='14'
curl -fsSL "$CLIENT_BASE_URL/apache/install.sh" | bash

#Step 3: Verify the installation

Run the following commands on the server:

sudo systemctl status honeylog-apache.service --no-pager
sudo journalctl -u honeylog-apache.service -n 100 --no-pager

The service status should show active (running). Then open a few public pages on the website, wait about one minute, and confirm that the visits appear in Honeylog. If the service is not active or the visits do not appear, send the command output to the person responsible for the server or to Honeylog support.