Customize HTTP access log in WSO2 API Manager 3.2.0 for custom request headers - wso2

Question

We followed below documentation to print custom request headers in HTTP access log but facing some challenges
URL: https://apim.docs.wso2.com/en/3.2.0/administer/logging-and-monitoring/logging/monitoring-http-access-logs/
**Option 1**: We added below entries in /repository/conf/deployment.toml file
[http_access_log]
useLogger = true
pattern = "%{X-Forwarded-For}i %h %l %u %t %r %s %b %{Referer}i %{User-Agent}i %{X-Custom-Header}i %T"
The changes are reflecting in HOME\repository\conf\tomcat\catlina-server.xml but the custom headers are not getting printed.
**Option 2**: Created a separate log file as mentioned in "Configuring access logs for PassThrough or NIO transports in API Gateway" section. With this we are able to print the custom headers but the response code is not getting printed. It is appearing as "-".
Log format: access_log_pattern=%{X-Forwarded-For}i %h %l %u %t %r %s \"%{Referer}i\" \"%{User-Agent}i\" %{X-Custom-Header}i %B
Example log entry: - 10.73.122.48 - - [06/Dec/2022:14:49:36.628 +0530] "GET /mcm-stubs/testservice HTTP/1.1" **-** "-" "Synapse-PT-HttpComponents-NIO" "-" -
Please help

Answer 1

There are two sets of Access logs in API Manager. One for the Servlet components(Store/Publisher etc. what you access through ports 9443 and 9763) and the second for the Passthrough Transport(Accessed through 8280 and 8243). Sevlet Access Logs are handled by a Tomcat value and these configs can be changed by altering the deployment.toml which would reflect in the catlina-server.xml. These logs will be written to a separate file.
The Passthrough transport is where you will be receiving the actual API traffic and inorder to change the format. First, add the logger configs to <APIM_HOME>/repository/conf/log4j2.properties.
# Add the new logger to this line
loggers = PassThroughAccess, AUDIT_LOG, SERVICE_LOGGER, trace-messages,..........
# Define the new logger
logger.PassThroughAccess.name = org.apache.synapse.transport.http.access
logger.PassThroughAccess.level = INFO
Then create a new file named access-log.properties in <APIM_HOME>/repository/conf directory with the following content.
# Default access log pattern examples
#access_log_pattern=%{X-Forwarded-For}i %h %l %u %t \”%r\” %s %b \”%{Referer}i\” \”%{User-Agent}i\”
#access_log_pattern=time=%t remoteHostname=%h localPort=%p localIP=%A requestMethod=%m requestURL=%U remoteIP=%a requestProtocol=%H HTTPStatusCode=%s queryString=%q
# combinded log pattern
access_log_pattern=%h %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Custom-Header}i\"
# file prefix
access_log_prefix=http_gw
# file suffix
access_log_suffix=.log
# file date format
access_log_file_date_format=yyyy-MM-dd
Now restart the server and when you access an API the Access logs will be logged to a new file with the name you give in the above config. With the above configs logs will be written to <APIM_HOME>/repository/logs/http_gw.log
If this is a response header. You need to use the following pattern to get the header.
# To get a custom response Header
%{X-Custom-Header}o
# TO Get response code
%s
# A complete pattern
access_log_pattern=%h %l %u %t \"%r\" %s %b \"%{User-Agent}i\" customHeader=%{X-Custom-Header}o responseCode=%s
Update
You can't log the request headers in the response path. They will be logged in two separate lines, hence is difficult to correlate. One option is to pass the Custom Header to the backend and ask the backend to return the header with the response. Then you would see the same header in both request and response logs.
As Lakshitha mentioned another option is to manually log the header and the response. In order to do this, first, you need to extract the custom request header in the request path and then log it in the response path. There are two ways to do this, one is by creating a custom handler.
Another option is to use custom mediation policies. You can use the following two sequences for this. (Create following two files and upload them as custom policies)
Request: extractHeader.xml
<sequence xmlns="http://ws.apache.org/ns/synapse" name="extractHeader">
<property name="CUSTOM_HEADER" expression="$trp:X-Custom-Header" scope="default" />
</sequence>
Response: log_response_code.xml
<sequence xmlns="http://ws.apache.org/ns/synapse" name="log_in_response_code">
<log level="custom">
<property name="Header" expression="$ctx:CUSTOM_HEADER"/>
<property name="StatusCode" expression="$axis2:HTTP_SC"/>
</log>
</sequence>
Once applied it will look like this.

Answer 2

Option 2 is the correct approach to logging the API traffic. If you followed the steps in [1], for each request, there will be four lines of logs printed in the http_gw_<date>.log file. Those would be generated based on,
Request received by the gateway
Request passed to the backend
Response received from the backend
Response out from the gateway
You won't be able to log the response code in 1st and 2nd log lines as at that moment, the server is still yet to receive a response.
If your requirement is to log the custom header received from the gateway, you can easily achieve this with a mediator as below.
<log level="custom">
<property name="Header" expression="get-property('transport','X-Custom-Header')"/>
</log>
[1]- https://apim.docs.wso2.com/en/3.2.0/administer/logging-and-monitoring/logging/monitoring-http-access-logs/#configuring-access-logs-for-passthrough-or-nio-transports-in-api-gateway