Apache logs -- what is difference between %a and %h?

Question

%a is "Remote IP-address" and %h is "Remote host", but when I test it, both print out the same IP addres. What's the difference?

sample log output for log format "%a %h:

192.168.1.2 192.168.1.2
192.168.1.2 192.168.1.2
192.168.1.2 192.168.1.2

Answer 1

The remote host value tries to perform a DNS lookup on the IP address to give you a hostname, if the resolveHosts attribute is set to True. If not, remote host just returns the remote IP address.

Answer 2

%h is the host name and %a is the IP address. %h will only show the host name if apache is doing name resolution. This can signficantly slow down your server and is generally not recommended.

The following description of %h is taken directly from the Apache documentation :-

This is the IP address of the client (remote host) which made the request to the server. If HostnameLookups is set to On, then the server will try to determine the hostname and log it in place of the IP address. However, this configuration is not recommended since it can significantly slow the server. Instead, it is best to use a log post-processor such as logresolve to determine the hostnames. The IP address reported here is not necessarily the address of the machine at which the user is sitting. If a proxy server exists between the user and the server, this address will be the address of the proxy, rather than the originating machine.