How to enable mod_rewrite detailed logging

your apache log files location varies by system. from cyberciti.biz:

• RHEL / Red Hat / CentOS / Fedora Linux Apache error file location - /var/log/httpd/error_log
• Debian / Ubuntu Linux Apache error log file location - /var/log/apache2/error.log
• FreeBSD Apache error log file location - /var/log/httpd-error.log

In the future, either make a backup of your .conf file before editing it, named with the datestamp of the change so that worst come to this, you can recover to a previous version OR, only comment out changed lines and add comments to new lines so you can keep track of what changed when and why. editing without a way to go back is one guaranteed way to attract bad mojo.

SSL connections have extra options for CustomLog but they're not going to break down the step-by-step connection status. You'll probably want to try LogLevel debug, but that will get you plenty of extra junk to wade through.

Honestly, a better idea for this class would be to demonstrate using the openssl s_server command, since it can be configured to show the step-by-step progress of the SSL state machine, you'll be able to see exactly at what step the client dropped the connection.

Something like

openssl s_server -key [somekey.pem] -cert [somecert.pem] -accept 443 -state -www 

When someone connects it'll print off the steps of the connection:

SSL_accept:before/accept initialization
SSL_accept:SSLv3 read client hello A
SSL_accept:SSLv3 write server hello A
SSL_accept:SSLv3 write certificate A
SSL_accept:SSLv3 write key exchange A
SSL_accept:SSLv3 write server done A
SSL_accept:SSLv3 flush data
SSL_accept:SSLv3 read client key exchange A
SSL_accept:SSLv3 read finished A
SSL_accept:SSLv3 write change cipher spec A
SSL_accept:SSLv3 write finished A
SSL_accept:SSLv3 flush data

the -www option makes it print some information when someone actually connects to it with a webbrowser. If the user navigates away without accepting the fake cert, then I'm guessing the connection will be broken somewhere in the middle there.

You can use the openssl s_client command in a similar fashion, though I'm not certain how flexible it is about accepting or not accepting invalid certificates.