If your web application always uses cookies to manage sessions, everything will be alright with changing your LogFormat and adding an option to register a specific cookie:
LogFormat ... \"%{JSESSIONID}C\" ... combined
, .
:
http://httpd.apache.org/docs/2.2/mod/mod_log_config.html#formats:
% {Foobar}
cookie Foobar , . cookie 0.
jsessionid, evene, url, - (, tomcat) :
response.setHeader("X-JSESSIONID", request.getSession().getId());
Apache RepsonseHeader
% {Foobar}
Foobar: .
- :
LogFormat ... \"%{X-JSESSIONID}o\" ... combined
. jsessionid, , , . tomcat, , sessionid.
String sessionId = request.getSession().getId();
String crypt = yourcryptalgo(sessionId);
response.setHeader("X-JSESSIONID", crypt);