Unfortunately, there's not a way to do that (that I know of), as the log files don't record that information. Since it's all traffic to one virtualhost, and you're using rewrite rules to substitute stuff for different subdomains, it does get ambiguous. As always though, I'm more than willing to change stuff if you can point me in a direction. If you find a way to do it, I'll be happy to change log file settings or anything.