IIS log files and load balancer?

Question

We host our ASP.NET applications on two web servers (Server 2003, IIS 6) that reside behind a hardware load balancer. When I look at the IIS logs, the c-ip value in the IIS (v6) logs are ALWAYS the IP address of the load balancer. I noticed in the http headers, there is an X-Forwarded-For header that appears to have the requesting IP address. Is there something I can do to make IIS log this header value in the logs?

Answer 1

When going through a proxy you the x-forwarded-for is what is most commonly used by load balancers. You can probably write an httpfilter which will swap this around yourself; or IIS Tracer has the ability to play with the standard files; including swapping the c-ip and x-forwarded field.

If this isnt being done for the use of a third party reporting tool; you might want to dump your logs into SQL Server where you can manipulate the columns whenever you want.

Personally i go for the latter so that i can get aggregate data for all the servers; i dump into different tables in the same db and then report from all the web servers in the farm. I also find it easier than managing 500mb or so log files all over the place.

Answer 2

F5 networks offers an ISAPI filter on devcentral.f5.com that will take x-forwarded-for and use it in the logs.

Beyond that, though, there's not much you can do - this is how TCP works. :)