Client IP in IIS Log (W3C Externded Format) : Inetserver
This is a discussion on Client IP in IIS Log (W3C Externded Format) within the Inetserver forums in Microsoft Tools category; Hello, I actually have a couple of questions about this: 1- In my IIS log, the client IP that shows up is an internal IP (non-unique) )and not an external IP. Why is this happening ? 2- Can I get the username (I use forms authentication) to show up in this log ? Thanks...
| Inetserver Microsoft Inet server asp, iis, ftp, smtp and security related discussions |
![]() |
| | LinkBack | Thread Tools |
|
#1
| |||
| |||
| I actually have a couple of questions about this: 1- In my IIS log, the client IP that shows up is an internal IP (non-unique) )and not an external IP. Why is this happening ? 2- Can I get the username (I use forms authentication) to show up in this log ? Thanks |
|
#2
| |||
| |||
| On Mar 26, 2:04*am, Mourad <Mou...@discussions.microsoft.com> wrote: > Hello, > I actually have a couple of questions about this: > 1- In my IIS log, the client IP that shows up is an internal IP (non-unique) > )and not an external IP. Why is this happening ? > > 2- Can I get the username (I use forms authentication) to show up in this > log ? > > Thanks 1. You have a proxy/loadbalancer which is handling all external traffic and making requests to your IIS server. Thus, the IIS server only sees that server making requests to it -- thus its internal IP is logged -- and not the IP of the clients connecting to the Proxy server. You will need to configure your Proxy Server to forward the real client IP to IIS, possibly as an HTTP header, and you can use this ISAPI Filter to make the real client IP show up in the IIS log. http://blogs.msdn.com/david.wang/arc...S-Servers.aspx 2. You will need to write your own ISAPI Log filter to accomplish this. IIS has fields for users that perform Windows Logon, but Forms Authentication never performs Windows Logon so it never gets logged. Ways to get username into the log file: a. custom ISAPI Filter to do this mapping b. custom ISAPI Extension which sets the username on its HSE_REQ_EXEC_URL call and is configured as Wildcard Application Mapping c. use AppendLog() in your ASP.Net application to tack the username onto the log entry (just not in the cs-username field) //David http://w3-4u.blogspot.com http://blogs.msdn.com/David.Wang // |
|
#3
| |||
| |||
| Thanks for your help. However, I think it would be easier for me to write my own logger. One that possibly logs the username/IP to a database for easier access. Thanks. "David Wang" wrote: > On Mar 26, 2:04 am, Mourad <Mou...@discussions.microsoft.com> wrote: > > Hello, > > I actually have a couple of questions about this: > > 1- In my IIS log, the client IP that shows up is an internal IP (non-unique) > > )and not an external IP. Why is this happening ? > > > > 2- Can I get the username (I use forms authentication) to show up in this > > log ? > > > > Thanks > > > 1. You have a proxy/loadbalancer which is handling all external > traffic and making requests to your IIS server. Thus, the IIS server > only sees that server making requests to it -- thus its internal IP is > logged -- and not the IP of the clients connecting to the Proxy > server. > > You will need to configure your Proxy Server to forward the real > client IP to IIS, possibly as an HTTP header, and you can use this > ISAPI Filter to make the real client IP show up in the IIS log. > > http://blogs.msdn.com/david.wang/arc...S-Servers.aspx > > 2. You will need to write your own ISAPI Log filter to accomplish > this. IIS has fields for users that perform Windows Logon, but Forms > Authentication never performs Windows Logon so it never gets logged. > > Ways to get username into the log file: > a. custom ISAPI Filter to do this mapping > b. custom ISAPI Extension which sets the username on its > HSE_REQ_EXEC_URL call and is configured as Wildcard Application > Mapping > c. use AppendLog() in your ASP.Net application to tack the username > onto the log entry (just not in the cs-username field) > > > //David > http://w3-4u.blogspot.com > http://blogs.msdn.com/David.Wang > // > |



