Consuming X-Forwarded-For Header from IIS Logs

wperry_or

I don't see any way to get SEM to consume the X-Forwarded-For header in IIS logs. Is there something I am missing?

Find more posts tagged with

exchange

nlb

iis 8.5

Accepted answers

All comments

npatterson

This depends on what connector you are using. if you want the x-forwarded logs this is in the IIS Advanced connector for your reference

jimf

Found this searching - I am using the "Microsoft IIS Web Server 8.5 (W3C Extended file format) Enhanced Logging" connector, even though my web server is IIS 10 (Server 2019), as there is no Enhanced logging connector for IIS 10. I am not seeing the X-Forwarded-For, or any option to grab it. Do you know specifically where to configure this? Thanks!

npatterson

I check my instance of IIS and if your want to have x-forwarded-for this are not on my default and have to add this in IIS to appear in the logs.

Add X-Forwarded-For column in IIS 8.5 and newer versions

Custom logging became easier to configure with the IIS 8.5. Follow the steps below to add X-Forwarded-For column into IIS logs.

Open IIS Manager
On server, site or application level, double click “Logging”
Click “Select Fields“
In “W3C Logging Fields” window, click “Add Field“
In the “Add Custom Field” window, fill out the following fields
- Field Name: X-Forwarded-For, Source type: Request Header, Source: X-Forwarded-For
Click “OK” in both open windows
Click “Apply” in the actions pane

this works for iis 10 and then it appears in the logs now I have not tested to see if sem is looking this because is it custom. you would need to custom the regex for the connector.

How that helps

jimf

The X-Forwarded-For data is being captured by IIS, I see it in the logfile. The issue is I cannot get SEM to ingest it. I have a case open for this - I will lets you know how that works out.