Open for Voting

Have option to use "X-Forwarded-For" in Web Console Audit Log for Orion systems behind load balancer

I've recently put our system behind an F5 and noticed that all audit logs are showing the IP of the F5 VIP rather than the IP of the person using Orion.   In doing a little research there should be an option for using the "X-Forwarded-For" header to divulge the actual client if it exists.    

https://thwack.solarwinds.com/product-forums/server-application-monitor-sam/f/forum/50953/web-console-audit-log---showing-actual-login-ip-behind-load-balancer/267207#267207

  • Yes, I've confirmed that changing this on the IIS server only effects the IIS server itself.    As said in the request, it would be nice if Solarwinds would pick up on this header being present and log it in its events rather than log the IP of the load balancer, or maybe log it in addition to logging the load balancer IP.

  • Side note:   I did notice that in the "Message Center" that it doesn't log which server served up the request.   ie: I see that "cnorborg" logged in from a specific IP, but I don't know what server they connected to.   Would be nice to know if it was our primary or secondary HA poller, or if it was our web server (AWS).   That would be a nice addition to the logs?

  • So, this does work to log the requests to the local IIS logfile, but I don't think it has any effect on what SW logs.   Still working to test this.  I'm pretty sure SW gets its info via the HTTP headers, not by parsing the IIS logfiles.   Having some problems testing this though.

  • Does this work?

    techcommunity.microsoft.com/.../287878

    I'm asking because I don't know and don't have an F5 (or other LB) to play with.