IIS log files and load balancer?

Question

We host our ASP.NET applications on two web servers (Server 2003, IIS 6) that reside behind a hardware load balancer. When I look at the IIS logs, the c-ip value in the IIS (v6) logs are ALWAYS the IP address of the load balancer. I noticed in the http headers, there is an X-Forwarded-For header that appears to have the requesting IP address. Is there something I can do to make IIS log this header value in the logs?

Answer 1

I don't know how long it's been around, but the Advanced Logging extension for IIS 7 and up (on Windows Server 2008 and up) offers Custom logging functionality which can be used to gather (almost) arbitrary information in IIS log files, including custom HTTP request (and response) headers like X-Forwarded-For.

I've just today set this up on our server and it works beautifully.

One thing to note: instead of editing the default Log Definition by the name of %COMPUTERNAME%-Server, just create a new one on your site or globally on your server to avoid the exception "The request is not supported." when trying to save your changes. This happens when you try to edit that default definition on the site level (thanks to this thread for the answer).