iis 6、7、8或更高版本，解決 nginx、f5 負載均衡後 wwwlogs 日誌中不能記錄 X-Forwarded-For 真實ip 問題

 iis 6、7、8或更高版本，解決 nginx、f5 負載均衡後 wwwlogs 日誌中不能記錄 X-Forwarded-For 真實ip 問題

 

 

The solution - how to modify logging behaviour

The steps required depend on your version of IIS.

IIS 8.5 & later

A custom logging field can be added to record XFF headers.

To enable this feature:

1. Start IIS Manager, then on the Connections pane on the left, click the appropriate website where you want to enable XFF logging. The Home page is then displayed in the main panel.
2. From the Home page, double-click Logging.
3. From the Log File section, click Select Fields.
4. From the bottom left corner, click Add Field.
5. In the Add Custom Field window, complete the following:

• in Field Name, type X-Forwarded-For
• in Source, type X-Forwarded-For
• leave Source Type set to ‘Request Header’
• click OK on the Add Custom Field window
• click OK on the W3C Logging Fields window

1. From the Actions pane on the right, click Apply to implement the change.
2. The log files are located by default in the directory %SystemDrive%\inetpub\logs\LogFiles. IIS creates new log files and appends “_x” to the log file names to indicate that they contain custom fields.

UIIS 7 & IIS 7.5

Advanced Logging 下載地址：http://www.microsoft.com/en-gb/download/details.aspx?id=7211

For IIS 7 & 7.5 the Advanced Logging add-on must be installed. This can be downloaded here. Once installed on the IIS server, you'll see an extra option called 'Advanced Logging' in IIS.

To configure and enable Advanced Logging:

1. Start IIS Manager, then on the Connections pane on the left, click the server, website or directory where you want to configure Advanced Logging. The related Home page is displayed in the main panel.
2. From the Home page, under IIS, double-click Advanced Logging.
3. From the Actions pane on the right, click Enable Advanced Logging.
4. From the Actions pane on the right, click Edit Logging Fields.
5. On the Edit Logging Fields window click Add Field, and then complete the following:

• in Field ID, type ClientSourceIP
• in Category, type *Default *
• in Source type, select Request Header
• in Source name, type X-Forwarded-For
• click OK on the Add Logging Field form
• click OK on the Edit Logging Fields form

1. From the Actions pane on the right, click Add Log Definition.
2. Enter Client Source IP in the Base file name field.
3. Click Select Fields.

• Check (enable) the ClientSourceIP field created earlier

1. Click OK on the Select Logging Fields form, then click Apply in the actions pane.
2. Click Return To Advanced Logging in the actions pane.
3. Run iisreset /restart to apply the new settings.
4. The advanced log must be viewed rather than the default log. The advanced log is located in %SystemDrive%inetpublogsAdvancedLogs. To view the logs, right-click the Client Source IP log definition and click View Log Files.

IIS 6

iis6 沒有官方的支持

f5 封裝的 dll 可以使用，http://downloads.loadbalancer.org/F5isapifilter/F5XForwardedFor.zip

Unfortunately, the Microsoft solution mentioned above is not available for IIS 6. Luckily there are a number of other solutions - some costing money and others that have been released as open source. One excellent example that we've tested with our products is F5's X-Forwarded-For ISAPI filter. It's available in both in 32- and 64-bit versions.

1. Download the zipped archive from here and extract to an appropriate folder.
2. Navigate to the relevant version (32- or 64-bit).
3. Copy F5XForwardedFor.dll to a suitable location on your server, e.g. C:ISAPIfilters.
4. Make sure you have ISAPI Filters enabled on your IIS server.
5. Open IIS Manager, right-click the site and select Properties.
6. Select the ISAPI Filters tab.
7. Click add, then in the popup enter a suitable name and select the DLL file stored in step 3.
8. Restart your website.

Problem solved - for IIS 7 and above, you should see an additional column named X-Forwarded-For which contains the IP addresses of client PC’s. For IIS 6 the IP address of the load balancer should be replaced with the IP address of client PC’s.

Found in

X-Forwarded-For Header (XFF), Top 10 Blogs

 

一、IISWeb服務器解決方案
1、爲了能讓IISWeb服務器記錄客戶訪問的真實IP地址，我們需要爲IISWeb服務器的ISAPI加入一個名爲“F5XForwardedFor”的擴展。
2、加入擴展的步驟
(1)下載“F5XForwardedFor.dll”庫文件（見最後附件下載），有兩個版本：X86與X64。
(2)根據您服務器的版本選擇對應的庫文件，如果您的Web服務器是32位系統，則選擇X86的庫文件，如果是64位操作系統則選擇X64對應庫文件。
(3)將下載下來的“F5XForwardedFor.dll”文件複製到“C:\Windows\System32\”目錄中。
(4)配置IIS，在ISAPI中加入“F5XForwardedFor.dll”擴展，方法如下：
    右鍵網站-》屬性-》ISAPI 篩選器-》添加-》瀏覽選擇 F5ForwardedFor.dll 後點擊【確定】
3、在“C:\Windows\System32\”目錄中新建一個名爲“F5XForwardedFor.ini”的文件，內容爲：
    [SETTINGS]
    HEADER=X-Forwarded-For
4、重啓IISWeb服務器（開始菜單->運行->iisreset）