IIS - Source IP Log Analysis

Question

I'm having 2 web-servers hosting around 70 websites. The load balancing is done through Radware App Director. I have an issue with the logs Analysis, since all the requests to the 70 odd sites is routed through App Director, the source IP in the IIS Log files shows the IP of APP Director , rather than the IP of actual source from where the request is sent to the web site. So I face a hell lot of problems to track the originating source IP when resolving issues with the specific sites. Is there any solution to resolve this Log anomaly so that the source IP in the IIS Log reflects the IP of the actual source rather than the App Director's IP?

Answer 1

This is possible to do by capturing and passing through X-Forwarded-For. If you do a search for that I imagine you will find the answer you are looking for. We are load balancing through an F5 BigIP Load balancer and had thesame issue. There is an option on the F5 to "enable X-Forward-For" and an ISAPI on the IIS servers to interpret and write it as the clientIP in the IIS logs.