#933 IIS Advanced Logging for x-forward-for feild

[shalvin]

Hi Team,

Im happy to donate genoursouly if you can fix my problem please. easy but i cannot fix.
This might be an issue everyone is having.
AWSTATs is on windows 2008r2. Webserver is IIS .75.
I have a reverse proxy between the client and the Webserver
I need to capture the x-forwarded-for feild instead of c-ip.
editing of c-ip is not available in iis so you have to install the advanced logging module.

I have install and enabled Advanced logging on IIS. When collecting the logs ->
all logs (or hits) are put into ---> Not viewed traffic * (on the AWSTATS statics page for that site.)

using the standard logging it works fine(but you cant capture x-forwarded-for). Only when you capture the logs through advanced logging.

I have narrowed it down to -
in standard logging -> which works fine
Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+Trident/5.0)

in IIS advanced logging -> which puts everything into "Not viewed traffic *"
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

See the + symbols is the difference.... this is the issue.
can you please advise how I can resolve this.

I believe that everyone has this issue.
I will donate genoursouly.... its not coming out of my pocket.. company is paying they just want it fixed.

Cheers,

[Ed Lewis]

will using ARR Helper give you what you need? It places the x-forwarded-for IP in the c-ip of the IIS logs.

I believe if caching is turned on it may report 404s as the proxy IP though. We use ARR helper with all caching turned off and it seems to work fine.