You can use custom logging to add X-Forwarded-For field in iis Logging, the directory the custom logs are stored in: %SystemDrive%\inetpub\logs\LogFiles
.
- Open IIS Manager
- On server, site or application level, double click "Logging"
- Click "Select Fields"
- In “W3C Logging Fields” window, click “Add Field“
- In the “Add Custom Field” window, fill out the following fields
- Field Name: X-Forwarded-For, Source type: Request Header, Source: X-Forwarded-For
- Click ”OK" in both open windows
- Click “Apply” in the actions pane
Check out this post for more screenshots.
Note: If you see a dash (“-“) instead of an IP address in X-Forwarded-For column, it means the client didn’t use any proxies or load balancers. Therefore, the client IP must be logged in the “c-ip” column
If you see multiple IP addresses in X-Forwarded-For column, it means the client went through more than one network device. Each network device adds their own IP to the end of the value. The left-most IP address is the actual client IP address. Others belong to network devices the client go through.
If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.