How to replace "C-IP" value on IIS log in Windows 2019 Server

Question

Hello All,

We are trying to capture customer IP address in IIS log file. We been using F5XFFHttpModule for over 10 years or more on all windows 2016 OS and everything works fine.

However, on Windows 2019 with IIS 10.0 version the module "F5XFFHttpModule" does not work. Would you please advise what is the alternative approach to get customer IP address which should map to "C-IP" value in IIS log.

Also, tried several recommendation here.

https://learn.microsoft.com/en-us/iis/extensions/advanced-logging-module/advanced-logging-for-iis-custom-logging#custom

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/general/customize-iis-log-file-field-names

Thanks you.
Deepu

Answer 1

Hi @Madhusoodanan, Deepu ,

According to my research, neither the unofficial F5XFFHttpModule nor the Advanced Logging Module for IIS7 will work in IIS10. Since IIS8.5, the enhanced IIS log has been used uniformly, which is the default log module in IIS10. In this module you can add custom fields to map the X-forward-for response header to get the client IP, but it doesn't allow you to map to the c-ip field. This is method 1.

Method 2, as a workaround, you can use the ARR helper to force c-ip to map x-forward-for. But I don't recommend you to do this, in my tests it was not stable, could cause the app pool to stop and crash for no reason, and not every request would record the client IP accurately.

If you has installed ARR3(must be ARR3) on server, please navigate to C:\Program Files\IIS\Application Request Routing. Find requestrouterhelper_x64.msi and click it to install, requestrouterhelper_x86.msi for 32-bit system. Then it will auto create a ARR Helper folder in C:\Program Files\IIS and add it into IIS module.

Then click ISAPI and CGI restrictions module on IIS, add the helper in it, like this:

Please Note: This method is not stable and may cause the problems mentioned above. I don't recommend you to use it. Please use method 1.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,
Bruce Zhang

Answer 2

Thanks, BruceZhang-MSFT.

We got solved the problem by installing latest F5module from the website,

Answer 3

Hi @Bruce Zhang-MSFT

Thanks, Hopefully IIS team will come up with some option on version 10 Windows 2019.