I have a really strange issue with logging the x-forwarded-for header in IIS logs on a few particular servers.
The log looks like this:
#Software: Microsoft Internet Information Services 8.5
#Version: 1.0
#Date: 2021-05-04 00:00:12
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2021-04-20 11:24:51 2000000a3+X-Forwarded-For+-+ serverxxx x.x.x.x GET /path/path/paths.png - 443 - x.x.x.x HTTP/1.1 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/538.1+(KHTML,+like+Gecko)+PhantomJS/2.1.1+Safari/538.1 ASPSESSIONIDSXXXXX=XXXXXX https://website.company.net/path/path/paths.asp sitename.company.net 200 0 0 51636 465 45
As you can see, the x-forwarded-for info looks all kinds of weird and it appears after the date/time. I have 5 x Windows Server 2012 R2 IIS servers which all have the problem. I have another ~50 servers which are absolutely fine. On the 50 servers that are
OK, the x-forwarded-for field appears in the #fields of the log and correctly as the last entry of a line.
I have the logging field setup uniformly across all the servers on the IIS root as it was done via a script.
The IIS log file name doesn't get the _x at the end of the filename like the other servers do.
![]()
I can see in the applicationHost.config we have the following, which is exactly the same between a working server and a non working server. There are no other entries in there for <LogFile>
<siteDefaults><logFile logExtFileFlags="Date, Time, ClientIP, UserName, SiteName, ComputerName, ServerIP, Method, UriStem, UriQuery, HttpStatus, Win32Status, BytesSent, BytesRecv, TimeTaken, ServerPort, UserAgent, Cookie, Referer, ProtocolVersion, Host, HttpSubStatus" logFormat="W3C" directory="%SystemDrive%\inetpub\logs\LogFiles"><customFields><clear /><add logFieldName="X-Forwarded-For" sourceName="X-Forwarded-For" sourceType="RequestHeader" /></customFields></logFile><traceFailedRequestsLogging directory="%SystemDrive%\inetpub\logs\FailedReqLogFiles" /></siteDefaults>
Does anyone have any idea why this is happening?
