Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two webservers hosting around 70 websites with load balancing done through Radware App Director.

I have an issue with Log Analysis. All the requests to the 70 odd sites are routed through App Director and as a result the source IP in the IIS Log files shows the IP of APP Director rather than the IP of the actual source of where the request is sent to the web site.

It's causing problems tracking the originating source IP when resolving issues with the specific sites.

Is there any solution to resolve this log anomaly so that the source IP in the IIS log reflects the IP of the actual source rather than the App Director's IP?

share|improve this question

migrated from Dec 19 '10 at 1:12

This question came from our site for computer enthusiasts and power users.

up vote 0 down vote accepted

I don't have any personal experience with Radware's products but many load-balancers that act like proxies have functionality built-in where they pass a custom HTTP Request header called X-Forwarded-For. The X-Forwarded-For header contains the end-user source IPs. It's possible that this header is already being sent to your servers--a simple wireshark trace and inspection of the request headers would confirm whether the X-Forwarded-For header is being passed along.

F5 has a freely available isapi filter than you can load in IIS that will replace the source IP in the IIS logs with the source IP pulled from the x-forwarded-for header. Radware may have one available as well but F5' is not F5 product-specific.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.