IIS Log Request Body / POST Data

Question

Does anyone know how I could get IIS to log POST data or the entire HTTP request?

Answer 1

The IIS logs only record querystring and header information without any POST data.

If you're using IIS7, you can enabled Failed Request Tracing for status code 200. That will record all of the data and you can select which type of data to include.

In either IIS6 or 7, you can use Application_BeginRequest in global.asax and create your own logging of POST data.

Or, in IIS7, you can write a HTTP Module with your own custom logging.

Answer 2

In managed code you can use the Response.AppendToLog method.  This method will append data to the cs-uri-stem field -- the total length is up to 4100 characters (undocumented).  If you exceed that limit, then the value that would have been logged is replaced with "..."

For instance, adding something like this to your Global.asax file should do the trick (C#):

void Application_EndRequest(Object Sender, EventArgs e)
{
    if( "POST" == Request.HttpMethod )
    {
        byte[] bytes    = Request.BinaryRead(Request.TotalBytes);
        string s    = Encoding.UTF8.GetString(bytes);
        if (!String.IsNullOrEmpty(s))
        {
            int QueryStringLength = 0;
            if (0 < Request.QueryString.Count)
            {
                QueryStringLength = Request.ServerVariables["QUERY_STRING"].Length;
                Response.AppendToLog( "&" );
            }

            if (4100 > ( QueryStringLength + s.Length ) )
            {
                Response.AppendToLog(s);
            }
            else
            {
                // append only the first 4090 the limit is a total of 4100 char.
                Response.AppendToLog(s.Substring(0, ( 4090 - QueryStringLength )));
                // indicate buffer exceeded
                Response.AppendToLog("|||...|||");
                // TODO: if s.Length >; 4000 then log to separate file
            }
        }       
    }
}
 

Answer 3

Try enabling the following in your IIS log settings:

Method (cs-method)

URI Stem (cs-uri-stem)

URI Query (cs-uri-query)