We have IIS7 servers sitting behind an nginx reverse proxy.

The reverse proxy is sending the standard "HTTP_X_FORWARDED_FOR" header with the visitor IP address, but IIS7 logging is only logging the IP address of the nginx server (which makes sense, but it's not what I want).

How can I tell IIS7 to instead log the "HTTP_X_FORWARDED_FOR" header (or additionally log it)?

(note: I'm a linux admin, not a windows one, so explicit instructions & links are sincerely appreciated)


This isn't built into IIS, but there is a module you can install that will perform this functionality. It is called ARR helper, but it will work for any proxy in front of IIS:



There is now an IIS7 module that will let you log custom headers.

How to: http://learn.iis.net/page.aspx/579/advanced-logging-for-iis-70---custom-logging/


While the question is tagged with iis-7, this is the top hit when searching on X-Forwarded-For and IIS so I thought I would go ahead and provide this information for IIS 8.5.

IIS 8.5 and later

IIS 8.5 introduced the Enhanced Logging feature that easily allows the administrator to log HTTP request headers such as X-Forwarded-For. This answer is adapted from the linked page.

  1. Open IIS Manager.

  2. Select the site or server in the Connections pane, and then double-click Logging. Note that enhanced logging is available only for site-level logging - if you select the server in the Connections pane, then the Custom Fields section of the W3C Logging Fields dialog is disabled.

  3. In the Format field under Log File, select W3C and then click Select Fields....

  4. In the W3C Logging Fields dialog, click Add Field.... Note that enhanced logging is available only for site-level logging - if you selected the server in the Connections pane, then Add Field... is disabled.

  5. In the Add Custom Field dialog, enter a Field Name such as c-ip-original to identify the custom field within the log file. Please note that the field name cannot contain spaces.

  6. Select Request Header in the Source Type list.

  7. Enter X-FORWARDED-FOR in Source.

  8. Click OK.

  9. Click OK.

  10. Click Apply in the Actions pane to apply the new configuration.

Once the custom fields have been configured, IIS will create new text log files with "_x" appended to the file name to indicate that the file contains custom fields.

Note that the total size of data collected from all custom fields cannot exceed 65,536 bytes. If the total exceeds 65,536 bytes, then IIS will truncate the data.

  • This is exactly what I needed to get custom IIS W3C fields logged from my proxy server. Thank you! One important note...log folders should be owned by "Administrators" or "SYSTEM", and check that the W3C Logging Service is running.
    – rjkunde
    Jul 29 '20 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.