RE: Logging Inbound Web Requests
- From: "Jim Harrison" <Jim@xxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Thu, 16 Mar 2006 12:25:31 -0800
Consider:
1. IIS logs the client address based on the TCP connection between it and the
actual client host
2. Regardless of what you send in the HTTP headers, IIS will continue to log
this data according to point #1
If you want ISA to log in W3C format, change it from MSDE (or SQL) to text.
-------------------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
-------------------------------------------------------
-----Original Message-----
From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx]
Sent: Thursday, March 16, 2006 12:18
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Logging Inbound Web Requests
http://www.ISAserver.org
Hello,
I don't expect ISA Logs to be identical to IIS logs. They are in fact very
different things.
If you just set up an IIS server and serve up some web pages the logs have a
certain set of fields based on the configuration.
If you then move that IIS server behind ISA and publish the web site the logs
have the exact same set of fields (assuming you left the fields alone) with one
major difference. The client IP address will always be that of the ISA server
just as it should be.
In my situation the ISA server that I use for publishing web pages is not the
default route to the internet so the suggestion that John made:
"1. In ISA publish rule, configure to send all requests as they appear from the
client, not ISA."
won't work in my situation (unless I am missing something). All of the
information I am after is available to the ISA server and actually gets passed
through to the published IIS server (again less the "real" client IP address).
However just because the information is available doesn't mean I can get at it.
Hence my question was is there a way to grab this information on the ISA server
and create a second log file in the W3C format or alternatively have actual
client IP address information sent to the IIS server without having the ISA
server as the default route to the internet. I would think the first method
would be easier. A filter that would log the request and format it and dump to
a file without really filtering anything would seem to be what I am after. I
just don't have any experience writing filter for ISA which is why I was asking
the question.
Thanks
Bill
-----Original Message-----
From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx]
Sent: Wednesday, March 15, 2006 2:51 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Logging Inbound Web Requests
http://www.ISAserver.org
Don't expect IIS logging from your proxy.
They 're very different animals with completely different focus.
Each one logs according to its own needs.
-------------------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
-------------------------------------------------------
-----Original Message-----
From: Alexandre Gauthier [mailto:gauthiera@xxxxxxxxxxxxxxxxx]
Sent: Wednesday, March 15, 2006 11:43
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Logging Inbound Web Requests
http://www.ISAserver.org
I would very much appreciate if someone could enlighten me on this as well, I
wonder how you can achieve the same logging detail with a reverse proxy as you
would get with the server directly facing the internet...
________________________________
From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx]
Sent: Wednesday, March 15, 2006 12:27 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] Logging Inbound Web Requests
http://www.ISAserver.org
Hello,
I use ISA Server 2004 to publish several web sites from our IntraNet. I
collect logging information however the ISA Web Proxy Log has several fields
that differ from a Web Server Log (as would be expected). There are also some
important fields missing such as the referrer. My question is as follows. Can a
filter be created that will create a logfile in the "Standard" W3C Extended Log
Format? Has anyone already done this.
Thanks
Bill
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
gauthiera@xxxxxxxxxxxxxxxxx To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
All mail to and from this domain is GFI-scanned.
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
wtholmes@xxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
All mail to and from this domain is GFI-scanned.
Other related posts:
