The key to configuring IIS logging in a load balancing environment is to ensure log integrity and traceability. 1. Enable and configure IIS logging, use W3C to extend log format, unify log storage paths, and set reasonable log scrolling frequency. 2. Record the client's real IP, set the X-Forwarded-For header through the load balancer, and configure the URL rewrite module and ARR on IIS to write it to the log. 3. Implement centralized log management and time synchronization, use tools such as ELK or Splunk to collect logs in a centralized manner, and ensure that all server time zones are consistent and NTP synchronization is enabled. 4. Avoid log duplication and missing, track the request link through X-Request-ID, record additional information through the application layer, and adopt asynchronous persistent log writing to reduce the difficulty of troubleshooting problems.

The key to configuring IIS logging in a load balancing environment is to ensure log integrity and traceability. Without adjustments, the default log settings may not accurately reflect user behavior, especially when requests pass through multiple nodes or proxy.

1. Enable and configure IIS logging

Logging is enabled by default by IIS, but to adapt to load balancing environments, it is recommended to check and adjust the following settings:

• Log format : It is recommended to use the W3C extended log format, which supports custom fields to facilitate recording more context information.
• Log path : It is recommended to unify log storage paths to facilitate subsequent central collection and analysis.
• Log scrolling frequency : Choose the appropriate time interval (such as daily or hourly) based on the number of visits to avoid excessive size of a single log file.

Open the Log settings in IIS Manager, you can adjust these parameters or configure them through the web.config or applicationHost.config file.

2. Record the client's real IP (X-Forwarded-For)

In a load balancing environment, requests received by IIS usually come from the load balancer, so the log may be the IP of the load balancer, rather than the real IP of the client.

The solution is:

• Set X-Forwarded-For request header on a load balancer such as Nginx, HAProxy, or AWS ALB.
• Install and configure the URL Rewrite Module and ARR (Application Request Routing) on IIS to ensure that X-Forwarded-For can be recognized and recorded.
• Use the W3C custom field to write X-Forwarded-For value to the log.

This step is very critical, otherwise you will encounter difficulties in subsequent analysis of user access behavior or performing security audits.

3. Centralized log management and time synchronization

To facilitate unified analysis, it is recommended to store logs from all servers in a centralized manner, for example:

• Use tools such as LogParser, ELK (Elasticsearch, Logstash, Kibana) or Splunk to collect logs.
• Upload log files through Windows Event Forwarding or a third-party log agent.
• Make sure all servers use the same time zone and enable NTP time synchronization.

If the time between servers is inconsistent, it will lead to confusing log sequence and affecting problem investigation.

4. Avoid duplication and missing logs

Under load balancing, some requests may be sent to multiple nodes due to retry or timeout, which may cause duplication of logs. In addition, if the log is written asynchronously and the server suddenly goes down, it may also lead to log loss.

Coping methods include:

• Track the entire request link with a unique request identifier such as X-Request-ID .
• Log additional context information into the log at the application layer.
• Consider using asynchronous persistent log writing method to reduce performance impact while reducing the risk of loss.

Basically that's it. The configuration is not complicated, but many details are easy to ignore, especially the real IP and centralized log processing part. It is recommended to do a complete log link test before going online.

The above is the detailed content of IIS logging in a load-balanced environment. For more information, please follow other related articles on the PHP Chinese website!