IIS log files and load balancer?

I don't know how long it's been around, but the Advanced Logging extension for IIS 7 and up (on Windows Server 2008 and up) offers Custom logging functionality which can be used to gather (almost) arbitrary information in IIS log files, including custom HTTP request (and response) headers like X-Forwarded-For.

I've just today set this up on our server and it works beautifully.

One thing to note: instead of editing the default Log Definition by the name of %COMPUTERNAME%-Server, just create a new one on your site or globally on your server to avoid the exception "The request is not supported." when trying to save your changes. This happens when you try to edit that default definition on the site level (thanks to this thread for the answer).

When going through a proxy you the x-forwarded-for is what is most commonly used by load balancers. You can probably write an httpfilter which will swap this around yourself; or IIS Tracer has the ability to play with the standard files; including swapping the c-ip and x-forwarded field.

If this isnt being done for the use of a third party reporting tool; you might want to dump your logs into SQL Server where you can manipulate the columns whenever you want.

Personally i go for the latter so that i can get aggregate data for all the servers; i dump into different tables in the same db and then report from all the web servers in the farm. I also find it easier than managing 500mb or so log files all over the place.

F5 networks offers an ISAPI filter on devcentral.f5.com that will take x-forwarded-for and use it in the logs.

Beyond that, though, there's not much you can do - this is how TCP works. :)