logging all HTTP requests

[Andy Fish]

Hi,

I am wondering if there is any way to log the HTTP traffic on an IIS server
(including headers but preferably the body as well), either at the IIS or
asp.net level

I know I could write my own isapi dll or .net filter, but I was rather
hoping someone else has already done it. I'm sure it's quite a common
requirement

Andy

 

[Guest]

Hi,

I am wondering if there is any way to log the HTTP traffic on an IIS server
(including headers

What about IIS log?

 

[Andrew Morton]

I am wondering if there is any way to log the HTTP traffic on an IIS
server (including headers but preferably the body as well), either at
the IIS or asp.net level

I know I could write my own isapi dll or .net filter, but I was rather
hoping someone else has already done it. I'm sure it's quite a common
requirement

Wireshark (formerly Ethereal)?

Andrew

 

[Andy Fish]

What about IIS log?

do you mean the standard log file which appears automatically in the
windows/system32 (WTF !?!) directory?. Yes, this logs some information but I
need access to at lest all the HTTP headers in both directions and
preferably the body too

 

[Michael Nemtsev]

Hello Andy,

I think that you need to implement HttpModule which will just log all request
to the desired location
Start from here http://www.15seconds.com/issue/020417.htm


---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog: http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

AF> Hi,
AF>
AF> I am wondering if there is any way to log the HTTP traffic on an IIS
AF> server (including headers but preferably the body as well), either
AF> at the IIS or asp.net level
AF>
AF> I know I could write my own isapi dll or .net filter, but I was
AF> rather hoping someone else has already done it. I'm sure it's quite
AF> a common requirement
AF>
AF> Andy
AF>

 

[Michael Nemtsev]

Hello Andy,

I'd recommend this article http://msdn.microsoft.com/msdnmag/issues/02/08/HTTPFilters/default.aspx
to my previous post

---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog: http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

AF> Hi,
AF>
AF> I am wondering if there is any way to log the HTTP traffic on an IIS
AF> server (including headers but preferably the body as well), either
AF> at the IIS or asp.net level
AF>
AF> I know I could write my own isapi dll or .net filter, but I was
AF> rather hoping someone else has already done it. I'm sure it's quite
AF> a common requirement
AF>
AF> Andy
AF>

 

[Ken Schaefer]

HTTPModule is only invoked once request is handed off to ASP.NET ISAPI
extension:

http.sys -> IIS pipeline -> determine extension -> ASP.NET ISAPI
extension -> ASP.NET pipeline

Requests for static files, for example, are handled by IIS Static file
handler, not ASP.NET, so HTTPModule would never be invoked (unless you map
all file extensions to ASP.NET)

ISAPI filter (or lower level tool, e.g. a packet capture tool) is probably
the only way.

Cheers
Ken

 

[Michael Nemtsev]

Hello Ken,

hmmm..
What about IIS7? The same ISAPI stuff?

---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog: http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

KS> HTTPModule is only invoked once request is handed off to ASP.NET
KS> ISAPI extension:
KS>
KS> http.sys -> IIS pipeline -> determine extension -> ASP.NET ISAPI
KS> extension -> ASP.NET pipeline
KS>
KS> Requests for static files, for example, are handled by IIS Static
KS> file handler, not ASP.NET, so HTTPModule would never be invoked
KS> (unless you map all file extensions to ASP.NET)
KS>
KS> ISAPI filter (or lower level tool, e.g. a packet capture tool) is
KS> probably the only way.
KS>
KS> Cheers
KS> Ken
KS> KS>

Hello Andy,

I think that you need to implement HttpModule which will just log all
request to the desired location
Start from here http://www.15seconds.com/issue/020417.htm
---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/
"The greatest danger for most of us is not that our aim is too high
and we miss it, but that it is too low and we reach it" (c)
Michelangelo

AF> Hi,
AF> AF> I am wondering if there is any way to log the HTTP traffic on
an
IIS
AF> server (including headers but preferably the body as well),
either
AF> at the IIS or asp.net level
AF> AF> I know I could write my own isapi dll or .net filter, but I
was
AF> rather hoping someone else has already done it. I'm sure it's
quite
AF> a common requirement
AF> AF> Andy
AF>

 

[Andy Fish]

Thanks for all the replies

I have read up a bit about the asp.net pipeline and, as I am currently only
interested in asp.net requests, I think IHttpModule will do it for me.

I was just hoping that someone had already invented this so I wouldn't have
to write it myself, but it doesn't look like it's available off the shelf. I
would think it's a common requirement.

I have previously tried ethereal and the other obvious alternative which is
a proxy with logging. these are just a bit more cumbersome to use than
having logging built into the web server.

Andy

HTTPModule is only invoked once request is handed off to ASP.NET ISAPI
extension:

http.sys -> IIS pipeline -> determine extension -> ASP.NET ISAPI
extension -> ASP.NET pipeline

Requests for static files, for example, are handled by IIS Static file
handler, not ASP.NET, so HTTPModule would never be invoked (unless you map
all file extensions to ASP.NET)

ISAPI filter (or lower level tool, e.g. a packet capture tool) is probably
the only way.

Cheers
Ken


--
My IIS Blog: www.adOpenStatic.com/cs/blogs/ken

Hello Andy,

I think that you need to implement HttpModule which will just log all
request to the desired location
Start from here http://www.15seconds.com/issue/020417.htm


---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and
we miss it, but that it is too low and we reach it" (c) Michelangelo

AF> Hi,
AF> AF> I am wondering if there is any way to log the HTTP traffic on an
IIS
AF> server (including headers but preferably the body as well), either
AF> at the IIS or asp.net level
AF> AF> I know I could write my own isapi dll or .net filter, but I was
AF> rather hoping someone else has already done it. I'm sure it's quite
AF> a common requirement
AF> AF> Andy
AF>

 

[David Wang]

Products like TeaLeaf do what was originally asked and exist.

If you are looking for a free solution, I don't know of any.

For the theoretically inclined:

IIS6 Request Processing Details:
http://blogs.msdn.com/david.wang/ar...O_IIS_6_Request_Processing_Basics_Part_1.aspx

IIS6 solutions involve any combination of the following techniques:
- How to read request entity body -
http://blogs.msdn.com/david.wang/archive/2006/05/10/HOWTO-Access-POST-form-data-with-ISAPI.aspx
- ISAPI Filter reading ALL_RAW ServerVariable after
SF_NOTIFY_AUTH_COMPLETE event to retrieve effective request headers
- ISAPI Filter listening to SF_NOTIFY_SEND_RAW_DATA to capture
response stream. Kills performance by disabling platform advantages
like TransmitFile for StaticFiles and kernel response cache for
Dynamic Files.

IIS7 solutions
- Existing IIS6 solution works with same caveats
- Native code Module listening on READ_ENTITY and SEND_ENTITY to
buffer
- Existing HttpModule and HttpHandler techniques can be applied to any/
all resources on a per-app basis (CANNOT configure one codebase to run
globally for any/all requests - read this for why -
http://blogs.msdn.com/david.wang/ar...l-Managed-Modules-are-Disallowed-in-IIS7.aspx
)


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Hello Ken,

hmmm..
What about IIS7? The same ISAPI stuff?

---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog:http://spaces.live.com/laflour
Team blog:http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

KS> HTTPModule is only invoked once request is handed off to ASP.NET
KS> ISAPI extension:
KS>
KS> http.sys -> IIS pipeline -> determine extension -> ASP.NET ISAPI
KS> extension -> ASP.NET pipeline
KS>
KS> Requests for static files, for example, are handled by IIS Static
KS> file handler, not ASP.NET, so HTTPModule would never be invoked
KS> (unless you map all file extensions to ASP.NET)
KS>
KS> ISAPI filter (or lower level tool, e.g. a packet capture tool) is
KS> probably the only way.
KS>
KS> Cheers
KS> Ken
KS>KS>

Hello Andy,
I think that you need to implement HttpModule which will just log all
request to the desired location
Start from herehttp://www.15seconds.com/issue/020417.htm
---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog:http://devkids.blogspot.com/
"The greatest danger for most of us is not that our aim is too high
and we miss it, but that it is too low and we reach it" (c)
Michelangelo
AF> Hi,
AF> AF> I am wondering if there is any way to log the HTTP traffic on
an
IIS
AF> server (including headers but preferably the body as well),
either
AF> at the IIS or asp.net level
AF> AF> I know I could write my own isapi dll or .net filter, but I
was
AF> rather hoping someone else has already done it. I'm sure it's
quite
AF> a common requirement
AF> AF> Andy
AF>- Hide quoted text -

- Show quoted text -