logging all HTTP requests

[Andy Fish]

Hi,

I am wondering if there is any way to log the HTTP traffic on an IIS server
(including headers but preferably the body as well), either at the IIS or
asp.net level

I know I could write my own isapi dll or .net filter, but I was rather
hoping someone else has already done it. I'm sure it's quite a common
requirement

Andy

[Alexey Smirnov]

On Jun 7, 10:50 am, "Andy Fish" <[e-mail]:

Hi,

I am wondering if there is any way to log the HTTP traffic on an IIS server
(including headers

What about IIS log?

[Andrew Morton]

Andy Fish wrote:

I am wondering if there is any way to log the HTTP traffic on an IIS
server (including headers but preferably the body as well), either at
the IIS or asp.net level

I know I could write my own isapi dll or .net filter, but I was rather
hoping someone else has already done it. I'm sure it's quite a common
requirement

Wireshark (formerly Ethereal)?

Andrew

[Andy Fish]

"Alexey Smirnov" <al************@gmail.comwrote in message
news:11**********************@p77g2000hsh.googlegr oups.com...

On Jun 7, 10:50 am, "Andy Fish" <[e-mail]:

>Hi,

I am wondering if there is any way to log the HTTP traffic on an IIS
server
(including headers

What about IIS log?

do you mean the standard log file which appears automatically in the
windows/system32 (WTF !?!) directory?. Yes, this logs some information but I
need access to at lest all the HTTP headers in both directions and
preferably the body too

[Michael Nemtsev]

Hello Andy,

I think that you need to implement HttpModule which will just log all request
to the desired location
Start from here http://www.15seconds.com/issue/020417.htm
---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog: http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

AFHi,
AF>
AFI am wondering if there is any way to log the HTTP traffic on an IIS
AFserver (including headers but preferably the body as well), either
AFat the IIS or asp.net level
AF>
AFI know I could write my own isapi dll or .net filter, but I was
AFrather hoping someone else has already done it. I'm sure it's quite
AFa common requirement
AF>
AFAndy
AF>

[Michael Nemtsev]

Hello Andy,

I'd recommend this article http://msdn.microsoft.com/msdnmag/is...s/default.aspx
to my previous post

---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog: http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

AFHi,
AF>
AFI am wondering if there is any way to log the HTTP traffic on an IIS
AFserver (including headers but preferably the body as well), either
AFat the IIS or asp.net level
AF>
AFI know I could write my own isapi dll or .net filter, but I was
AFrather hoping someone else has already done it. I'm sure it's quite
AFa common requirement
AF>
AFAndy
AF>

[Ken Schaefer]

HTTPModule is only invoked once request is handed off to ASP.NET ISAPI
extension:

http.sys -IIS pipeline -determine extension -ASP.NET ISAPI
extension -ASP.NET pipeline

Requests for static files, for example, are handled by IIS Static file
handler, not ASP.NET, so HTTPModule would never be invoked (unless you map
all file extensions to ASP.NET)

ISAPI filter (or lower level tool, e.g. a packet capture tool) is probably
the only way.

Cheers
Ken
--
My IIS Blog: www.adOpenStatic.com/cs/blogs/ken
"Michael Nemtsev" <ne*****@msn.comwrote in message
news:a2***************************@msnews.microsof t.com...

Hello Andy,

I think that you need to implement HttpModule which will just log all
request to the desired location
Start from here http://www.15seconds.com/issue/020417.htm
---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

AFHi,
AFAFI am wondering if there is any way to log the HTTP traffic on an
IIS
AFserver (including headers but preferably the body as well), either
AFat the IIS or asp.net level
AFAFI know I could write my own isapi dll or .net filter, but I was
AFrather hoping someone else has already done it. I'm sure it's quite
AFa common requirement
AFAFAndy
AF>

[Michael Nemtsev]

Hello Ken,

hmmm..
What about IIS7? The same ISAPI stuff?

---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog: http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

KSHTTPModule is only invoked once request is handed off to ASP.NET
KSISAPI extension:
KS>
KShttp.sys -IIS pipeline -determine extension -ASP.NET ISAPI
KSextension -ASP.NET pipeline
KS>
KSRequests for static files, for example, are handled by IIS Static
KSfile handler, not ASP.NET, so HTTPModule would never be invoked
KS(unless you map all file extensions to ASP.NET)
KS>
KSISAPI filter (or lower level tool, e.g. a packet capture tool) is
KSprobably the only way.
KS>
KSCheers
KSKen
KS"Michael Nemtsev" <ne*****@msn.comwrote in message
KSnews:a2***************************@msnews.micros oft.com...
KS>

>Hello Andy,

I think that you need to implement HttpModule which will just log all
request to the desired location
Start from here http://www.15seconds.com/issue/020417.htm
---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/
"The greatest danger for most of us is not that our aim is too high
and we miss it, but that it is too low and we reach it" (c)
Michelangelo

AFHi,
AFAFI am wondering if there is any way to log the HTTP traffic on
an
IIS
AFserver (including headers but preferably the body as well),
either
AFat the IIS or asp.net level
AFAFI know I could write my own isapi dll or .net filter, but I
was
AFrather hoping someone else has already done it. I'm sure it's
quite
AFa common requirement
AFAFAndy
AF>

[Andy Fish]

Thanks for all the replies

I have read up a bit about the asp.net pipeline and, as I am currently only
interested in asp.net requests, I think IHttpModule will do it for me.

I was just hoping that someone had already invented this so I wouldn't have
to write it myself, but it doesn't look like it's available off the shelf. I
would think it's a common requirement.

I have previously tried ethereal and the other obvious alternative which is
a proxy with logging. these are just a bit more cumbersome to use than
having logging built into the web server.

Andy

"Ken Schaefer" <ke*******@THISadOpenStatic.comwrote in message
news:ee**************@TK2MSFTNGP05.phx.gbl...

HTTPModule is only invoked once request is handed off to ASP.NET ISAPI
extension:

http.sys -IIS pipeline -determine extension -ASP.NET ISAPI
extension -ASP.NET pipeline

Requests for static files, for example, are handled by IIS Static file
handler, not ASP.NET, so HTTPModule would never be invoked (unless you map
all file extensions to ASP.NET)

ISAPI filter (or lower level tool, e.g. a packet capture tool) is probably
the only way.

Cheers
Ken
--
My IIS Blog: www.adOpenStatic.com/cs/blogs/ken
"Michael Nemtsev" <ne*****@msn.comwrote in message
news:a2***************************@msnews.microsof t.com...

>Hello Andy,

I think that you need to implement HttpModule which will just log all
request to the desired location
Start from here http://www.15seconds.com/issue/020417.htm
---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and
we miss it, but that it is too low and we reach it" (c) Michelangelo

AFHi,
AFAFI am wondering if there is any way to log the HTTP traffic on an
IIS
AFserver (including headers but preferably the body as well), either
AFat the IIS or asp.net level
AFAFI know I could write my own isapi dll or .net filter, but I was
AFrather hoping someone else has already done it. I'm sure it's quite
AFa common requirement
AFAFAndy
AF>

[David Wang]

Products like TeaLeaf do what was originally asked and exist.

If you are looking for a free solution, I don't know of any.

For the theoretically inclined:

IIS6 Request Processing Details:
http://blogs.msdn.com/david.wang/arc...cs_Part_1.aspx

IIS6 solutions involve any combination of the following techniques:
- How to read request entity body -
http://blogs.msdn.com/david.wang/arc...ith-ISAPI.aspx
- ISAPI Filter reading ALL_RAW ServerVariable after
SF_NOTIFY_AUTH_COMPLETE event to retrieve effective request headers
- ISAPI Filter listening to SF_NOTIFY_SEND_RAW_DATA to capture
response stream. Kills performance by disabling platform advantages
like TransmitFile for StaticFiles and kernel response cache for
Dynamic Files.

IIS7 solutions
- Existing IIS6 solution works with same caveats
- Native code Module listening on READ_ENTITY and SEND_ENTITY to
buffer
- Existing HttpModule and HttpHandler techniques can be applied to any/
all resources on a per-app basis (CANNOT configure one codebase to run
globally for any/all requests - read this for why -
http://blogs.msdn.com/david.wang/arc...d-in-IIS7.aspx
)
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//


On Jun 7, 4:25 am, Michael Nemtsev <[e-mail]:

Hello Ken,

hmmm..
What about IIS7? The same ISAPI stuff?

---
WBR, Michael Nemtsev [.NET/C# MVP].
My blog:http://spaces.live.com/laflour
Team blog:http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

KSHTTPModule is only invoked once request is handed off to ASP.NET
KSISAPI extension:
KS>
KShttp.sys -IIS pipeline -determine extension -ASP.NET ISAPI
KSextension -ASP.NET pipeline
KS>
KSRequests for static files, for example, are handled by IIS Static
KSfile handler, not ASP.NET, so HTTPModule would never be invoked
KS(unless you map all file extensions to ASP.NET)
KS>
KSISAPI filter (or lower level tool, e.g. a packet capture tool) is
KSprobably the only way.
KS>
KSCheers
KSKen
KS"Michael Nemtsev" <[e-mail] in message
KS>news:a2***************************@msnews.micro soft.com...
KS>

Hello Andy,

I think that you need to implement HttpModule which will just log all
request to the desired location
Start from herehttp://www.15seconds.com/issue/020417.htm
---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog:http://devkids.blogspot.com/
"The greatest danger for most of us is not that our aim is too high
and we miss it, but that it is too low and we reach it" (c)
Michelangelo

AFHi,
AFAFI am wondering if there is any way to log the HTTP traffic on
an
IIS
AFserver (including headers but preferably the body as well),
either
AFat the IIS or asp.net level
AFAFI know I could write my own isapi dll or .net filter, but I
was
AFrather hoping someone else has already done it. I'm sure it's
quite
AFa common requirement
AFAFAndy
AF>- Hide quoted text -

- Show quoted text -