nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Retrieve Client IP Address Information from ArcGIS Server Logs

SaurabhUpadhyaya

Hi,

We are currently working with ArcGIS Server 11.1 in our environment and are in need of assistance regarding our server logs.

We are attempting to retrieve the client IP address information from the logs for analysis and troubleshooting purposes.

Upon reviewing the available log fields, we noticed that the fields provided do not include a dedicated "Client IP" field. The fields available in our logs are as follows: [Type, Message, Time, Target, Machine, User, Code, Time Elapsed, Process, Thread, Method Name, Request ID].

Can anyone share the workaround to get the Client IP.

Najděte více příspěvků označených jako

Accepted answers

Aled Wyn Jones

Yes, monitoring web logs is a complex process. I can't suggest any particular tools but Web Server log parsers can help you see trends via Graphs of client requests.

If you know which services you want to trace, you can look for calls to "server/rest/services/MyData/Myservice/MapServer" which should help you filter the web server logs sufficiently to understand then which IPs have been requesting your map service.

If you're worried about unauthorised use of your Map services, you should look to implement CORS restrictions or, on the extreme side of the scale, set up a WAF to entirely control your web traffic.

CORS for Server map services:

https://enterprise.arcgis.com/en/server/latest/administer/linux/restricting-cross-domain-requests-to-arcgis-server.htm

Portal CORS:

https://enterprise.arcgis.com/en/portal/latest/administer/windows/restrict-cross-domain-requests-to-your-portal.htm

ArcGIS Hardening guide which is a good place to start reading about applying a WAF:

https://downloads.esri.com/RESOURCES/ENTERPRISEGIS/ArcGIS_Enterprise_Hardening_Guide.PDF

All comments

gisarchitect

I know it might be late may be someone need it. I think System Log Parser can be handy in this situation as you can configure it with a narrow window of time. The output sheet contains the Client IP addresses that hit the web server. I think this could narrow the search to specific IP addresses. Attached is screen shots from the Parser and the Excel sheet. I hope this might help

berniejconnors

Saurabh,

You should be able to get the web server logs from the machine hosting your web adaptor. The web server logs will give you the client IP, date, time, the incoming REST service request, the URL of the referrer, the referring agent, http status code, bytes transferred and the duration of the request in seconds. I find it useful to look at the duration of the request to identify the slow requests that are using a lot of server time. This may indicate a problem such as a poorly formed query on a map service, or a map service that needs to be tuned for faster performance.

Unfortunately I cannot tell you how to find the web server logs. I rely on an excellent server administrator to extract and filter logs for my analysis. Just looking at requests that run longer than 60 seconds I usually only have 100 or fewer records per day to examine. I just scan them in a text editor and look for unusual requests that may need further investigation.

Cheers,

Bernie.

Aled Wyn Jones

Yes, monitoring web logs is a complex process. I can't suggest any particular tools but Web Server log parsers can help you see trends via Graphs of client requests.

If you're worried about unauthorised use of your Map services, you should look to implement CORS restrictions or, on the extreme side of the scale, set up a WAF to entirely control your web traffic.

CORS for Server map services:

https://enterprise.arcgis.com/en/server/latest/administer/linux/restricting-cross-domain-requests-to-arcgis-server.htm

Portal CORS:

https://enterprise.arcgis.com/en/portal/latest/administer/windows/restrict-cross-domain-requests-to-your-portal.htm

ArcGIS Hardening guide which is a good place to start reading about applying a WAF:

https://downloads.esri.com/RESOURCES/ENTERPRISEGIS/ArcGIS_Enterprise_Hardening_Guide.PDF

SaurabhUpadhyaya

@A_Wyn_Jones Thanks for prompt response. This is vert lengthy process, I have published multiple services which accessed by diffrent geographies and now want to trace the Client IP.

Can you share any step or easy available tool?

Aled Wyn Jones

You should be able to see this information via your Web Server logs - you can then cross-reference the error shown in ArcGIS Server logs with a call made via Web Server

e.g.

Web server: 00:00:000 /server/admin/security/config/update 123.12.1.3

ArcGIS Server: 00:00:000 SEVERE - can't update security config ERROR 9999

Připojte se k diskusi

Přihlášení členové mohou přispívat, sledovat aktualizace a další. Jste tu noví? Zaregistrujte si bezplatný účet.

Rychlé odkazy

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.