How to Log Custom HTTP Headers like MS-ASProtocolVersion in IIS for Exchange Server Analysis


2 views

When troubleshooting Exchange ActiveSync (EAS) communications, standard IIS logs often lack critical protocol information. The MS-ASProtocolVersion header, for instance, reveals which EAS protocol version a mobile device is using - essential data for compatibility analysis and debugging.

Modern IIS versions (7.5+) support custom field logging through the Advanced Logging module. Here's how to implement it:

1. Install the "Advanced Logging" feature via Server Manager
2. Open IIS Manager → Select server → Double-click "Advanced Logging"
3. Click "Edit Logging Fields..." → Add new field
4. Configure as follows:
   - Field ID: MS_ASProtocolVersion
   - Category: Request Header
   - Source Name: MS-ASProtocolVersion
   - Source Type: RequestHeader
5. Enable Advanced Logging for your Exchange virtual directory

For administrators managing multiple servers, here's a PowerShell script to automate the configuration:

Import-Module WebAdministration
$sitePath = "IIS:\Sites\Default Web Site\Microsoft-Server-ActiveSync"

# Add custom header logging
Add-WebConfigurationProperty -PSPath $sitePath 
    -Filter "system.webServer/advancedLogging/server" 
    -Name "." -Value @{
        name = 'MS-ASProtocolVersion';
        sourceType = 'RequestHeader';
        sourceName = 'MS-ASProtocolVersion'
    }

# Enable advanced logging
Set-WebConfigurationProperty -PSPath $sitePath 
    -Filter "system.webServer/advancedLogging/server" 
    -Name "enabled" -Value $true

After implementation, verify your custom fields appear in logs:

#Sample log entry with custom fields
2023-01-15 12:34:56 192.168.1.100 POST /Microsoft-Server-ActiveSync 443 - 10.0.0.1 
Apple-iPhone5C1/1002.146 200 0 0 1234 
MS-ASProtocolVersion=14.1 X-MS-PolicyKey=886721299

For IIS 6.0 or when Advanced Logging isn't available:

  1. Use URL Rewrite Module to capture headers in server variables
  2. Implement custom ISAPI filters
  3. Consider third-party logging solutions like LogParser

When logging multiple custom headers:

  • Monitor disk I/O impact during peak loads
  • Consider log rotation policies for large volumes
  • Test with a subset of servers before enterprise rollout



Internet Information Services (IIS) provides flexible logging capabilities through its Advanced Logging module. While default logs capture standard HTTP fields, Exchange Server troubleshooting often requires tracking mobile protocol headers like MS-ASProtocolVersion.

  • IIS 7.0+ with Advanced Logging installed
  • Administrator privileges on the Exchange server
  • Understanding of ActiveSync traffic patterns

1. Install Advanced Logging Module:

Server Manager > Add Roles and Features > Web Server (IIS) > Role Services
Select "Advanced Logging" under Health and Diagnostics

2. Create Custom Logging Field:

# PowerShell command to add MS-ASProtocolVersion to logged fields
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/advancedLogging/server/advancedLogs/log[@name='Exchange ActiveSync']/logDefinitions/logDefinition[@name='Default']/logFields" -name "." -value @{name='MSASProtocolVersion';sourceName='MS-ASProtocolVersion';sourceType='RequestHeader'}

3. Configure Log Location:

<advancedLogging>
    <logDefinitions>
        <logDefinition name="Exchange_ActiveSync">
            <logFields>
                <add name="MSASProtocolVersion" sourceName="MS-ASProtocolVersion" sourceType="RequestHeader" />
            </logFields>
            <directory type="Custom" path="C:\Logs\Exchange\ActiveSync" />
        </logDefinition>
    </logDefinitions>
</advancedLogging>

After configuration, trigger an ActiveSync request and verify logs contain the protocol version:

2023-08-15 12:34:56 192.168.1.100 POST /Microsoft-Server-ActiveSync - 443 User@domain.com 192.168.1.100 Apple-iPhone5C1/1002.146 200 0 0 64 14.1

For multi-server environments, consider centralized logging with:

# PowerShell script to consolidate logs
Get-ChildItem -Path "\\Exchange01\C$\Logs\Exchange\ActiveSync","\\Exchange02\C$\Logs\Exchange\ActiveSync" -Filter "*.log" | 
Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-1) } |
Select-String -Pattern "MS-ASProtocolVersion" |
Export-Csv -Path "C:\Consolidated\ActiveSync_Protocol_Versions.csv" -NoTypeInformation