Request Filter

This is an ISAPI filter that can conditionally log all HTTP transactions that take place within IIS. In order to do this, it has a simple scripting language that can check the IIS headers and serverVariables collection. A basic script example is:

  if (headers('url') =~ '.*chunk.*') {
  } else {

For full details, you can read FilterScript.l/FilterScript.y which are the lex & yacc definitions of the language.

Notes on language syntax

The compound statement {} surrounding the script is required.
Syntax follows a C style, with allowed types being integer, float and string. Sadly, you can’t use variables (yet). Bug me if you would find this useful, it’s not too hard to add (or do it yourself, preferably mailing me a patch).
Allowed tests are ==, !=, < =, >=, <>, =~ (regular expression match).
Allowed operators are +,-,*,&,&&/AND,||/OR,!/NOT.
Allowed `commands’ are ECHO (takes a string, for testing), LOG and NOLOG. The default state is NOLOG.
The last logging state set wins.

Registry setup

Registry keys controlling the filter all live under HKLM\SOFTWARE\NPSL\RequestFilter. They are:

  • LogFileDirectory – string, mandatory, where to dump the logs. Logs are named l-{instance}-{request}.in.log and l-{instance}-{request}.out.log for data coming from and going to the client respectively.
  • FilterScriptPath – string, mandatory, the path to the filter script.
  • Instance – number, optional, defaults to 1 (for preventing collisions between logs on a shared drive in a cluster)
  • DisableOnIOError – number, optional, default 1 – set to keep stop in the FS complains at us. If you want to re-enable logging after an I/O error and the filter script is being monitored, then touch (cygwin has one) the filter script or resave it.
  • WatchFilterChanges – number, optional, default 1 – set to watch the script for changes and reload as appropriate.
  • *Important* when setting this option put the script in some directory that doesn’t change much. NOT THE LOG DIRECTORY!


To build from source, you will need to check out the project and related libraries from CVS. See the home page for instructions on CVS, and below for specific build instructions.

Alternatively, click here for a prebuilt binary and registry script.

License and building

The entire source code is licensed under the GNU General Public License. The code draws heavily from my Open-Win32 library, which is licensed under the GNU Lesser General Public License. These licenses are compatible.

For regular expression support, the excellent boost::regex library is utilised. This library is Copyright (c) 1998-2001 Dr John Maddock.

To build the source, download OW32 and ensure that the OW32 directory is in the include path. Ensure that the OW32 .lib files are built and available in the library path. Ensure that boost (or at least the boost::regex part) is installed and available as per instructions for installing boost. Any problems, let me know and I will try to assist.

Leave a Reply

Your email address will not be published. Required fields are marked *