Mmh I didn't think about it...there's also a complete dump log, cool!
Well, just tried, here it is an example:
04/02/2009 15.06.24 Server stop
04/02/2009 15.06.25 Server start
04/02/2009 15.06.31 127.0.0.1:49539 Connected
04/02/2009 15.06.31 127.0.0.1:49539 Got 591 bytes
04/02/2009 15.06.31 127.0.0.1:49539 Requested GET /
04/02/2009 15.06.31 127.0.0.1:49539 Request dump
> GET / HTTP/1.1
> Connection: Keep-Alive
> Keep-Alive: 300
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
> Accept-Encoding: gzip,deflate
> Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
> Cookie: Volume=100
> Host: ********.ath.cx
> Max-Forwards: 10
> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5
> X-Original-URL: /
> X-Forwarded-For: 79.9.192.***:49538
> X-ARR-SSL: 0|128|CN=********.ath.cx|CN=********.ath.cx
> X-ARR-LOG-ID: 7bcb7281-a6a0-43d0-a1d2-15fa94a3613c
04/02/2009 15.06.31 127.0.0.1:49539 Sent 1460 bytes
04/02/2009 15.06.31 127.0.0.1:49539 Served 1.83 KB
04/02/2009 15.06.34 127.0.0.1:49539 Requested GET /favicon.ico
04/02/2009 15.06.34 127.0.0.1:49539 Request dump
> GET /favicon.ico HTTP/1.1
> Connection: Keep-Alive
> Keep-Alive: 300
> Accept: image/png,image/*;q=0.8,*/*;q=0.5
> Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
> Accept-Encoding: gzip,deflate
> Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
> Cookie: Volume=100
> Host: ********.ath.cx
> Max-Forwards: 10
> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5
> X-Original-URL: /favicon.ico
> X-Forwarded-For: 79.9.192.***:49538
> X-ARR-SSL: 0|128|CN=********.ath.cx|CN=********.ath.cx
> X-ARR-LOG-ID: 08f95bf5-cc95-4603-939e-7afe57cfbe4e
04/02/2009 15.06.34 127.0.0.1:49539 Sent 21875 bytes
04/02/2009 15.06.34 127.0.0.1:49539 Served 576 B
04/02/2009 15.06.37 127.0.0.1:49539 Got 1257 bytes
04/02/2009 15.06.37 127.0.0.1:49539 Requested GET /favicon.ico
04/02/2009 15.06.37 127.0.0.1:49539 Request dump
> GET /favicon.ico HTTP/1.1
> Connection: Keep-Alive
> Keep-Alive: 300
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
> Accept-Encoding: gzip,deflate
> Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
> Cookie: Volume=100
> Host: ********.ath.cx
> Max-Forwards: 10
> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5
> X-Original-URL: /favicon.ico
> X-Forwarded-For: 79.9.192.***:49542
> X-ARR-SSL: 0|128|CN=********.ath.cx|CN=********.ath.cx
> X-ARR-LOG-ID: 72db2f02-1fb7-41ef-b7c4-d98217292419
04/02/2009 15.06.37 127.0.0.1:49539 Sent 1152 bytes
04/02/2009 15.06.37 127.0.0.1:49539 Served 576 B
p.s. I hide personal informations (*s).
The interesting thing is also the X-ARR-LOG-ID part!
I've read on their website (they have an entire section in the IIS7 support forum for ARR only) they're working hard to make a "undefined" utility (could be an Apache extension or a module of IIS7 or a standalone application?) to make ARR interact with (for example) Apache server and, in particular, they want the Apache logs to contain real IPs(are there other things one could want to do!? don't think so...but you never know!)...I guess they're going to cross-check the LOG-ID for this!
Also, they say there's the functionality to achieve the same also with the current version...but seems the way is a bit abrupt (guess we'd need to use the console, like I needed to specify the personalized port of HFS)!
Anyway...WOW! The IP is there already, available to HFS

Now, how to change the IP HFS logs, 'securely'? I mean, as I read somewhere else in the forum, you spoke about the possibility a client would send its own "X-Forwarded-For" part that could make the system log the wrong IP!
BUT...since with ARR the "name" of the specify is editable...and, correct me if I'm wrong, the client doesn't even see the specifies added by ARR and sent to HFS, why not just use a brand new name and let ARR send it, I don't know, ARR-HFS-Forwarded-For for example

Let me know what you think, and thanks for the help
