I have an ISA2004 firewall publishing web requests to various IIS and apache web servers. Multiple sites are hosted on an ip. In the ISA logs the url column always seems to dump the original host header and only report the ip of the request, eg http://10.1.0.15/image.jpg (not http://www.site.com/image.jpg), this means that it makes it impossible to tell which sites are being hit when there are multiple sites on a single ip. The logs work fine for outgoing requests, but since this is a server farm, outgoing requests are not important.
Thanks for replying. I realised that what it is doing it reporting the host of where the request is being published to, not the original host header. Since nearly all web requests are being published to the same IP, it reports that - and as such makes the logs a little harder to interpret. I was considering adding a host name for each published site in the internal DNS, all pointing to the same place, so that the logged URLs showed different hosts (still not the correct ones, but easier to read).