Levo IIS Module

This guide walks you through installing and configuring Levo.ai's IIS Module to capture HTTP/HTTPS traffic on Windows IIS servers.

Overview

The Levoai IIS Module captures HTTP/HTTPS traffic from your IIS web servers and sends it to Levo's Satellite service for API discovery and analysis.

Prerequisites

• Windows Server with IIS 8.0+

• Administrator privileges on the Windows server

• PowerShell 5.0+

• Windows Media Foundation (necessary for IIS components):

  If not installed, run the following command in PowerShell to install:

  Install-WindowsFeature -Name "Server-Media-Foundation"

• C++ Redistributables (required for running native modules):

  Visual C++ Redistributable (x64)

  Visual C++ Redistributable (x86)

Installation Steps

1. Download and Prepare

1. Download the Levoai-IIS-Module.zip file from our downloads portal
2. Extract the contents to a directory (recommended: C:\Program Files\Levo\IISModule\)
3. Important: Schedule a maintenance window as installation requires an IIS restart

2. Configure the Module

Before installing the module, modify the config.json file to match your specific setup:

1. Open the config.json file in a text editor
2. Update the fields as needed (see full reference below)

Full config.json Reference

{
    "satellite-url": "your-satellite-url-here",
    "levo-env": "production",
    "levoai-org-id": "your-org-id-here",
    "logging-enabled": "false",
    "rate-limit": 10,
    "max-endpoint-bucket-size": 1000,
    "allowed-methods": ["GET", "POST", "PUT", "PATCH", "DELETE", "CONNECT"],
    "allowed-content-types": [
        "application/json",
        "application/x-www-form-urlencoded",
        "text/json",
        "application/pdf",
        "text/plain",
        "application/grpc",
        "text/xml",
        "application/soap+xml",
        "application/xml",
        "application/x-ndjson",
        "text/event-stream",
        "application/vnd.amazon.eventstream"
    ],
    "allowed-user-agents": []
}

Field	Type	Description
satellite-url	string	URL of your Levo Satellite service. Point to your Levo-hosted or on-premises satellite URL.
levo-env	string	Environment name (e.g. production, staging). Used to tag traces in the Levo portal.
levoai-org-id	string	Your Levo organization ID. Found in the Levo portal under Settings.
logging-enabled	string	Set to "true" to enable debug logging. Defaults to "false". See Logging below.
rate-limit	number	Maximum number of traces sent to the satellite per second. Defaults to 10.
max-endpoint-bucket-size	number	Maximum number of unique endpoints tracked in the rate-limiter bucket. Defaults to 1000.
allowed-methods	array	HTTP methods to capture. Requests with methods not in this list are silently dropped.
allowed-content-types	array	Content-Type values to capture. Requests whose Content-Type does not match any entry are silently dropped.
allowed-user-agents	array	If non-empty, only requests whose User-Agent matches an entry are captured. Leave empty to capture all user agents.

Note: If you're running the Satellite service on your own premises, point satellite-url to that service.

3. Deploy

1. Open PowerShell as Administrator
2. Navigate to the directory containing the extracted Levoai IIS Module files
3. Execute the installation script:

.\DeployLevoaiIIS.ps1

Important: This will cause temporary downtime for all IIS websites since IIS is being restarted. It is recommended to do this during a scheduled maintenance window.

4. Verify Installation

1. Open IIS Manager
2. Navigate to Modules
3. Confirm that "LevoaiIISModule" is listed among the modules
4. Log into the Levoai Portal, go to API Inventory, and verify that traffic appears

Data Flow

1. The IIS Module captures HTTP/HTTPS traffic from your IIS web servers
2. Captured data is sent to the configured Levo Satellite service
3. Access the API documentation, sensitive data flows, and API catalog in the Levo.ai portal

Logging / Debug

By default, logging is disabled to minimize disk I/O overhead on production servers.

Enabling Debug Logs

To enable logging, set logging-enabled to "true" in config.json:

{
    "logging-enabled": "true"
}

Then restart IIS for the change to take effect:

iisreset

Note: Enabling logging has a measurable latency impact due to synchronous disk writes on every request. Enable it only for debugging, not in production.

Log File Locations

Log File	Location	Contents
levoai_satellite.log	Installation directory (e.g. C:\Program Files\Levo\IISModule\)	All module activity: request/response capture, satellite send status, errors
improved.log	Installation directory under logs\	DLL load and initialization events only

What the Logs Show

When a request is captured and sent successfully, you will see entries like:

2026-01-01 12:00:00 - Captured request body (256 bytes)
2026-01-01 12:00:00 - Successfully reinserted 256 bytes
2026-01-01 12:00:00 - Captured response body: 512 bytes from 1 chunks
2026-01-01 12:00:00 - Sent trace to Levo Satellite service: <trace-id>
2026-01-01 12:00:00 - Successfully sent 1 traces, status: 201

When a request is dropped (e.g. content-type not in allowlist):

2026-01-01 12:00:00 - Dropping request — content-type not in allowlist: text/html

Troubleshooting

Common Issues

• Module Not Loading: Check Event Viewer and IIS Manager for error messages
• No Data in Portal: Verify config.json settings and network connectivity. Enable logging and check levoai_satellite.log for errors.
• Requests Being Dropped: Check levoai_satellite.log for "Dropping request" messages — the request's method or content-type may not be in the allowlist. Add it to allowed-methods or allowed-content-types in config.json.

Logs Location

The main module log is levoai_satellite.log in the installation directory. See Logging / Debug for details.

Uninstallation

To uninstall the module, run the following commands in PowerShell (as Administrator):

Import-Module WebAdministration
Remove-WebGlobalModule -Name "LevoaiIISModule_x64.dll"
Remove-WebGlobalModule -Name "LevoaiIISModule_x86.dll"
Clear-WebConfiguration -PSPath "MACHINE/WEBROOT/APPHOST" -Filter "system.webServer/modules/add[@name='LevoaiIISModule_x64.dll']"
Clear-WebConfiguration -PSPath "MACHINE/WEBROOT/APPHOST" -Filter "system.webServer/modules/add[@name='LevoaiIISModule_x86.dll']"
iisreset

Note: Uninstallation requires an IIS restart, which will cause temporary downtime for all IIS websites.

Support

For additional support or assistance, please contact support@levo.ai.