The tags beginning with web.iis identify log events generated by the Internet Information Services (IIS) web server for Windows.
The full tag must have at least six levels. The first two are fixed as web.iis. The third level identifies the log type/format and currently must be one of access-ncsa, access-w3c, or access-w3c-all.
The fourth, fifth and sixth levels are required and should identify the environment type, web application, and instance respectively.
- environment - Describes the environment in when the event occurred. For example, development, testing, or production.
- web application - The name of the web application.
- clon - This is the instance that generated the event. Depending on your network, this can be a machine name, or the virtual name of an IIS process.
The values of these levels should be guided by the structure we propose because they will be saved in the events when saved in Devo. When you open the resulting data table, these will appear in the environment, site and clon columns.
free but required
|free but required||free but required|
Therefore, the valid tags include:
For more information, read the article about Devo tags.
IIS access logs
In the access log there is one event for each request processed by the server. Follow these steps to select type of logs you want to process:
|IIS 7.0 and later|
W3C Extended format
The W3C Extended log file format is the default log file format for IIS and it corresponds to the web.iis.access-w3c tag.
W3C Extended log format
#Software: Microsoft Internet Information Services 7.5 #Version: 1.0 #Date: 2013-01-03 08:45:16 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
For a detailed description of the log fields, see the Microsoft documentation.
W3C Extended ALL format
This is the same as the W3C Extended format but logs all of the available fields and it corresponds to the web.iis. access-w3c-all tag. We recommend this format because it offers a greater level of detail.
W3C Extended ALL log format
#Software: Microsoft Internet Information Services 7.5 #Version: 1.0 #Date: 2013-01-21 11:46:52 #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
NCSA Common Format
The NCSA Common format is fixed and it corresponds to the web.iis.access-ncsa tag.
The log format is the same used in web.apache.accessclf (Common Log Format).
NCSA Common log format
remotehost rfc931 authuser [date] "request" status bytes
Sending IIS events to Devo
In both cases:
- Make sure the logs are written in text files.
- Have the complete paths to the log files on hand when setting up the sending.