---
title: "web.iis"
canonical: "https://docs.devo.com/space/latest/94666204/web.iis"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `web.iis`** **identify events generated by the Internet Information Services belonging to [Microsoft](http://www.microsoft.com).

## Valid tags and data tables

The full tag must have at least 3 levels. The first two are fixed as `web.iis`. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product/Service** | **Tag** | **Data table** |
| --- | --- | --- |
| Apache HTTP Server Project | `web.iis.accessNcsa` | `web.iis.accessNcsa` |
| `web.iis.access-w3c.pro.gif.1` | `web.iis.accessW3c` |
| `web.iis.access-w3c.env.aws.pam` |
| `web.iis.access-w3c-all.b.app.clon` | `web.iis.accessW3cAll` |
| `web.iis.access-w3c-all.pro.gif.1` |

For more information, read the article [about Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Send it

Devo recommends using the [Endpoint Agent 2.0 by Snare](https://docs.devo.com/space/latest/479363146/Devo+Endpoint+Agent+2.0+by+Snare) to forward IIS to Devo. In both cases:

- Make sure the logs are written in text files.
- Have the complete paths to the log files on hand when setting up the sending.

> Macro (anchor)



<details>
<summary>Event formats</summary>

IIS access logs: In the access log there is one event for each request processed by the server. Follow these steps to select type of logs you want to process:

| **IIS 7.0 and later** |
| --- |
| 1. Open IIS Manager (**Start** → **Control Panel** →  **System and security** → **Administrative tools** → **IIS Manager**).
2. Select the site want to configure and double click on the **Register** icon in the **Features** view.
3. Check that the Logging is enabled (**Enable/Disable** option on the **Actions** view).
4. Select the log format in the **Format** field (**Register File** section from **Features** view). |

- <u>NCSA Common Format:</u>  
The [NCSA Common format](https://en.wikipedia.org/wiki/Common_Log_Format) is fixed and it corresponds to the `web.iis.access-ncsa` tag. The log format is the same used in [web.apache.accessclf](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94666290) (Common Log Format).
- <u>W3C Extended format:</u>  
The [W3C Extended log file format](https://www.w3.org/TR/WD-logfile) is the default log file format for IIS and it corresponds to the `web.iis.access-w3c` tag.
  For a detailed description of the log fields, see the [Microsoft documentation](https://docs.microsoft.com/en-us/windows/desktop/http/w3c-logging).
- <u>W3C Extended ALL format:</u>  
This is the same as the W3C Extended format but logs all of the available fields and it corresponds to the `web.iis.access-w3c-all` tag. We recommend this format because it offers a greater level of detail.
</details>

## Table structure

These are the fields displayed in these tables:

- [web.iis.accessNcsa](https://docs.devo.com/space/latest/94666204#web.iis.accessNcsa)
- [web.iis.accessW3c](https://docs.devo.com/space/latest/94666204#web.iis.accessW3c)
- [web.iis.accessW3cAll](https://docs.devo.com/space/latest/94666204#web.iis.accessW3cAll)

### web.iis.accessNcsa

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *environment* | `str` | *venv* |  |
| *site* | `str` | *vsite* |  |
| *clon* | `str` | *vclon* |  |
| *serverdate* | `timestamp` |  |  |
| *srcIp* | `ip4` |  |  |
| *user* | `str` |  |  |
| *method* | `str` |  |  |
| *url* | `str` |  |  |
| *protocol* | `str` |  |  |
| *statusCode* | `int4` |  |  |
| *responseLength* | `int4` |  |  |
| *srcIdentd* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` |  | **✓** |
| *rawMessage* | `str` |  | **✓** |

### web.iis.accessW3c

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *environment* | `str` | *venv* |  |
| *site* | `str` | *vsite* |  |
| *clon* | `str` | *vclon* |  |
| *rawMessage* | `str` |  | **✓** |
| *serverdate* | `timestamp` |  |  |
| *srcIp* | `str` |  |  |
| *dstIp* | `str` |  |  |
| *serverPort* | `int4` |  |  |
| *user* | `str` |  |  |
| *method* | `str` |  |  |
| *url* | `str` |  |  |
| *urlQuery* | `str` |  |  |
| *userAgent* | `str` |  |  |
| *referrer* | `str` |  |  |
| *statusCode* | `int4` |  |  |
| *subStatus* | `int4` |  |  |
| *win32Status* | `int8` |  |  |
| *responseTime* | `int4` |  |  |
| *other* | `str` |  |  |
| *comment* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` |  | **✓** |

### web.iis.accessW3cAll

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *environment* | `str` | *venv* |  |
| *site* | `str` | *vsite* |  |
| *clon* | `str` | *vclon* |  |
| *siteName* | `str` |  |  |
| *computerName* | `str` |  |  |
| *serverdate* | `timestamp` |  |  |
| *srcIp* | `ip4` |  |  |
| *dstIp* | `ip4` |  |  |
| *serverName* | `str` |  |  |
| *serverPort* | `int4` |  |  |
| *user* | `str` |  |  |
| *method* | `str` |  |  |
| *url* | `str` |  |  |
| *urlQuery* | `str` |  |  |
| *protocol* | `str` |  |  |
| *statusCode* | `int4` |  |  |
| *referer* | `str` |  |  |
| *userAgent* | `str` |  |  |
| *cookies* | `str` |  |  |
| *subStatus* | `int4` |  |  |
| *win32Status* | `int4` |  |  |
| *responseLength* | `int4` |  |  |
| *requestLength* | `int4` |  |  |
| *responseTime* | `int4` |  |  |
| *serverdate_str* | `str` |  |  |
| *rawMessage* | `str` | rawSource |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` |  | **✓** |