Microsoft Windows IIS

1. Run settings IIS server from control panel.

2. Click on name of server.

3. Choose logging.

   

4. one file logging for: server.

5. format: W3C.

6. Click on the selection fields and select the required values for logging:

   

   Below is the list of required fields which have to be selected for parser to work.

   • Date (date)
   • Time (time)
   • Client IP Address (c-ip)
   • User Name (cs-username)
   • Server IP Address (s-ip)
   • Server Port (s-port)
   • Method (cs-method)
   • URI stem (cs-uri-stem)
   • URI Query (cs-uri-query)
   • Protocol Status (sc-status)
   • Bytes Sent (sc-bytes)
   • Bytes Received (cs-bytes)
   • Time Taken (time-taken)
   • User Agent ( cs(User-Agent) )
   • Referer ( cs(Referer) )

   Currently this is required only for logs coming from filebeat agent.

7. location: SystemDrive\\inetpub\\logs\\LogFiles.

8. coding: UTF-8.

9. schedule: once day.

If you are collecting Microsoft IIS logs using the new Beat agent, you need to follow the list of fields mentioned above. If you remove any of them, or add a value other than the one mentioned above, the logs will not be processed.

This procedure demonstrates the GUI configuration for all available messages.

1. Configure the Logmanager to watch the log files on Windows Server with Windows IIS. Follow the Chapter Windows.

2. We find computer with Windows IIS and we need to set following properties on Editing client station page:

   • Set log type to value iis
   • Paste the log file path from your clipboard into textbox log source

WES agent starts sending Windows IIS messages to the Logmanager.