OBSOLETE Flat File - Microsoft IIS W3C File

The W3C Extended log file format is the Microsoft IIS default. It is a customizable ASCII text-based format. You can use IIS Manager to select which boxes to include in the log file, which enables you to keep log files as small as possible. To collect and process logs using the default LogRhythm MPE Rules sets you must leave the format in its default state. Adding any additional boxes to the output format will cause processing to fail. Because HTTP.sys handles the W3C Extended log file format, this format records the HTTP.sys kernel-mode cache hits.

The following are the default format fields: 

CODE

<date> <time> <s-sitename> <server-ip> <cs-method> <cs-uri-stem> <cs-uri-query> <s-port> <cs-username> <c-ip> <cs(User-Agent)> <sc-status> <sc-substatus> <sc-win32-status>

Prerequisites

• Ensure the IIS Active log format = W3C Extended Log Format.
• Identify the following prior to configuration:
  • The Microsoft IIS default log directory
  • The LogRhythm System Monitor Agent used to collect the logs from Microsoft IIS Manager

Configure Default Log Directory and Active Log W3C in Microsoft IIS Manager

1. Start Internet Information Services (IIS) Manager.
2. Access ServerName, then Web Sites or ServerName, and then FTP Sites.
3. Right-click the web site or FTP site where you want to enable logging and select Properties from the context menu.
4. Click the Web Site or FTP Site tab.
5. Select the Engage logging check box.
6. In the Active log format box, select W3C Extended Log Format.
7. Next to the Active log format, click Properties.
8. Specify the log file directory, for example: C:\Windows\System32\LogFiles\IISW3C_logs\.

After you configure the device, you must also configure LogRhythm according to the instructions provided on the overview page of this guide. LogRhythm requires a LogRhythm System Monitor Agent be used to collect the logs. The files being collected must be viewable on the host with the Agent using a standard file name path such as: /var/log/logfile.txt or C:\logs\logfile.txt.

Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.

The name of the log message source is Flat File - Microsoft IIS W3C File. In addition, when configuring this log source:

• For Log Message Processing Engine (MPE) Policy, select LogRhythm Default.
• On the Flat File Settings tab, enter the following:
  • File Path.C:\Windows\System32\LogFiles\IISW3C_logs\*.log
  • Date Parsing Format. Select existing IIS W3C Log type: “<UTC><yy>-<M>-<d> <h>:<m>:<s>”
    
  • Log Message Start Regex. ^\d

Supported Log Messages

(List of LR tags used to parse the log information for each message type)

Revision History