The key to analyzing IIS logs is to clarify the starting point and focus on content. 1. The log is located in C:\inetpub\logs\LogFiles by default. It is commonly used in W3C format, including fields such as time, IP, request method, path, status code, etc. 2. Focus on status codes (such as 404, 500), client IP, User-Agent, access frequency and request paths to detect errors or potential attacks. 3. You can use LogParser, Excel or third-party tools to improve analysis efficiency. 4. It is recommended to set up automation mechanisms, such as regular archiving, exception extraction and email reminders, to achieve efficient monitoring and problem investigation.

Analyzing IIS logs is actually not mysterious. The key is to know where to start and what to read. The IIS log records the access status of the website, which can help you discover performance issues, troubleshoot error sources, and even see potential security attacks.

1. Find the location and format of the log file

The default log location of IIS is usually under C:\inetpub\logs\LogFiles , and each site will have a separate folder. The log is a text file generated by daily by default. The format may be W3C, IIS, NCSA, etc., and the most commonly used is the W3C format.

There will be field definitions at the beginning of the log in W3C format, such as:

 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status

These fields represent the request time, server IP, request method, access path, query parameters, server port, user account, client IP, browser identification, response status code, etc.

Tips: If you see a lot of cs-uri-stem is /favicon.ico , this is actually a small icon that the browser automatically requests, which can be ignored.

2. Common data points that need attention

When analyzing logs, focus on the following aspects:

• HTTP status code (sc-status)
  for example:

  • 404 means that the page cannot be found
  • 500 is an internal server error
  • 200 means normal response

  If you find a large number of 404 or 500 errors, you need to check the configuration or code further.

• Client IP (c-ip) and User-Agent (cs(User-Agent)) can be used to identify abnormal access. For example, a certain IP frequently attempts to access non-existent pages, which may be scanning for vulnerabilities.

• Access time and frequency If traffic suddenly surges during a certain period of time, you can use other indicators to determine whether it is an attack or normal business growth.

• The request path (cs-uri-stem) shows which pages are most popular or whether unanticipated resources are frequently visited.

3. Use tools to improve efficiency

Although you can open logs directly with notepad, it is inefficient when facing large files. Several practical methods are recommended:

• LogParser
  The command line tool provided by Microsoft supports SQL query syntax and can quickly count specific fields, such as finding the IP with the most accessed:

   logparser "SELECT c-ip, COUNT(*) AS hits FROM *.log GROUP BY c-ip ORDER BY hits DESC"

• Excel Text Import Wizard
  Save the log file as .txt or .csv and import it through Excel for easy sorting, filtering and graph display.

• Third-party tools
  For example, LogParser Studio, GoAccess, ELK Stack, etc. are suitable for scenarios with higher analysis needs, especially when long-term monitoring or visual display is required.

---

4. Automation and regular inspection recommendations

IIS logs are generated every day, and manually viewing is too time-consuming. It is recommended to set up some automation mechanisms:

• Archive log files regularly to avoid full disk
• Write scripts to extract abnormal IP or error status code regularly, send email reminders
• Monitor IIS health with Windows Event Viewer

If you just check the problem occasionally, it is not too late to read the log of the corresponding date after the problem occurs.

---

Basically that's it. By mastering these key points, you can obtain valuable information from the logs, which are not complicated but are easy to ignore details.

The above is the detailed content of How to analyze IIS logs?. For more information, please follow other related articles on the PHP Chinese website!