To troubleshoot server issues, you can associate the IIS log with the Event Viewer log through the timestamp and context fields. 1. Ensure that the time formats of the two are consistent and both use local time for comparison; 2. Use timestamps, client IP, username, status code, event ID and other key fields to establish associations; 3. Use Log Parser Studio, ELK Stack, Splunk or PowerShell scripts to improve analysis efficiency; 4. In actual scenarios, it can be used to troubleshoot problems such as user access errors, 500 status codes, and authentication failures, and quickly locate the root cause of the problem by combining time and context information.

Correlating IIS logs and Event Viewer logs are useful when troubleshooting server problems, especially when you want to locate specific time and context information when a request or error occurs. The key is to find the correspondence between the timestamps and event identification.

1. Confirm the timestamp format is consistent

The default time formats of IIS logs and event viewers may be different, and the first step is to make sure they both use the same time zone and time formats.

• IIS log time : Usually the server local time is recorded, the format is similar to 2024-03-15 10:23:45
• Event Viewer Time : The local time is displayed by default, but a more detailed time stamp can be seen in the event properties

Tips: You can enable the "Date Time Field" in the IIS log and set the "Details" view in the event viewer, so that you can compare time more accurately.

2. Find associated keyword fields

Although the contents of IIS logs and event logging are different, there are several key fields that can be used as bridges:

• Timestamp : The most direct way to associate, it is recommended to be accurate to seconds
• Client IP address (c-ip) : Can be used to track requests from specific users
• Username : When Windows authentication is enabled, you can match specific users
• Status code (sc-status) : If the 500 error is errored, you can find error events in the event log in the event log.
• Event ID : For example, the 500 error that occurs in IIS may have the corresponding Event ID 1000 or 1010 in the system log.

3. Use tools to assist in association

Manual comparison of logs is inefficient, and it is recommended to use the following tools for centralized analysis:

• Log Parser Studio : Microsoft's free tool, supports SQL-style query IIS logs, and can import event logs for comparison
• ELK Stack (Elasticsearch Logstash Kibana) : Suitable for long-term centralized management of logs, and visual associations are more intuitive
• Splunk : Business tool, powerful, suitable for enterprise-level log analysis
• PowerShell script : You can write a simple script to extract IIS logs and event logs and merge them to display by time

For example, you can use Log Parser to write a query like this:

 SELECT TO_TIMESTAMP(date, time) AS timestamp, cs-uri-stem, sc-status
FROM ex240315.log
WHERE sc-status >= 500

Then filter the "System Log" or "Application Log" for the same time period in the Event Viewer to see if any abnormal events have occurred.

4. Common scenarios in actual investigation

Here are a few scenarios you may use:

• A user reported an access error : Check the IP time in the IIS log, and then check whether there are corresponding error events in the event log.
• 500 error occurred in IIS : Check whether there are IIS or ASP.NET-related errors (such as Event ID 1000)
• Authentication failed : see the 401 status code in the IIS log. You can find the login failed event in the Security log in the event log.

Basically that's it. The core of the IIS and event log is the "time context field". If you use this information well, you can troubleshoot problems much faster. Tools can save you time, but understanding the log structure and content is the key.

The above is the detailed content of How to correlate IIS logs with event viewer logs?. For more information, please follow other related articles on the PHP Chinese website!