You can use Log Service to collect and analyze Internet Information Services (IIS) logs. This topic demonstrates how to analyze key metrics from your IIS logs, such as page views (PV), unique visitors (UV), visitor locations, error requests, and request methods, to assess website performance.
Prerequisites
Ensure that IIS logs are collected. For more information, see Collect logs in IIS configuration mode.
During log collection, Log Service automatically creates an index based on the log content. To modify the index, see Create an index.
Background information
Internet Information Services (IIS) is a popular web server known for its ease of use and robust security. When you use IIS to host a website, its logs provide essential information for operations and maintenance.
Log Service recommends that you use the W3C Extended Log File Format. The following example shows the configuration:
logExtFileFlags="Date, Time, ClientIP, UserName, SiteName, ComputerName, ServerIP, Method, UriStem, UriQuery, HttpStatus, Win32Status, BytesSent, BytesRecv, TimeTaken, ServerPort, UserAgent, Cookie, Referer, ProtocolVersion, Host, HttpSubStatus"The following is a sample IIS log:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2020-09-08 09:30:26
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2009-11-26 06:14:21 W3SVC692644773 125.67.67.* GET /index.html - 80 - 10.10.10.10 Baiduspider+(+http://www.example.com)200 0 64 185173 296 0-
Field prefixes
Prefix
Description
s-
Indicates a server action.
c-
Indicates a client action.
cs-
Indicates a client-to-server action.
sc-
Indicates a server-to-client action.
-
Field descriptions
Field
Description
date
The date the client sent the request.
time
The time the client sent the request.
s-sitename
The name of the Internet service and the instance number of the site that the client visited.
s-computername
The name of the server where the log entry was generated.
s-ip
The IP address of the server where the log entry was generated.
cs-method
The request method, such as GET or POST.
cs-uri-stem
The URI of the requested resource.
cs-uri-query
The query string, which is the information that follows the question mark (?).
s-port
The server port number that handled the request.
cs-username
The authenticated domain or username.
-
For authenticated users, the format is
Domain\Username. -
A hyphen (-) indicates anonymous users.
c-ip
The IP address of the client that made the request.
cs-version
The protocol version used by the client, such as HTTP/1.0 or HTTP/1.1.
cs(User-Agent)
The browser used by the client.
Cookie
The content of the cookie sent or received. A hyphen (-) indicates that no cookie was sent or received.
referer
The previous site that referred the user.
cs-host
The content of the Host header.
sc-status
The HTTP status code.
sc-substatus
The substatus code, which provides more specific error information.
sc-win32-status
The Windows status code.
sc-bytes
The number of bytes sent by the server.
cs-bytes
The number of bytes received by the server.
time-taken
The time taken to process the request, in milliseconds.
-
Procedure
Log on to the Simple Log Service console.
In the Projects section, click the one you want.
On the tab, click the logstore you want.
-
Enter a query statement, and then click Last 15 Minutes to set the time range.
For more information, see Step 1: Configure indexes.
-
To analyze visitor locations by IP address:
*| select ip_to_geo("c-ip") as country, count(1) as c group by ip_to_geo("c-ip") limit 100 -
To calculate PV and UV:
*| select approx_distinct("c-ip") as uv ,count(1) as pv , date_format(date_trunc('hour', __time__), '%m-%d %H:%i') as time group by date_format(date_trunc('hour', __time__), '%m-%d %H:%i') order by time limit 1000
-
To view the distribution of HTTP status codes:
*| select count(1) as pv ,"sc-status" group by "sc-status"
-
To analyze inbound and outbound traffic:
*| select sum("sc-bytes") as net_out, sum("cs-bytes") as net_in ,date_format(date_trunc('hour', time), '%m-%d %H:%i') as time group by date_format(date_trunc('hour', time), '%m-%d %H:%i') order by time limit 10000
-
To view the distribution of request methods:
*| select count(1) as pv ,"cs-method" group by "cs-method"
-
To view the distribution of browsers:
*| select count(1) as pv, case when "user-agent" like '%Chrome%' then 'Chrome' when "user-agent" like '%Firefox%' then 'Firefox' when "user-agent" like '%Safari%' then 'Safari' else 'unKnown' end as "user-agent" group by case when "user-agent" like '%Chrome%' then 'Chrome' when "user-agent" like '%Firefox%' then 'Firefox' when "user-agent" like '%Safari%' then 'Safari' else 'unKnown' end order by pv desc limit 10 -
To find the top 10 most requested paths:
*| select count(1) as pv, split_part("cs-uri-stem",'?',1) as path group by split_part("cs-uri-stem",'?',1) order by pv desc limit 10
-
