Choose tools for analyzing IIS logs

For SQL-style investigation of IIS logs, consider Microsoft's Log Parser engine and its Log Parser Studio interface. WebLog Expert provides graphical traffic reports, while GoAccess offers terminal and HTML views. Choose based on the questions you need to answer and the actual fields in your logs.

Log Parser Studio

Log Parser Studio is a Microsoft tool built on the Log Parser engine. Select IIS W3C input and the files to query, then run queries such as these separately:

-- Ten request paths with the most hits.
SELECT TOP 10 cs-uri-stem, COUNT(*) AS Hits
FROM '[LOGFILEPATH]'
GROUP BY cs-uri-stem
ORDER BY Hits DESC

-- Requests per hour.
SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS Hour, COUNT(*) AS Hits
FROM '[LOGFILEPATH]'
GROUP BY Hour
ORDER BY Hour

[LOGFILEPATH] is the Studio file-selection placeholder; a command-line query needs an actual path or wildcard. The queries require the corresponding fields in the W3C header. Studio's saved queries are useful starting points, but this is a legacy Windows tool: verify installation and compatibility on your analysis machine.

WebLog Expert

WebLog Expert produces graphical reports covering traffic, bandwidth, pages, referrers, and crawler activity. That can suit recurring operational reports. Visitor counts are estimates derived from log data, not a direct count of authenticated people. Verify the features and licensing of the edition you intend to use.

GoAccess

For a build that supports W3C input:

goaccess iis.log --log-format=W3C -o report.html

GoAccess can display a terminal dashboard or generate HTML. The command above writes a report; a continuously updating browser view needs the real-time HTML options and an ongoing log input. Check the W3C header and GoAccess version if parsing fails. Linux is a convenient place to analyze exported IIS files, provided you preserve the original headers and record boundaries.

Centralize logs when analysis spans servers

IIS supports several logging formats; W3C Extended is common and its field set is configurable. A centralized platform can support cross-server searches, retention, and alerts without copying files to each analyst's desktop.

For Guance, point DataKit log collection at the actual W3C files and parse fields in the order declared by #Fields. Verify timestamps and HTTP status codes using a request to a known URL. A parser based on an old field order can silently mislabel values after someone changes the site's logging settings.

Frequently asked questions

Where are the files normally stored?

With the usual per-site W3C configuration, look under %SystemDrive%\inetpub\logs\LogFiles\W3SVC<site-id>\. The directory, format, and rollover schedule are configurable; daily rollover is a common default.

What timezone do W3C records use?

The date and time fields use UTC. A local-time rollover setting affects filenames and rollover boundaries, not those record timestamps. Convert to local time in the analysis tool when needed.

How do I add request duration?

In IIS Manager, select the site, open Logging, choose Select Fields, and enable time-taken. Its unit is milliseconds; consider IIS's documented timing behavior before treating it as pure application execution time.

References: IIS logging configuration, GoAccess manual, and WebLog Expert.