Question

我想将自己的列附加到IIS W3C请求日志这可能吗？

我希望IIS为每个日志行添加自定义列和值。

Answer 1

您可以将自定义日志数据附加到IIS日志。但它会附加到UriQuery列。

进行追加

Answer 2

W3C.zip related files 您可以导入W3C格式，清除标题，然后添加自己的标题。例如：

Step 1:
 get the log u_ex181121.log [get rid of the first 3 header rows  leaving the 4th but taking out just this '#Fields: ']
 so your header should look like this:
 date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken

Step 2:
 Remove any more headers that may appear in the log file throughout the life of the log file.

Step 3:
 Import Parse the file (For example manually with EXCEL or some other ETL process delimiting by space   
  See W3C.zip for related files:
  u_ex181121.log = the log file generated by IIS
  u_ex181121.log.xls = the imported version of u_ex181121.log
  _ULog_StatusLU.xls = the Status Code Lookup 
  2018.11.21_Query_Results.xls = the results from the W3C_LOG.sql query
  W3C_LOG.sql = the query


            --Query Logs
            SELECT
                tRet.[date]
                , tRet.[date-time]
                , tRet.[date-time-mst]
                , tRet.[s-ip]
                , tRet.[cs-method]
                , tRet.[cs-uri-stem]
                , tRet.[cs-uri-query]
                , tRet.[s-port]
                , tRet.[cs-username]
                , tRet.[c-ip]
                , tRet.[cs(User-Agent)]
                , tRet.[sc-status]
                , tRet.[sc-substatus]
                , tRet.[sc-win32-status]
                , tRet.[time-taken] 
                , tRet.[time-taken-seconds]  
                , tRet.[time-taken-minutes]
                , tRet.[sc-status-Description]
                , tRet.[sc-status-Notes] 
            From
            (
                SELECT
                    Cast(l.[date] As Date) [date]
                    , Cast(Replace(Cast(l.[date] As varchar(20)), ' 00:00:00.', '') + Cast(Replace(Replace(Cast(l.[time] as varchar(20)), '1899-12-31', ''), '.', '') as varchar(20)) As DateTime) As [date-time]
                    , DateAdd('n', (-60*7), (Cast(Replace(Cast(l.[date] As varchar(20)), ' 00:00:00.', '') + Cast(Replace(Replace(Cast(l.[time] as varchar(20)), '1899-12-31', ''), '.', '') as varchar(20)) As DateTime))) As [date-time-mst]
                    , l.[s-ip]
                    , l.[cs-method]
                    , l.[cs-uri-stem]
                    , l.[cs-uri-query]
                    , l.[s-port]
                    , l.[cs-username]
                    , l.[c-ip]
                    , l.[cs(User-Agent)]
                    , l.[sc-status]
                    , l.[sc-substatus]
                    , l.[sc-win32-status]
                    , l.[time-taken] 
                    , ROUND((l.[time-taken] * .001), 2) As [time-taken-seconds]
                    , ROUND((l.[time-taken] * 1.66667e-5), 4) As [time-taken-minutes]
                    , lu.[sc-status-Description]
                    , lu.[sc-status-Notes] 
                FROM
                    [u_ex181121.log].[u_ex181121] l
                    Left Outer Join [_ULog_StatusLU].[StatusLU] lu on l.[sc-status] = lu.[sc-status]
            ) tRet
            Order By
            tRet.[date-time-mst] DESC[enter link description here][1]

将任意数据附加到IIS W3C日志？

2 个答案: