I need to be able to count only successful authentication attemtps for our IIS based Web Portal. All users come from the same IP Address. Is there something specific in the w3c logs to look for in order to perform what I am after?
Create a simple SQL file for this query named
And then we can generate a DataGrid to take a quick look:
Please note that network logons also include shared file and printer access authentications. If your IIS server is sharing printers or files outside of IIS, you may need a different method of gathering these data.
@dexter But the web logs do track authentication. If you get a 200 with a domain\user, you've successfully authenticated to that element. You might not be authorized to do anything but you've authenticated to the web server successfully.
You might also want to ignore the https status and just watch for domain\user against a particular file. That way you'd get authentications that show up as something else (ex. 500 error) where the authentication worked but something on the page failed.