1

I need to be able to count only successful authentication attemtps for our IIS based Web Portal. All users come from the same IP Address. Is there something specific in the w3c logs to look for in order to perform what I am after?

3
  • Which authentication method(s) are you using?
    – jscott
    Jun 9, 2011 at 13:23
  • Integrated Windows Authentication
    – dexter
    Jun 9, 2011 at 13:34
  • Do you mean "per user, per 20 minutes"?
    – TristanK
    Jun 9, 2011 at 22:00

2 Answers 2

2

The W3SVC1 logs will indicate the HTTP status of requests. Your authentication is logged in the Security event log. Successful network logons register Event ID 540, Type 3.

Create a simple SQL file for this query named query.sql:

SELECT
    TimeGenerated,
    EventID,
    EXTRACT_TOKEN(Strings,0,'|') AS User,
    EXTRACT_TOKEN(Strings,3,'|') AS Type
FROM
    Security
WHERE 
    (EventID = 540) AND (Type LIKE '3')
ORDER BY
    TimeGenerated
DESC

And then we can generate a DataGrid to take a quick look:

LogParser.exe file:query.sql -o:DATAGRID -i:EVT

Please note that network logons also include shared file and printer access authentications. If your IIS server is sharing printers or files outside of IIS, you may need a different method of gathering these data.

2
  • ok great - 2 things though, is there any way to somehow detect a logon in the W3SVC, may be by looking at 2 log records belonging to the same domain user within particular time frame? What else can I look at in the W3SVC? The problem is - with the security logs I don't really know what application they hit plus the logs dont go back that long..
    – dexter
    Jun 9, 2011 at 17:47
  • @dexter The W3SVC log really only captures access, not authentication. This page details what a successful "auth" looks like in the W3SVC log. You'd be sniffing for 401s immediately followed by a 200 on the same resource -- and then guessing they're associated. One problem is that before the auth has happened, the log lists only the client IP. After the auth, you get the username. It's possible you can script something to do this but I do not think LogParser would be the answer.
    – jscott
    Jun 9, 2011 at 18:44
1

@dexter But the web logs do track authentication. If you get a 200 with a domain\user, you've successfully authenticated to that element. You might not be authorized to do anything but you've authenticated to the web server successfully.

It is likely in the W3SVC logs that you'd see a successful 200 after a 401 on every element of a page (images, javascript, etc.), so that's not really a useful count as a single page may show 10+ authentications for each user. But if you narrowed it down with log parser to a specific element, say index.aspx, that would tell you how many successful authentications against that file and you could ignore the rest of the loads on that page.

You might also want to ignore the https status and just watch for domain\user against a particular file. That way you'd get authentications that show up as something else (ex. 500 error) where the authentication worked but something on the page failed.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .