IIS weblog analysis (Sharepoint document library audit)

Question

I have a particular requirement to analyse the IIS web logs and view which users (by username) have accessed a particular subset of pages.

Can anyone recommend a good analysis tool to get this information from the logs.

The ones I have looked at SmarterLogs and WebLog Expert seem to either list numbers of user (not who) have accessed a page. And don't offer selecting which pages you are interested in...

Thanks,

Apologies for re-opening this question. It seems the IIS logs didnt have the information I was after. I was looking for each user request of documents within a SharePoint 2003 document library. It seems that that this logging has to be enabled in SharePoint http://msdn.microsoft.com/en-us/library/dd583134(v=office.11).aspx

Has anyone tried to do this before in SP2003? And can I still use Log Parser?

Answer 1

My favorite tool for this is Log Parser (recommended initially by Peter), it has a bit of a learning curve but its very versatile. Microsoft PFE has a pretty good blog post on common queries to use to get data out of IIS logs with Log Parser, some of those queries may provide you with a quick leg up on what you're wanting to extract: http://blogs.technet.com/b/clinth/archive/2010/01/07/w3c-iis-log-analysis-using-log-parser.aspx

There's also a GUI tool for Log Parser called "Log Parser Lizard" which can simply it for you somewhat: http://www.lizard-labs.net/default.aspx

I also found a free tool that someone posted at IIS.net that may be worth a look, but I haven't tried it myself yet: http://www.iis.net/community/default.aspx?tabid=34&i=1864&g=6

John

Answer 2

If you are familiar with writing SQL queries, one option would be to import them into a database such as SQL Server. This is documented across the web, Microsoft doing it at http://support.microsoft.com/kb/296085

An alternative might to be to use a tool such as Microsoft's Log Parser, but it uses a similar query language. http://www.microsoft.com/download/en/details.aspx?id=24659

Answer 3

If you can describe the "subset of pages" as a regex, the following ruby should do the trick (feed the log into standard input):

users = []
$stdin.each_line { |l| next unless l =~ %r{interestingpagesregex}; u = l.split(/\s+/)[1]; users << u unless users.include? u }
puts users