Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I've decided to try to analyse user behavior on my site by using the information in the IIS log files in order to think of improvements to the site.
I've tried some free tools to analyse logs (Web Log Expert and Log Analyzer: trends) and managed to get some useful information out of them, but not what I really needed.

What I'd like to have are data like "in which page users are leaving my site", "the path they've taken until they got to that exit page" and so on. Web Log Expert does attempt to give me that information, but the way it does it (by using that "visitor timeout" parameter) just messes all the statistics since I don't know any server-sided way to know that time.

So my question is: does anyone know if it's possible to gather this kind of information out of IIS logs and, if possible, how to do it?

Thank you in advance

share|improve this question
up vote 0 down vote accepted

Determining the exit page for a site is difficult to do reliably (without custom code in your site -- I'll get to that). For example, let's say I open and begin researching the answer to a question. That research takes me down the proverbial rabbit hole, and I don't actually get back to my serverfault browser window for 30 minutes.

From web logs alone, you can't determine whether my 30 minute absence was an "exit" followed by a new visit, or a "pause" of an existing visit. And that's just one example out of many of why a user might become "idle" on a site without it being a real "exit".

That's why analysis tools like Web Log Expert rely on a visitor timeout. You have to make your own assessment of how long a user would have to be idle to be considered having exited the site.

Of course, your log analysis tool (I'm generalizing here, because there are a lot of options out there) needs a way of differentiating users. IP address and User Agent string are not sufficient. For example, there may be multiple users in an office or school somewhere, all of them using homogenized OSes and browsers and coming in through a proxy or NAT (your server would see them all as the same IP and same UA string).

In IIS (not knowing which version, so I'll be vague) open the field selection dialog in the logging config. If Cookie is not checked off, check it (this is assuming that your site uses a session cookie). Also check off Referer.

These two options may make your log files a lot larger, but will give your analysis tool the ability to differentiate users (by session cookie), as well as their path through the site (by referer). AFAIK those fields are not enabled by default.

If you really want an accurate representation of when a user exits your site (closes browser or navigates elsewhere), you can implement an AJAX call on a timer in each of your pages that calls to a URL every X seconds. You can then set the visitor timeout in your analysis tool to something like X+2 seconds. Then you'll know exit times to an accuracy of X+2 seconds. Of course, exit pages will often be reported as being the URL of the AJAX call, so you'd need to somehow have the analysis tool ignore those as exit pages, but not ignore them when checking the visitor timeout.

Whether that's possible would depend upon the tool. I have no experience with Web Log Expert, so I couldn't say for certain.

There's always been a lot of debate as to which log analyzer is the best. IMO you need to try a bunch of them and find the one that best fits the balance of your needs for ease of use, complexity (or simplicity) of reports, speed, and presentation.

share|improve this answer
First of all, thank you for such detailed answer. My site is a reservation system, so I don't think there's much "idle time". I'll check on that session cookie, I believe there's something like that already being used. About the IIS, it's IIS 6. I tagged it but forgot to mention in the question, my bad. Again, thanks for the help. – Arthur Lago May 20 '13 at 13:24

IIS logs typically report only the pages someone is requesting and not the path they took to get there. Analysis may be possible, but to me it would be easier to implement something like Google Analytics to gather this data.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.