Is there a way to see /log which cipher suites are (actively) being used to establish SSL connections on Windows Server 2008 R2?
Ideally on a per request basis, like an extra column in the IIS logs.
IIS logs won't help you here, since the SSL connection is negotiated before any HTTP/application layer traffic starts flowing.
But what you can do is:
You can open that ETL file with Windows Performance Analyzer, and also with NetMon. (The latter will likely be more useful to you.)
Here's a screenshot of that trace file I just generated:
(Open in new tab to see fullsize)
Edit: To find the exact cipher mode being used, locate the "HandShake: Server Hello" packets:
Here is a Microsoft support article telling you how to interpret the bytes of the packet manually, but Netmon will do it for you.
You could come up with a packet trace filter that only contained packets of this nature. If there's a better way to get this data I'd like to know about it.