I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the regular IIS logs with Snare; however it does not work the same for IIS Advanced Logging.

The default file path is different for IIS Advanced Logging (%SystemDrive%\inetpub\logs\AdvancedLogs) and it appears that the file names are based upon the UTC time, see here, and not the local date and time that you can specify with regular logging. This also creates and issue for developing some type of wildcard rule if we wanted to test this with Snare. Any ideas are welcome.


logparser has the ability to insert into syslog

type logparser -h -o:syslog

Wrap into a batch file or powershell script. That is one option.


Send error entries in the IIS log to a SYSLOG server:

 LogParser "SELECT TO_TIMESTAMP(date,time), CASE sc-status WHEN 500 THEN
 'emerg' ELSE 'err' END AS MySeverity, s-computername AS MyHostname,
 cs-uri-stem INTO @myserver FROM <1> WHERE sc-status >= 400" -o:SYSLOG
 -severity:$MySeverity -hostName:$MyHostname
| improve this answer | |

Have you looked at Snare for collecting and forwarding logs to syslog? I haven't looked for a while but, at one time, they had support for file-based logs (i.e. polling the IIS log files), as well as direct support for IIS and even Windows Event Logs.

| improve this answer | |
  • We are currently using Snare successfully for the regular IIS logs. However, I am not able to figure out the syntax to have it match on the Advanced IIS Logs since it appears to be using some random method for how it writes out the file names. Any ideas would be appreciated. – John Jan 23 '13 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.