Forum Discussion

armin1961's avatar
armin1961
Copper Contributor
Nov 26, 2019
Solved

How to query W3CIISLog

Hello I'm totally lost with querying IIS HTTP logs at Azure Monitor. It just returns NO RESULTS FOUND.  What I'm doing wrong? Are there any configuration steps that I'm missed? Thank you for your...
azure monitor
  • armin1961's avatar
    armin1961
    Nov 29, 2019

    hspinto

    Yes, that query returns some rows...

    thanks,

    Armin 

     

hspinto's avatar
hspinto
Icon for Microsoft rankMicrosoft
Nov 26, 2019

armin1961, I am assuming you enabled IIS Logs collection in the Log Analytics workspace (Advanced Settings > Data > IIS Logs).

 

1. Have you checked if the Log Analytics agent is running healthy in the target machine? Is it sending hearbeats? Run this query to know if your machine has been heartbeating:

 

Heartbeat
| summarize arg_max(TimeGenerated, *) by Computer
 
2. Have you enabled logging in the IIS Web Sites you want to monitor? See https://support.microsoft.com/en-us/help/313437/how-to-enable-logging-in-internet-information-services-iis
 
3. Are the Web Sites getting requests and are they being logged in the file system?

 

armin1961's avatar
armin1961
Copper Contributor
Nov 28, 2019

hspinto 

Many thanks for your quick response.

Going piece-by-piece:

 

...enabled IIS Logs collection in the Log Analytics workspace (Advanced Settings > Data > IIS Logs).

Yes, I have set up a Workspace and checked: Data > IISLogs > "Collect https://www.mms.microsoft.com/Redirect?outgoingURL=https%3A%2F%2Fgo.microsoft.com%2Ffwlink%2F%3Flinkid%3D841477".

 

The query...  

Heartbeat
| summarize arg_max(TimeGenerated, *) by Computer

... returns NO RESULTS FOUND.

 

Have you enabled logging in the IIS Web Sites...

I've enabled IIS logging by setting:

App Service
Monitoring > App Service logs: Web server logging - File System

(pls. see the pic below)

 

Yes, the site gets hits.

https://exitadviser.com

 

thank you for your assistance,

Armin

 

 

 

 

  • armin1961's avatar
    armin1961
    Copper Contributor
    Nov 28, 2019

    P.S.

    I've also set "Diagnostic settings" to send the stuff to Log Analytics:

     

    • hspinto's avatar
      hspinto
      Icon for Microsoft rankMicrosoft
      Nov 28, 2019

      armin1961, the W3CIISLog table holds IIS Logs collected by the Log Analytics agent running in a machine. That was my initial assumption.

       

      I see you are forwarding Azure App Service HTTP logs to Log Analytics, but these logs are stored in another table. Can you please check if this query returns results?

       

      AppServiceHTTPLogs
      | limit 50

       

      • armin1961's avatar
        armin1961
        Copper Contributor
        Nov 29, 2019

        hspinto

        Yes, that query returns some rows...

        thanks,

        Armin 

         

Resources