Forum Discussion

armin1961

Copper Contributor

Nov 26, 2019

Solved

How to query W3CIISLog

Hello I'm totally lost with querying IIS HTTP logs at Azure Monitor. It just returns NO RESULTS FOUND. What I'm doing wrong? Are there any configuration steps that I'm missed? Thank you for your...

azure monitor

armin1961
Nov 29, 2019
hspinto
Yes, that query returns some rows...
thanks,
Armin

armin1961

Copper Contributor

Nov 28, 2019

hspinto

Many thanks for your quick response.

Going piece-by-piece:

...enabled IIS Logs collection in the Log Analytics workspace (Advanced Settings > Data > IIS Logs).

Yes, I have set up a Workspace and checked: Data > IISLogs > "Collect https://www.mms.microsoft.com/Redirect?outgoingURL=https%3A%2F%2Fgo.microsoft.com%2Ffwlink%2F%3Flinkid%3D841477".

The query...

Heartbeat

| summarize arg_max(TimeGenerated, *) by Computer

... returns NO RESULTS FOUND.

Have you enabled logging in the IIS Web Sites...

I've enabled IIS logging by setting:

App Service
Monitoring > App Service logs: Web server logging - File System

(pls. see the pic below)

Yes, the site gets hits.

https://exitadviser.com

thank you for your assistance,

Armin

armin1961

Copper Contributor

Nov 28, 2019

P.S.

I've also set "Diagnostic settings" to send the stuff to Log Analytics:

hspinto
Microsoft
Nov 28, 2019
armin1961, the W3CIISLog table holds IIS Logs collected by the Log Analytics agent running in a machine. That was my initial assumption.

I see you are forwarding Azure App Service HTTP logs to Log Analytics, but these logs are stored in another table. Can you please check if this query returns results?

AppServiceHTTPLogs

| limit 50
- armin1961
  Copper Contributor
  Nov 29, 2019
  hspinto
  Yes, that query returns some rows...
  thanks,
  Armin
  - armin1961
    Copper Contributor
    Nov 29, 2019
    All right, I can conclude that the question is perfectly answered.
    I was not aware that these IIS logs are in another table.
    Many thanks for your professional help, hspinto.
    Armin