How to query W3CIISLog

[armin1961]

Hello

I'm totally lost with querying IIS HTTP logs at Azure Monitor.

It just returns NO RESULTS FOUND. 
What I'm doing wrong? Are there any configuration steps that I'm missed?

Thank you for your assistance.

 

[#2]

@armin1961, I am assuming you enabled IIS Logs collection in the Log Analytics workspace (Advanced Settings > Data > IIS Logs).

1. Have you checked if the Log Analytics agent is running healthy in the target machine? Is it sending hearbeats? Run this query to know if your machine has been heartbeating:

Heartbeat

| summarize arg_max(TimeGenerated, *) by Computer

2. Have you enabled logging in the IIS Web Sites you want to monitor? See https://support.microsoft.com/en-us/help/313437/how-to-enable-logging-in-internet-information-servic...

3. Are the Web Sites getting requests and are they being logged in the file system?

[#3]

@hspinto 

Many thanks for your quick response.

Going piece-by-piece:

...enabled IIS Logs collection in the Log Analytics workspace (Advanced Settings > Data > IIS Logs).

Yes, I have set up a Workspace and checked: Data > IISLogs > "Collect W3C format IIS log files".

The query...  

Heartbeat

| summarize arg_max(TimeGenerated, *) by Computer

... returns NO RESULTS FOUND.

Have you enabled logging in the IIS Web Sites...

I've enabled IIS logging by setting:

App Service
Monitoring > App Service logs: Web server logging - File System

(pls. see the pic below)

Yes, the site gets hits.

https://exitadviser.com

thank you for your assistance,

Armin

[#4]

P.S.

I've also set "Diagnostic settings" to send the stuff to Log Analytics:

[#5]

@armin1961, the W3CIISLog table holds IIS Logs collected by the Log Analytics agent running in a machine. That was my initial assumption.

I see you are forwarding Azure App Service HTTP logs to Log Analytics, but these logs are stored in another table. Can you please check if this query returns results?

AppServiceHTTPLogs

| limit 50

[#6 · Accepted solution]

@hspinto

Yes, that query returns some rows...

thanks,

Armin 

[#7]

All right, I can conclude that the question is perfectly answered.

I was not aware that these IIS logs are in another table.

Many thanks for your professional help, @hspinto.

Armin