IIS Log Files recording parameters?

[166geary]

Hello Everone,

This is my first time really working with IIS files and I've been having trouble making it work on WebTrends 8 (which we are trying out).

Basically, the website has pages like the follwing: "page.php?nav=1" for the homepage, "page.php?nav=2" for the about us and so on.

I have set WebTrends to find the parameter using ".*page\.php" under a regular expression and looking for the "nav" variable. However,WebTrends has been unable to see anything.

Is the logile not properly logging the parameter/query information? Please see the log file snippet below.

Is their something wrong in the way I am setting up my parameter filter?

#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes time-taken cs-version cs(User-Agent) cs(Cookie) cs(Referer)
2006-03-31 00:00:27 12.167.79.226 - WEBSITE.com 80 GET /styles/kn_php_Detect.js Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Win+9x+4.90),+http://www.WEBSITE.com/page.php?nav=2,+12.167.79.226-3991588832.29774933,+- 304 162 431 0 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Win+9x+4.90) EGSOFT_ID=12.167.79.226-3991588832.29774933 [WEBSITE.com...]
2006-03-31 00:00:27 12.167.79.226 - WEBSITE.com 80 POST /page.php Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Win+9x+4.90),+http://www.WEBSITE.com/page.php?nav=2,+12.167.79.226-3991588832.29774933,+nav=2 200 18133 567 203 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Win+9x+4.90) EGSOFT_ID=12.167.79.226-3991588832.29774933 [WEBSITE.com...]

[McElvoy]

That's very strange. The IIS headers are not matching what's in the logs after the cs-uri-stem field. You've got two different user agent fields, um, lotsa strange things. Your problem is definitely not in your statistics program. Maybe somebody else here has seen this kind of thing in IIS logs. I don't even know how you could make IIS do that if you wanted to. Are you manipulating the logs at any point?

[166geary]

McElvoy,

Thank you for the reply, its been very confusing.

I spoke with the IT guy who manages the IIS and he left all settings on default (never changed it) and it looked like the settings matches the log headers, but obviously that's not what's actually being written to the logs.

So now I am faced with two issues:
1. How can we correct the log file when the settings are actually correct, its just not being executed correctly?

2. I assume we can "fix" the log files by parsing and correcting them? Maybe a python scripter with a firm knowledge of log file formats can fix this?

Does anyone know of someone who could help us on that?

Thanks again everyone.