I’m trying to import my IIS webserverlogs from the Advanced Logging for IIS module.
Everytime i try to parse the log-file with import_logs.py, it doesn’t work.
The regular W3C IIS-logging works fine, but because the webserver is behind a load balancer, i need to use the x-forwarded-for field. So i’m constricted to Advanced Logging ( right? )
In Advanced Logging I carefully reconstructed the entire W3C layout:
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2014-04-10 12:40:24.190 5.5.5.5 GET /index.asp - 80 - 6.6.6.6 “Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36” 200 0 0 2036
The regular IIS W3C-logs:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2014-03-10 23:00:00
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2014-04-10 12:40:24 10.123.17.66 GET /index.php - 80 - 10.0.1.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_9_2)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/33.0.1750.152+Safari/537.36 200 0 0 2036
The only difference i can spot is that the ‘time’ and ‘User-agent’ differs. the field ‘time’ shows milliseconds and user-agent doesn’t user the ‘+’ delimiter. It seems that Piwik can’t handle this different layout.
Doesn’t Piwik work Advanced Logging at all? Do i’ve got other options for utilizing the Forward-for field?
Thanks in advance.