Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > Configure the IIS Connector in LEM

Configure the IIS Connector in LEM

Table of contents

Updated 09/13/2017


This article discusses how to configure your IIS server to create compatible event logs and configure a LEM connector to parse them.


  • LEM all versions


Configure IIS logging to use the correct fields so that our connector can read the Log: 


  1. Check the log folder on the node where IIS is set up and remember the syntax of the log file name(s) along with the prefix and date/time format. The default folder path for IIS logs is C:\inetpub\logs\LogFiles\W3SVC1\.
  2. Check the connector settings in comparison: In the web console, go to Manage > Nodes, locate the node with IIS installed, click its gear icon and select Connectors. Locate the IIS connector, click on its gear icon and select New if you are setting up a new connector. If you already have the connector set up, select the existing connector.
  3. You should see the following field options:
    • Alias:
    • Log Directory or File:
    • New File Name Interval:
    • Time Zone:
    • Log Prefix:
    • Use Daylight Savings:
    • Output:
    • nDepth Host:
    • nDepth Port:
    • Sleep Time:
    • Wrapper Name:
    • Tool Version:
  4. Change the fields as appropriate for the file name syntax with accurate New File Name Interval and Log Prefix.
  5. Change the Time Zone to GMT.
  6. On the IIS server, open the Internet Information Services (IIS) Manager.
  7. Select the site you are working with and click on the logging icon.
  8. Click on Select Fields and make sure every box is checked:
    • Date (date)
    • Time (time)
    • Client IP Address (c-ip)
    • User Name (cs-username)
    • Service Name (s-sitename)
    • Server Name (s-computername)
    • Server IP Address (s-ip)
    • Server Port (s-port)
    • Method (cs-method)
    • URI Stem (cs-uri-stem)
    • URI Query (cs-uri-query)
    • Protocol Status (sc-status)
    • Protocol Substatus (sc-substatus)
    • Win32 Status (sc-win32-status)
    • Bytes Sent (sc-bytes)
    • Bytes Received (cs-bytes)
    • Time Taken (time-taken)
    • Protocol Version (cs-version)
    • Host (cs-host)
    • User Agent (cs(User-Agent))
    • Cookie (cs(Cookie))
    • Referer (cs(Referer))
  9. Restart the IIS service.


If all of the above items are in line, you should begin receiving IIS logs on the LEM.


Other suggested IIS related articles:

LEM - IIS Advanced Logging

Unable to start the IIS Web or FTP Server Connector in LEM

Read logs from multiple IIS sites on the same server


Articles referencing IIS:

Connector will not start or will stop after starting


Last modified


This page has no custom tags.