Submit a ticketCall us

Training ClassThe Orion® Platform Instructor-led Classes

Provided by SolarWinds® Academy, these trainings will introduce users to the Orion Platform and its features, management, and navigation. These courses are suitable for users looking to discover new tips, tricks, and ways to adapt their Orion products to better suit their monitoring needs:
Deploying the Orion Platform
Configuring Orion views, maps, and accounts
Configuring Orion alerts and reports

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Configure the IIS Connector in LEM

Configure the IIS Connector in LEM

Table of contents

Updated 09/13/2017


This article discusses how to configure your IIS server to create compatible event logs and configure a LEM connector to parse them.


  • LEM all versions


Configure IIS logging to use the correct fields so that our connector can read the Log: 


  1. Check the log folder on the node where IIS is set up and remember the syntax of the log file name(s) along with the prefix and date/time format. The default folder path for IIS logs is C:\inetpub\logs\LogFiles\W3SVC1\.
  2. Check the connector settings in comparison: In the web console, go to Manage > Nodes, locate the node with IIS installed, click its gear icon and select Connectors. Locate the IIS connector, click on its gear icon and select New if you are setting up a new connector. If you already have the connector set up, select the existing connector.
  3. You should see the following field options:
    • Alias:
    • Log Directory or File:
    • New File Name Interval:
    • Time Zone:
    • Log Prefix:
    • Use Daylight Savings:
    • Output:
    • nDepth Host:
    • nDepth Port:
    • Sleep Time:
    • Wrapper Name:
    • Tool Version:
  4. Change the fields as appropriate for the file name syntax with accurate New File Name Interval and Log Prefix.
  5. Change the Time Zone to GMT.
  6. Check the box for Daylight Savings Time(This needs to be selected). 
  7. On the IIS server, open the Internet Information Services (IIS) Manager.
  8. Select the site you are working with and click on the logging icon.
  9. Click on Select Fields and make sure every box is checked:
    • Date (date)
    • Time (time)
    • Client IP Address (c-ip)
    • User Name (cs-username)
    • Service Name (s-sitename)
    • Server Name (s-computername)
    • Server IP Address (s-ip)
    • Server Port (s-port)
    • Method (cs-method)
    • URI Stem (cs-uri-stem)
    • URI Query (cs-uri-query)
    • Protocol Status (sc-status)
    • Protocol Substatus (sc-substatus)
    • Win32 Status (sc-win32-status)
    • Bytes Sent (sc-bytes)
    • Bytes Received (cs-bytes)
    • Time Taken (time-taken)
    • Protocol Version (cs-version)
    • Host (cs-host)
    • User Agent (cs(User-Agent))
    • Cookie (cs(Cookie))
    • Referer (cs(Referer))
  10. Restart the IIS service.


If all of the above items are in line, you should begin receiving IIS logs on the LEM.


Other suggested IIS related articles:

LEM - IIS Advanced Logging

Unable to start the IIS Web or FTP Server Connector in LEM

Read logs from multiple IIS sites on the same server


Articles referencing IIS:

Connector will not start or will stop after starting


Last modified


This page has no custom tags.