---
title: "Microsoft IIS"
slug: "microsoft-iis"
updated: 2025-06-26T16:27:37Z
published: 2025-06-26T16:27:37Z
canonical: "docs.databee.buzz/microsoft-iis"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft IIS

Internet Information Services (IIS) for Windows is a flexible, secure and manageable Web server for hosting anything on the Web. Logging events, usually an HTTP transaction, are recorded by the IIS logging module. For more information about the events refer the [Microsoft IIS documentation](https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525410(v=vs.90)).

**Integration Method**: Data Collector

**Tables**: FTP Activity (4008), HTTP Activity (4002) This integration supports the following type of events.

| **Event** | **Description** |
| --- | --- |
| FTP | Records each FTP operation handled by the IIS FTP server |
| HTTP | Records each HTTP request made to the IIS web server |

This integration supports the following versions.

| Microsoft IIS Version | 10.0 |
| --- | --- |
| Microsoft API version | N/A |

## Prerequisites

- The user should have a compatible version of the Windows system and configure the data collector.
- The user should have access to the DataBee console.

## Configuration Overview

1. [Configure the Data Collector](/user-manual/docs/microsoft-iis-may2025#data-collector-configuration)
2. Install the Data Collector on your machine and configure filters for the data feed.
  1. Install the Data Collector
  2. [Configure Logging](/user-manual/docs/microsoft-iis-may2025#microsoft-iis-configuration)
3. Create [](/docs/microsoft-iis#_DataBee_Configuration)[Microsoft IIS Data Feed](/user-manual/docs/microsoft-iis-may2025#databee-configuration) in the DataBee console.

## Data Collector Configuration

In order to receive logs from Microsoft IIS, a Data Collector must be installed and configured. The data collector will read the Microsoft IIS log files and send these events to DataBee encrypted. For more information refer to the [Data Collector article](https://docs.databee.buzz/docs/data-collector#configure-data-collector-in-databee).

> [!NOTE]
> **Note**
> 
> The logs files need to be accessible by the Data Collector via a remote mount or installed on the same IIS machine.

## Microsoft IIS Configuration

### Default Logging

- In the case of Default Logging, no additional configuration is required.
- To select all fields for forwarding, go for Custom Logging option (extended format support).

### Custom Logging

1. Open the **IIS Manager**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-775ihcly.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
2. In the **Connections tree view** of IIS Manager, select your **web server**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-awndb5id.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
3. In **Features View**, double-click **Logging**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-cd21423m.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
4. On the “Logging” page, confirm the following options:
  - **One log file per**: Make sure **Site** is selected
  - **Log File format**: **W3C**
  - **Directory**: Keep default
  - **Log Event Destination**: Select **Both log file and ETW event**
  - **Log File Rollover**: Keep default schedule (i.e. Hourly) ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-8fij3x78.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
5. Click on **Select Fields...** for Log File. Under the “W3C Logging Fields” window, make sure all fields are selected and click on **OK**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-zk7h13f1.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
6. Similarly, navigate to **Features View** and double-click **FTP Logging**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-9uj4xvba.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
7. On the “FTP Logging” page, confirm the following and keep default. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-0d74sgpf.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
8. Under ‘Log File’, click on **Select W3C Fields...** option and make sure all fields are selected and click on **OK**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-7l2qtapg.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D) For more information on Configuring Logging, refer to the article [Configure Logging in IIS](https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis).

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-jzspbtx0.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
2. Search for **Microsoft IIS** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-fsgt2rf3.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
3. Click on the **Data Collector** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-p79exw52.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
4. Click on the **Flat File** option to poll traffic events from the Microsoft IIS server. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-n0n7yw1y.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
5. Enter the feed contact information, select the collector that you have created, and click on the **Next** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-2a6h3ztg.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
6. Fill in the required details to configure the data feed and Click on the **Next** button.
  - **Format**: Select **cef** option from the dropdown menu.
  - **Refresh Interval (seconds)**: Select **1** second to achieve optimum performance. The available options are 1, 5, 10, and 20.
  - **Source Files**: Enter the list of source files to be monitored. For example, C:\inetpub\logs\LogFiles\*\*
  - **Exclusion Files (optional)**: Enter a list of source files to be excluded (Keep blank value).
  - **Tags (optional)**: Add the key-value pair optionally to identify the source. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-otawf3pl.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
7. Click on the **Submit** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-tg1jj5ml.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)

## Troubleshooting Tips

- Ensure that the server is reachable by opening the terminal on the receiver machine and running **ping <server_ip>** command. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-iis-may2025-image-6bnt3wsr.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A07%3A37Z&se=2026-10-30T13%3A07%3A37Z&sr=c&sp=r&sig=as%2B8zk2jn%2B701ZwVUe%2BdmFaLJlj1p%2Fe4w3lqoFZFxck%3D)
- If you encounter any issues regarding log forwarding, refer to the [DataBee troubleshooting article](https://docs.databee.buzz/docs/troubleshooting) for detailed guidance.