DWA Emitter for Microsoft Windows IIS FTP Server W3C extended log format

Prerequisites

This emitter supports the W3C extended log format produced by the FTP Server component included in Microsoft Windows Internet Information Server (IIS).

DWA Emitter for IIS is certified with IIS 10.

IIS configuration allows selective inclusion and exclusion of specific attributes from the generated W3C extended logs.

DWA Emitter requires IIS to be configured to include the following fields in the W3C extended logs generated:

  1. date (date)

  2. time (time)

  3. c-ip (client IP address)

  4. c-port

  5. cs-username (user name)

  6. s-sitename

  7. s-computername

  8. cs-host

  9. s-ip

  10. s-port

  11. cs-method (requested method, protocol verb)

  12. cs-uri-stem (URI stem, target of the action)

  13. sc-status (status code)

  14. sc-win32-status

  15. sc-substatus

  16. sc-bytes (number of bytes that the server sent)

  17. cs-bytes (number of bytes that the server received)

  18. time-taken (number of milliseconds that the action took)

  19. x-session

  20. x-fullpath

  21. x-debug

Here is an example of a valid IIS W3C extended log:

#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2025-06-19 10:00:54
#Fields: date time c-ip c-port cs-username s-sitename s-computername cs-host s-ip s-port cs-method cs-uri-stem sc-status sc-win32-status sc-substatus sc-bytes cs-bytes time-taken x-session x-fullpath x-debug
2025-06-19 10:00:54 123.45.678.90 54321 - - DEL-CUSTOMER01 - 12.34.5.67 89 ControlChannelOpened - - 0 0 0 0 0 d1678a06-t750-77v4-5s8g-5y77gf355749 - -
2025-06-19 10:00:54 123.45.678.90 54321 - FTPSVC2 DEL-CUSTOMER01 - 12.34.5.67 89 USER jane.doe 571 0 0 71 82 0 d1678a06-t750-77v4-5s8g-5y77gf355749 - -
2025-06-19 10:01:00 123.45.678.90 54321 NASA\jane.doe FTPSVC2 DEL-CUSTOMER01 - 12.34.5.67 89 PASS *** 123 0 0 12 12 34 d1678a06-t750-77v4-5s8g-5y77gf355749 / -

For more information about IIS log settings please refer to IIS 10 official documentation.

Configuration reference

DWA Emitter for Microsoft Windows IIS FTP Server W3C extended log format -- Prefix emitter.w3c[<label>].*

Properties
Description

protocolType

Type of protocol involved. For emitter.w3c, it is FTP.

logFilePath

Name of the primary log file to monitor, complete with absolute path.

All pattern properties included in the configuration conform to Java Message Format syntax as defined in: https://docs.oracle.com/javase/8/docs/api/java/text/MessageFormat.html

PreviousDWA Emitter for OpenSSH SFTP ServerNextDWA Emitter for IBM STERLING CONNECT:DIRECT

Last updated