1 Reply Latest reply on Jul 21, 2015 10:41 AM by curtisi

    IIS Activity Logging - Missing User Account

    Mark Roberts



      I have configured IIS monitoring and am seeing log data from the Microsoft IIS W3C v8.5 tool such as page requests, CSS requests etc. The IIS server has been configured to enable all log entities.


      The website log data is being received for has Windows Authentication enabled and I have confirmed with a manual review of the IIS log file that the CS-Username field is being populated in the log. However this data is not being shown in the LEM normalized data structure and I would have expected it to appear in the SourceAccount field.


      Is the username value something that LEM should be parsing into it's dataset from the IIS log source and if so how can I get this to appear?