I've long heard people with this request but I'm working in a new environment where I'm not sure what views and dashboards anybody actually uses in Orion so I went ahead and built a tool in powershell to review the IIS logs to try and figure it out over the next few weeks.
It's pretty simple, will just crawl through the iis logs, breaks out the columns I thought might become useful and then I included a few examples of how you can take the resulting psobject and navigate through it or sort the data. I'm planning that after a month or so of log review I can put together a list of dashboards that are not used to see if maybe they should be ditched or if the team that they are supposed to be for has forgotten they exist.
As usual I'll have the latest version available through my Github page,
https://github.com/Mesverrum/MyPublicWork/blob/master/IISLogParser.ps1
For those of you who don't have access to github this is the current version:
# needs to be run with elevated permissions to access IIS log directories
# how far back in hours do we want to review logs?
$duration = 48
if(!$creds) {$creds = Get-Credential}
$sites = get-iissite
$ParsedLogs = $null
$ParsedLogs = [System.Collections.ArrayList]@()
foreach($site in $sites ) {
Write-host " Checking $site Logs" -foregroundcolor Green
$logDir = $site.logfile.directory + "\w3svc" + $site.id
Write-host " $logDir" -foregroundcolor DarkGray
$logs = Get-ChildItem -Path $logDir | Where-Object {$_.LastWriteTime -ge [DateTime]::Now.Addhours(-$duration)}
ForEach ($log in $logs) {
Write-host " Parsing $($log.fullname)" -foregroundcolor DarkGreen
$results = @(
Select-String $log -Pattern ' GET ', ' POST ' |
where { $_ -match "^(?<Timestamp>\S+ \S+) \S+ \S+ \S+ (?<Method>\S+) (?<URIQuery>\S+ \S+) \d+ (?<User>\S+) (?<IP>\S+) \S+ \S+ \S+ \S+ \S+ (?<Response>\S+) \S+ \S+ (?<ServerBytesSent>\d+) (?<ClientBytesSent>\d+) (?<MS>\d+)" } |
foreach {
new-object PSObject –Property @{
Server = $server
Timestamp = $matches['Timestamp']
Method = $matches['Method']
URIQuery = ($matches['URIQuery']).Replace(' ','?')
User = $matches['User']
IP = $matches['IP']
Response = $matches['Response']
ServerBytesSent = [int]$matches['ServerBytesSent']
ClientBytesSent = [int]$matches['ClientBytesSent']
MS = [int]$matches['MS']
} } )
[void]$ParsedLogs.Add($results)
}
}
# Examples of using the data
# most frequently requested pages
$ParsedLogs.URIQuery | where-object {$_ -like "*.aspx*" }| group-object | sort-object -Property "Count" -Descending | select -first 20 | ft -Property ("Count", "Name");
# most frequent User
#$ParsedLogs.User | group-object | sort-object -Property "Count" -Descending | select -first 10 | ft -Property ("Count", "Name");
# most frequent IP
#$ParsedLogs.IP | group-object | sort-object -Property "Count" -Descending | select -first 10 | ft -Property ("Count", "Name");
<# URI with the longest total amounts of time, this number can be affected by the client side as well as the server execution time and pages with more requests will obviously have high numbers here.
$aggs = @()
foreach($obj in $parsedlogs) {
foreach($row in $obj) {
if($row.uriquery -notin $aggs.uriquery) {
"Adding new row for $($row.uriquery)"
$new = new-object PSObject –Property @{
URIQuery = $row.uriquery
TotalMS = $row.ms
}
$aggs += $new
} else {
$index = $aggs.IndexOf($row.uriquery)
$aggs[$index].TotalMS = ($aggs[$index].TotalMS + $row.ms)
"Incrementing $($row.uriquery) by $($row.ms) ms to get $($aggs[$index].TotalMS) ms"
}
}
}
$aggs | sort-object -property totalms -Descending | select -first 10 | ft -Property ("totalms", "uriquery");
#>
