Microsoft IIS
Microsoft IIS collects metrics from the IIS Windows performance counters and tails IIS access logs from disk. Metrics are scraped through the OpenTelemetry iisreceiver, and logs are read with the filelogreceiver and parsed according to the configured log format (W3C, IIS, or NCSA).
Supported Telemetry
Windows
✓
✓
Prerequisites
A Windows host running Microsoft IIS, with a Bindplane agent installed on that host.
For metrics: the IIS Windows performance counters must be available (they are installed with the IIS role). The agent collects them locally, so no network endpoint is required.
For logs: IIS logging must be enabled and writing to disk in a format the source can parse (W3C, IIS, or NCSA). The default IIS log directory is
%SystemDrive%\inetpub\logs\LogFiles(per-site subdirectories such asW3SVC1). The agent must have read access to the configured log paths, and the configured Log Format must match the format IIS is writing.
To enable and configure IIS logging, see Configure Logging in IIS. For the W3C field reference, see IIS Log File Formats.
Configuration
General
Choose Telemetry Type
Telemetry Selector
No
["Logs", "Metrics"]
Which signals this source collects. Select Logs, Metrics, or both.
Logs
File Path(s)
Strings
No
["C:/inetpub/logs/LogFiles/W3SVC*/**/*.log"]
File or directory paths to tail for logs. Relevant when Logs is selected.
Exclude File Path(s)
Strings
No
_(empty)_
File or directory paths to exclude. Relevant when Logs is selected.
Metrics
Metrics
Telemetry Selector
No
["Logs", "Metrics"]
Metrics are collected when Metrics is selected in Choose Telemetry Type. See the Advanced group to tune the collection interval and toggle individual metrics.
Advanced
Timezone
Timezone
No
UTC
The timezone to use when parsing timestamps (RFC3164 only). Relevant when Logs is selected.
Parse To
Enum: body, attributes
No
body
Parse the structured log parts to either the body or attributes. Relevant when Logs is selected.
Log Format
Enum: w3c, iis, ncsa
No
w3c
The format of the IIS logs. Relevant when Logs is selected.
W3C Header
String
No
date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
The W3C header used when parsing logs. Set to an empty string to enable auto-detection from the log file's #Fields: line. When auto-detection is enabled, the Start At setting is ignored. Relevant when Logs is selected and Log Format is w3c.
Start At
Enum: beginning, end
No
end
Start reading logs from the beginning or end of the file. Relevant when Logs is selected and Log Format is not w3c.
Start At
Enum: beginning, end
No
end
Start reading logs from the beginning or end of the file. Relevant when Logs is selected, Log Format is w3c, and W3C Header is set (non-empty).
Encoding
Enum: nop, utf-8, utf-16le, utf-16be, ascii, big5
No
utf-8
The encoding of the file being read.
Fingerprint size
String
No
3kb
The size of the file fingerprint used to distinguish unique files.
Force Flush Period
Duration
Yes
500ms
Time since the last read after which buffered logs are sent to the pipeline. 0 disables forced flushing.
Max Log Size
String
Yes
1MiB
The maximum size of a log entry to read. Larger entries are truncated.
Max Concurrent Files
Integer
No
1024
The maximum number of files read from concurrently.
Filesystem Poll Interval
Duration
No
2s
The duration between filesystem polls.
Collection Interval
Integer
No
60
How often (in seconds) to scrape for metrics. Relevant when Metrics is selected.
Metrics
Metrics
No
_(empty)_
Toggle individual IIS metrics on and off. Relevant when Metrics is selected.
Metrics
When Metrics is selected, the source collects the following IIS metrics. Use the Metrics toggle (Advanced) to disable any you do not want.
iis.connection.active
Connection
iis.connection.anonymous
Connection
iis.connection.attempt.count
Connection
iis.network.blocked
Network
iis.network.file.count
Network
iis.network.io
Network
iis.request.count
Request
iis.request.queue.age.max
Request
iis.request.queue.count
Request
iis.request.rejected
Request
iis.thread.active
Thread
iis.uptime
Uptime
Examples
Collect W3C access logs and metrics from a default IIS install
This source tails the per-site W3C logs under the default IIS log directory and scrapes IIS metrics every 30 seconds.
Configuration Tips
Set Log Format to match the format IIS is actually writing. W3C is the IIS 7+ default; use
iisfor the Microsoft IIS log file format andncsafor the NCSA Common format.For W3C logs, leave W3C Header empty to auto-detect fields from the file's
#Fields:header line. This adapts automatically when you add or remove fields in IIS, but note that Start At is ignored in this mode (the file is read from the beginning).The default File Path glob matches every per-site directory (
W3SVC*). Narrow it or use Exclude File Path(s) to limit which sites are collected.
Troubleshooting
No metrics are collected
Symptoms: the source is deployed but no iis.* metrics appear.
Solutions:
Confirm Metrics is selected in Choose Telemetry Type.
Verify the agent is running on the Windows host where IIS is installed (the performance counters are local and cannot be scraped remotely).
Check that the specific metrics are not disabled in the Metrics toggle.
No logs are collected
Symptoms: logs are enabled but no records arrive.
Solutions:
Verify IIS logging is enabled and writing files under the configured File Path(s). See Configure Logging in IIS.
Confirm the agent's service account has read access to the IIS log directory.
With Start At set to
end(the default), only logs written after the agent starts are read. Set it tobeginningto backfill existing files.
Logs arrive but fields are unparsed
Symptoms: log records are ingested but the body is not split into structured fields.
Solutions:
Ensure Log Format matches what IIS is writing (W3C vs. IIS vs. NCSA).
For W3C, either leave W3C Header empty to auto-detect, or set it to exactly the field list IIS is configured to log.
Standalone Source
Related Resources
Last updated
Was this helpful?