Microsoft IIS 10 W3C Access Logs

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/web-microsoft-iis/generator.yml \
  --id web-microsoft-iis \
  --live-mode true

Event Types

Realism Features

• Explicit 15-field W3C Extended layout matching a published IIS 10.0 log and the Elastic IIS integration: space-delimited UTC rows at one-second resolution, - for unavailable values, + for spaces in the User-Agent, millisecond time-taken, HTTPS port 443 and the status triples 200 0 0, 304 0 0, 403 14 0 and 404 0 2. Rows carry no #Software, #Version, #Date or #Fields headers, so a parser of event.original needs the layout configured; the selection is not a universal IIS default (2026 updates add sc-bytes and cs-bytes on some builds), and response size is not available.
• 280 office PCs and 60 iPhones browse in sessions: a first view loads the page and most static assets, later views mostly revalidate them with 304 and carry the previous page as referer. Legacy pages link a missing favicon and stale URLs, and iPhones request missing apple-touch-icon files. Requests a browser sends together are seconds apart rather than milliseconds: assets follow their page after a median of 5-6 s.
• Seven records users (two remote), two script hosts (curl and PowerShell) and two IT staff work in /backup/, /admin/ and /exports/ in sittings of two to four visits, about 14, 36 and 10 visits a day per client. Records users and script hosts download their own exports with their Windows accounts; a browser download with a /reports.htm referer (about 60%) follows a view of that page, script hosts retry exports not generated yet and records users occasionally mistype a file name.
• About 23,200 requests a day (21,900-24,400). Browser traffic follows one UTC office-hours curve peaking around 11:30, and the mean rate is 0.66-0.71 requests per second at 10:00-12:59 UTC against 0.12-0.13 at 18:00-04:59; the monitor (once a minute, gaps of about 43-78 s), the scanner (a few bursts a day), the script hosts and part of the records users' work run around the clock. All weights and rates are synthetic workload values, not measured IIS traffic.
• Every step and partial sequence of the chain also occurs in ordinary traffic of both modes from the same clients, including about 32 /backup/ -> /admin/ -> /exports/ sequences a day within 15 minutes from one client. An ordinary download that would complete the sequence within 15 minutes of the /backup/ request is answered 404 0 2 (withheld, about 27 a day); later ones succeed, so a window longer than 15 minutes finds about 2-3 ordinary complete sequences a day between 15 and 30 minutes. With anomaly_mode true, counts of the chain parts are about one per episode higher.
• Windows authentication appears only as the account on successful export downloads; the anonymous 401 2 5 challenge is not modeled and directory probes are anonymous. Access rows do not show how the client obtained access or how many bytes it downloaded, and behind a load balancer c-ip can be the proxy address unless a forwarded-client field is logged.

Sample Output

{
  "@timestamp": "2026-09-02T09:21:15+00:00",
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "kind": "event",
    "module": "iis",
    "dataset": "iis.access",
    "category": [
      "web"
    ],
    "type": [
      "access"
    ],
    "action": "http_request",
    "outcome": "success",
    "duration": 223000000,
    "original": "2026-09-02 09:21:15 10.20.0.10 GET /exports/ap-aging.csv - 443 CONTOSO\\tgarcia 10.20.2.44 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:152.0)+Gecko/20100101+Firefox/152.0 https://intranet.contoso.example/reports.htm 200 0 0 223"
  },
  "host": {
    "name": "WEB-IIS-01",
    "ip": "10.20.0.10"
  },
  "source": {
    "ip": "10.20.2.44"
  },
  "destination": {
    "ip": "10.20.0.10",
    "port": 443
  },
  "http": {
    "request": {
      "method": "GET"
    },
    "response": {
      "status_code": 200
    }
  },
  "url": {
    "path": "/exports/ap-aging.csv"
  },
  "user_agent": {
    "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0"
  },
  "iis": {
    "access": {
      "sub_status": 0,
      "win32_status": 0
    }
  },
  "user": {
    "name": "CONTOSO\\tgarcia"
  }
}

Parameters