Skip to content
WinBookUnofficial

Logs, audit and SIEM for a Windows web server

Verified 1 min read

Collect IIS/Nginx access logs, Windows security events and app logs, keep time and retention sane, and alert on what matters.

Tested onStandard / Datacenter · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Method

The short answer

Section titled “The short answer”

Collect four streams:

  1. Web access — IIS W3C / Nginx access log.
  2. Web errors — IIS failed request tracing / Nginx error log.
  3. Windows — Security, System, Application events.
  4. App — stdout/stderr, structured JSON logs.

Ship them off-box; local logs vanish with the host.

What to keep

Section titled “What to keep”
  • timestamp with timezone, server, site/host, client IP, method, path, status, bytes, latency;
  • authenticated user (if safe), user agent;
  • request id/correlation id.

Do not log passwords, tokens, full cookies, card data or sensitive query strings. Redact at the app/proxy.

IIS

Section titled “IIS”

Default: C:\inetpub\logs\LogFiles\W3SVC<id>\. Set retention, move off the system drive, and enable failed request tracing for 500s. IIS logs are W3C text; parse fields explicitly.

Nginx

Section titled “Nginx”
log_format main '$remote_addr - $host [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" "$http_user_agent" '
                'rt=$request_time uct=$upstream_connect_time urt=$upstream_response_time';
access_log C:/nginx/logs/access.log main;
error_log  C:/nginx/logs/error.log warn;

Use a real client IP only from a trusted proxy; otherwise XFF is spoofable.

Windows audit

Section titled “Windows audit”

Enable at least:

  • logon success/failure;
  • account management;
  • process creation (if you can handle volume);
  • service install/change;
  • PowerShell script block logging (if appropriate).

Forward with Windows Event Forwarding or an agent. Keep a domain controller/PAW path separate from the web tier.

SIEM/alerts

Section titled “SIEM/alerts”

Useful alerts:

  • spike in 401/403/404 from one IP;
  • 500 rate jump after deploy;
  • new service/process on a web server;
  • IIS app pool crash loop;
  • certificate expiry < 14 days;
  • disk full on log/temp volume;
  • outbound connection from web tier to an unusual host.

Verify

Section titled “Verify”
Terminal window
Get-WinEvent -LogName Security -MaxEvents 5
Get-Content C:\inetpub\logs\LogFiles\W3SVC2\*.log -Tail 5

Then confirm the same event appears in the SIEM with the right timezone and fields.

Lab boundary

Section titled “Lab boundary”

E1. The lab had IIS logging and Windows events but no central SIEM/forwarder. The streams and alerts are the production design for Server 2025.

Sources