This is for SP2010. Does anybody know what entries in an IIS logfile match up with a cooresponding action in SharePoint? I'm looking to cook up a "badge" or "points" system similar to what is going on here with StackExchange, but without impacting our system performance. I'm ruling out any real-time data collection, and want to concentrate on parsing IIS logfiles.

FOr example:

HEAD /foo/_vti_bin/owssvr.dll dialogview=FileSave&FileDialogFilterValue=

looks like a file save. But there are so many more entries in the logfile. Google was not my friend on this one. I'm sure every action performed leaves some sort of signature in the logfile, but is there a magic cheat sheet to decode it?

  • Oddly enough, i was just asked to do the same thing and would be very interested in whatever options come up
    – Dave Wise
    Sep 18, 2013 at 17:27
  • Well, I can tell you that a POST hit on /author.dll equates to a content update of some sort. I am convinced somebody at MS has this info sitting in a drawer, or a forgotten SP team site somewhere...
    – Alan M
    Sep 18, 2013 at 17:42

1 Answer 1


Wouldn't it make more sense to use the built in auditing features for this? The auditing information can be stored in a separate database (which is actually supported if you access) that will give you the ability to run scripts against it. You could set up some daily processing scripts to parse out the data and update your metrics.

  • That was the route I was thinking but there are some hurdles there as well, such as the 60 day availability of this data and that this can be complex to sift through in large farms (i.e. 30+ content databases) and that user 234 in one site collection is a different user than 234 in another.
    – Dave Wise
    Sep 18, 2013 at 18:07
  • True, there would be some challenges with it, but creating flat views would help mitigate that. I think it would be an easier route to take than IIS log parsing and trying to map unknown URLs and entries to actions. You can configure the auditing settings to exactly what you want to collect. Sep 18, 2013 at 18:18
  • My big concern is system impact. Real-time auditing has the potential to impact performance, and we're already getting "too slow" gripes as is. I cannot say I've tried auditing, though, so I'm not really in a position to dismiss the idea entirely. I'll have to google up auditing for sp2010.
    – Alan M
    Sep 20, 2013 at 0:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.