Igorv

Microsoft IIS - need to remove the web_cookie cs_cookie field from parser

Discussion created by Igorv on May 25, 2010
Latest reply on Jun 3, 2010 by Igorv

Per Microsoft's guidance on IIS logging, busy websites may need to disable the logging of cookies in their W3C logs due to significant storage and processing implications.

 

When we disable the cookie field under IIS logging options, enVision runs into problems parsing the logs.

 

We've tried to manually edit the micrsofotiismsg.xml to remove the web_cookie field. Couple of observations about that:

 

1. When we loaded the microsoftiismsg.xml in the ESI tool, the web_cookie and web_referral fields did not appear to be assigned to any fields in the Web Accounting table (unlike the rest of the variables).

 

2. CONTENT field of each message in the parser includes the statement:

 

<@fld3:*PARMVAL(web_cookie)>

 

We've tried removing it as well as the web_cookie field in each message, but it hasn't helped much.

 

As of now, the log files WITHOUT the cookie field are not parsing correctly using the ORIGINAL parser.

 

Questions:

 

1. PARMVAL is supposed to assign a value of one variable (already parsed in) to another variable. What is fld3 then and where is it stored in the Web Accounting table?

 

2. Is there an easy, documented, supported method of removing undesired fields from a parser without breaking the rest of the parsing logic?

 

At this point we're looking at having to recreate the IIS parser through the ESI tool just to get this functionality.

Outcomes