With the log4j CVE we’re checking our IIS logs in detail. To automate this we’ve created a powershell script that parses the logs and provides query access. Below a script that searches for 502 responses and prints the fields we need for investigation.
$logFolder = 'C:\inetpub\logs\LogFiles\W3SVC1'
# sort with oldest file first
$files = Get-ChildItem -Path $logFolder -Filter '*.log' | sort name
foreach($file in $files) {
# skip the 3 header lines and remove the #Fields: part to be able to use the first line as headers
$log = get-content "$logFolder\$file" | select-object -skip 3 | foreach-object { $_ -replace '#Fields: ', ''} | convertfrom-csv -Delimiter ' '
# now search for 502 status and print the fields we need in a table
$log | where sc-status -eq '502' | Select-Object -Property date, time, s-ip, cs-method, cs-uri-stem, cs-username, sc-status | format-table
}
No screenshot – because of security 😉
.NET Development by Eric 