# Logs, audit and SIEM for a Windows web server

> Collect IIS/Nginx access logs, Windows security events and app logs, keep time and retention sane, and alert on what matters.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Collect four streams:

1. **Web access** — IIS W3C / Nginx access log.
2. **Web errors** — IIS failed request tracing / Nginx error log.
3. **Windows** — Security, System, Application events.
4. **App** — stdout/stderr, structured JSON logs.

Ship them off-box; local logs vanish with the host.

## What to keep

- timestamp with timezone, server, site/host, client IP, method, path, status, bytes, latency;
- authenticated user (if safe), user agent;
- request id/correlation id.

Do **not** log passwords, tokens, full cookies, card data or sensitive query strings. Redact at the app/proxy.

## IIS

Default: `C:\inetpub\logs\LogFiles\W3SVC<id>\`. Set retention, move off the system drive, and enable failed request tracing for 500s. IIS logs are W3C text; parse fields explicitly.

## Nginx

```nginx
log_format main '$remote_addr - $host [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" "$http_user_agent" '
                'rt=$request_time uct=$upstream_connect_time urt=$upstream_response_time';
access_log C:/nginx/logs/access.log main;
error_log  C:/nginx/logs/error.log warn;
```

Use a real client IP only from a trusted proxy; otherwise XFF is spoofable.

## Windows audit

Enable at least:

- logon success/failure;
- account management;
- process creation (if you can handle volume);
- service install/change;
- PowerShell script block logging (if appropriate).

Forward with Windows Event Forwarding or an agent. Keep a domain controller/PAW path separate from the web tier.

## SIEM/alerts

Useful alerts:

- spike in 401/403/404 from one IP;
- 500 rate jump after deploy;
- new service/process on a web server;
- IIS app pool crash loop;
- certificate expiry < 14 days;
- disk full on log/temp volume;
- outbound connection from web tier to an unusual host.

> **Caution: Logs are evidence, not backup**
>
> Logs help investigate, but they do not restore a server. Back up config/content/certs separately, and protect logs from tampering (central write-once storage where possible).

## Verify

```powershell
Get-WinEvent -LogName Security -MaxEvents 5
Get-Content C:\inetpub\logs\LogFiles\W3SVC2\*.log -Tail 5
```

Then confirm the same event appears in the SIEM with the right timezone and fields.

## Lab boundary

E1. The lab had IIS logging and Windows events but no central SIEM/forwarder. The streams and alerts are the production design for Server 2025.

## Sources

- [Microsoft Learn — IIS logging](https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis)
- [nginx — Logging](https://nginx.org/en/docs/http/ngx_http_log_module.html)

---

Source: https://windows.homes/en/server/security/logging/