I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management.
Is the method the same in case of IIS or just applicable to apache?
Usually, the basic authentication user name is placed into apache logs by default. From http://httpd.apache.org/docs/1.3/logs.html a typical log configuration is
LogFormat "%h %l %u %t \"%r\" %>s %b" common CustomLog logs/access_log common
Where %u is the user name.
I'm not very familiar with iis, but it appears that the basic authentication user name is logged as cs-username. Here is the documentation http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/676400bc-8969-4aa7-851a-9319490a9bbb.mspx