I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management.
Is the method the same in case of IIS or just applicable to apache?
Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.Sign up to join this community
Usually, the basic authentication user name is placed into apache logs by default. From http://httpd.apache.org/docs/1.3/logs.html a typical log configuration is
LogFormat "%h %l %u %t \"%r\" %>s %b" common CustomLog logs/access_log common
Where %u is the user name.
I'm not very familiar with iis, but it appears that the basic authentication user name is logged as cs-username. Here is the documentation http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/676400bc-8969-4aa7-851a-9319490a9bbb.mspx