Both the log file and Event Tracing for Windows (ETW) for the IIS 8.5 web server must be enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76683	IISW-SV-000103	SV-91379r1_rule		Medium

Description
Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process. In IIS 8.5, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time. Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063

Description

Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process. In IIS 8.5, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time. Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063

STIG	Date
IIS 8.5 Server Security Technical Implementation Guide	2018-09-27

Details

Check Text ( C-76339r1_chk )
Open the IIS 8.5 Manager. Click the IIS 8.5 server name. Click the "Logging" icon. Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected. If the "Both log file and ETW event" radio button is not selected, this is a finding.

Fix Text (F-83379r1_fix)
Open the IIS 8.5 Manager. Click the IIS 8.5 server name. Click the "Logging" icon. Under Log Event Destination, select the "Both log file and ETW event" radio button. Under the "Actions" pane, click "Apply".