The {0} in the command represents the path of the source log file. Please replace it with the real path when it is actually running.
The {1} in the command represents the path of the file exported to the log. Please replace it with the real path when it is actually running.
For example:
-i:BIN -o:W3C "select siteid,uristem,bytessent from 'd:\iislog\w3svc\' to 'd:\' order by bytessent desc"
1. Query the number of times a certain IP visits a certain web page on a certain website, and arrange it in reverse order
-i:BIN -o:W3C "select clientipaddress,siteid,uristem,count(clientipaddress) from '{0}' to '{1}' group by clientipaddress,uristem,siteid order by count(clientipaddress) desc"
2. The number of times a certain IP visits the entire server website
-i:BIN -o:W3C "select clientipaddress,count(clientipaddress) from '{0}' to '{1}' group by clientipaddress order by count(clientipaddress) desc"
3. Arrange according to the size of received data (uploaded by users)
-i:BIN -o:W3C "select siteid,uristem,bytesreceived from '{0}' to '{1}' order by bytesreceived desc"
4. Arrange according to the size of the sent data (user downloads)
-i:BIN -o:W3C "select siteid,uristem,bytessent from '{0}' to '{1}' order by bytessent desc"
5. Detect PHP packetization
-i:BIN -o:W3C "select siteid,uristem,uriquery from '{0}' to '{1}' where uriquery like '%port=%' and uriquery like '%ip=%'"
The {1} in the command represents the path of the file exported to the log. Please replace it with the real path when it is actually running.
For example:
-i:BIN -o:W3C "select siteid,uristem,bytessent from 'd:\iislog\w3svc\' to 'd:\' order by bytessent desc"
1. Query the number of times a certain IP visits a certain web page on a certain website, and arrange it in reverse order
-i:BIN -o:W3C "select clientipaddress,siteid,uristem,count(clientipaddress) from '{0}' to '{1}' group by clientipaddress,uristem,siteid order by count(clientipaddress) desc"
2. The number of times a certain IP visits the entire server website
-i:BIN -o:W3C "select clientipaddress,count(clientipaddress) from '{0}' to '{1}' group by clientipaddress order by count(clientipaddress) desc"
3. Arrange according to the size of received data (uploaded by users)
-i:BIN -o:W3C "select siteid,uristem,bytesreceived from '{0}' to '{1}' order by bytesreceived desc"
4. Arrange according to the size of the sent data (user downloads)
-i:BIN -o:W3C "select siteid,uristem,bytessent from '{0}' to '{1}' order by bytessent desc"
5. Detect PHP packetization
-i:BIN -o:W3C "select siteid,uristem,uriquery from '{0}' to '{1}' where uriquery like '%port=%' and uriquery like '%ip=%'"