IIS web server logging is fairly version dependent, and so it is good practice to make sure you know what is running in your environment before performing installations or making configuration changes.
As with other Windows Server and Workstation MS-Event streams, you'll need to install NXLog Community Edition on your IIS server if you haven't already.
Our data input wizard for IIS will give you the option to configure NXLog to ship from the default locations with a single check, and to include OS and Application Events if you wish. Stream 'em if ya got 'em.
Our wizard expects the default path to be C:\inetpub\logs\LogFiles\, but you can change this if needed by editing the nxlog.conf file with a text editor.
You will also need to tell your IIS Manager which individual fields to include, to make sure you're capturing exactly the information you want to track.
Once you've done this and restarted the NXLog service, the Loom team will check that the incoming logs are being parsed correctly, add classifications as necessary, and the machine learning will begin.
For additional information, see: https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/