xTra section help please

RajiB
2013-05-29
2013-05-29
  • RajiB
    RajiB
    2013-05-29

    Hi

    I would like some help with creating a extra section to get stats on upload (POST) traffic.

    The logs are from IIS7 and a sample below.
    In particular I am after the users that are using the POST method.

    2013-05-23 20:06:03 W3SVC1 BRCSVARC10 10.139.0.19 GET /MailArchiver/WebResource.axd d=kNaI09LiY3lW9YSwKkCoiBGggCdaoEkKG5E5kNF6GFHYyYJ0Rg8TDQLeuqT96iJQ7EhSwC4yidVHl0d1VKEFXW93V27JC-JkUCgByE3weMHJMb5iBLiCtv_Qpuxb22mwAqQ2SHarwhg5Gr4mZkrZclHs08YDFg6iKkBRAd4-eQI1&t=634859120780000000 80 ENVBOP\SarahO 10.138.12.32 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+Trident/5.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+.NET+CLR+1.1.4322;+.NET4.0C;+.NET4.0E) MarcLastAccessedPage=Archive.aspx;+OrientationPreview=Vertical;+SortField=sentdate;+SortAscending=False;+ConversationOrMailbox=Conversation;+LastArchiveStore=27bcd7c6-810e-48e5-a180-8ea49e8149d4;+ASP.NET_SessionId=iszdyennum4adghs04u1mi33;+aticket=audit_222b9e5e-b502-49d2-bd5a-16563246dd5d http://mailarchive.envbop.net/MailArchiver/mailview.aspx?connectionId=27bcd7c6-810e-48e5-a180-8ea49e8149d4&ID=-2147387531&selectedUser=077a5364b279db4eb160dbe8d31c8b7d&selectedFolder=&showDelete=true&rwndrnd=0.3179892741746011 mailarchive.envbop.net 200 0 0 2654 4205 0
    2013-05-23 20:06:03 W3SVC1 BRCSVARC10 10.139.0.19 GET /mailarchiver/User/body.aspx id=-2147387531&connectionId=27bcd7c6-810e-48e5-a180-8ea49e8149d4&noimages=true 80 ENVBOP\SarahO 10.138.12.32 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+Trident/5.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+.NET+CLR+1.1.4322;+.NET4.0C;+.NET4.0E) MarcLastAccessedPage=Archive.aspx;+OrientationPreview=Vertical;+SortField=sentdate;+SortAscending=False;+ConversationOrMailbox=Conversation;+LastArchiveStore=27bcd7c6-810e-48e5-a180-8ea49e8149d4;+ASP.NET_SessionId=iszdyennum4adghs04u1mi33;+aticket=audit_222b9e5e-b502-49d2-bd5a-16563246dd5d http://mailarchive.envbop.net/MailArchiver/mailview.aspx?connectionId=27bcd7c6-810e-48e5-a180-8ea49e8149d4&ID=-2147387531&selectedUser=077a5364b279db4eb160dbe8d31c8b7d&selectedFolder=&showDelete=true&rwndrnd=0.3179892741746011 mailarchive.envbop.net 200 0 0 3407 4270 46
    2013-05-23 20:09:22 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 - 10.138.15.49 HTTP/1.1 - - - mailarchive.envbop.net 401 1 3221225581 188 827 202
    2013-05-23 20:09:50 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - - - mailarchive.envbop.net 200 0 0 994 3235 78
    2013-05-23 20:09:50 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - - - mailarchive.envbop.net 200 0 0 5484 3311 46
    2013-05-23 20:09:50 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - aticket=audit_c86dec47-6da7-4e4c-a1cc-f998dd043dd6;+ASP.NET_SessionId=i11xg43agxkwb4prqg0f1vgf - mailarchive.envbop.net 200 0 0 7139 3409 156
    2013-05-23 20:09:50 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - aticket=audit_c86dec47-6da7-4e4c-a1cc-f998dd043dd6;+ASP.NET_SessionId=i11xg43agxkwb4prqg0f1vgf - mailarchive.envbop.net 200 0 0 1107 3670 265
    2013-05-23 20:09:50 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - aticket=audit_c86dec47-6da7-4e4c-a1cc-f998dd043dd6;+ASP.NET_SessionId=i11xg43agxkwb4prqg0f1vgf - mailarchive.envbop.net 200 0 0 1107 3670 249
    2013-05-23 20:09:50 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - aticket=audit_c86dec47-6da7-4e4c-a1cc-f998dd043dd6;+ASP.NET_SessionId=i11xg43agxkwb4prqg0f1vgf - mailarchive.envbop.net 200 0 0 1106 3669 249
    2013-05-23 20:09:51 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - aticket=audit_c86dec47-6da7-4e4c-a1cc-f998dd043dd6;+ASP.NET_SessionId=i11xg43agxkwb4prqg0f1vgf - mailarchive.envbop.net 200 0 0 1107 3670 249
    2013-05-23 20:09:51 W3SVC1 BRCSVARC10 10.139.0.19 POST /mailarchiver/services/outlook.asmx - 80 ENVBOP\PaulG 10.138.15.3 HTTP/1.1 - aticket=audit_c86dec47-6da7-4e4c-a1cc-f998dd043dd6;+ASP.NET_SessionId=i11xg43agxkwb4prqg0f1vgf - mailarchive.envbop.net 200 0 0 1107 3670 390

    Anyone care to help ?

    Thanks