Summary of Common commands for IIS log analysis in off-star systems

The {0} in the Command represents the path of the source log file. Replace it with the actual path when running the command.
The {1} in the Command represents the path of the file exported from the log. Replace it with the actual path when running the command.
For example:
7i24iislog.exe-I: BIN-o: W3C "select siteid, uristem, bytessent from 'd: \ iislog \ w3svc \ sss. ibl 'to 'd: \. log 'order by bytessent desc"

1. query the number of times an IP address accesses a website.
7i24iislog.exe-I: BIN-o: W3C "select clientipaddress, siteid, uristem, count (clientipaddress) from '{0}' to '{1}' group by clientipaddress, uristem, siteid order by count (clientipaddress) desc"

2. Number of times an IP address accesses the entire server website
7i24iislog.exe-I: BIN-o: W3C "select clientipaddress, count (clientipaddress) from '{0}' to '{1}' group by clientipaddress order by count (clientipaddress) desc"

3. Sort the received data (uploaded by Users)
7i24iislog.exe-I: BIN-o: W3C "select siteid, uristem, bytesreceived from '{0}' to '{1}' order by bytesreceived desc"

4. Sort data by user download size
7i24iislog.exe-I: BIN-o: W3C "select siteid, uristem, bytessent from '{0}' to '{1}' order by bytessent desc"

5. Detect PHP packets
7i24iislog.exe-I: BIN-o: W3C "select siteid, uristem, uriquery from '{0}' to '{1}' where uriquery like '% port = %' and uriquery like '% ip = % '"