We are well aware that Portal logs can give us some insight into the users’ login details, and also the operation they have performed by setting the logs levels to INFO. But it would be beneficial if we could have a more detailed logs file that is similar to AGOL activity logs, which records columns of information that can be used to explain the who, what, when, where, and why of each event.
As per testing, one of the possible alternatives to monitor ArcGIS Enterprise traffic is monitoring the web server (IIS in this case) since the web adaptor is installed at IIS and it manages all the incoming traffic. Our team found that IIS W3C logs (Default Location: %SystemDrive%\inetpub\logs\LogFiles) keep a type of log for activities and should be able to get client IP as well as their target destination. A kind of log parser (Log Parser Studio) is used by our team to analyze the details of W3C logs. However, there are some limitations to it as well, for instance, we will not be able to know the actual operation the user is performing through this IIS W3C log.
We are aware that ArcGIS Enterprise usage report offers pretty much similar information to AGOL activity logs except for the IP tracing capability. It would be great if this capability is included in the usage report too!
Thanks.
