PowerBI Report Server Web Portal Log parsing

[Anonymous]

Hi all,

We are trying to parse and analyse web portal log (e.g. RSPortal_2021_11_02_10_05_41.log) for following action:

(1) Login and logout (failed login seems not logged?)

(2) Report usage (how to know it's reading and refreshing?)

Tried Excel and MS Log Parser but it's still hard to understand those event code and extract accurate user name from text field. Is there any detailed document for log event code, scope and configuration? 

Thanks!

[Anonymous · Accepted solution]

Neither PBIRS nor IIS logs are capturing logon (successful or failed) info.

Finally I figured out to find the required log at:

Windows event viewer -> Windows logs -> Security -> (Right click) filter with "Event ID": 4625,4776
You can further specify "keywords" to be "Audit Failure" or "Audit Success" or both, "Computer" would be the server name

Pre-requisition: 
Local Computer Policy -> Computer Configuration -> Windows Setting -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group Policy Object -> Logon/Logoff -> need enable "Audit Logoff" and "Audit logon" depend on requirements

[v-henryk-mstf]

Hi @Anonymous ,

Thank you very much for your feedback, it is very helpful for us to solve such problems.😊

Best Regards,
Henry

[v-henryk-mstf]

Hi @Anonymous ,

According to your description, the various logs of the report server are used to record information about the server operations and status. There are two basic categories of logging: execution logging and trace logging. Execution log records include information about report execution statistics, auditing, performance diagnostics, and optimization. Trace log records are information about error messages and general diagnostics.

document link.

If the problem is still not resolved, please point it out and let me know immediately. Looking forward to your reply.

Best Regards,
Henry

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

Thanks the links above is the most useful link I read before. 

Most problem is still can't extract the login information, especially the failed login attempt. Any idea it will or won't be logged? Checked PBIRS http log and IIS log but still not found.