After the addition of SiteMinder on IIS 6, the username is no longer present in the IIS logs. To return the username to the log, the customer implemented AppendIISServerLog.
When AppendIISServerLog is enabled, the formatting of the data is fixed under the control of the Web Agent. There are two possible formats. If SM_USER is not set, that is the resource is unprotected and the user does not have a SiteMinder session, the following format is used:
If SM_USER is set, then the format used is:
This is added to the cs-uri-query field in the log file. This data is appended to the end of any existing query string data in the URI if present. AppendIISServerLog is the only mechanism available to insert the username into the IIS log.