Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Enhance your career with this limited time 50% discount on Fabric and Power BI exams. Ends August 31st. Request your voucher.

Reply
Anonymous
Not applicable

PowerBI Report Server Web Portal Log parsing

Hi all,

 

We are trying to parse and analyse web portal log (e.g. RSPortal_2021_11_02_10_05_41.log) for following action:

(1) Login and logout (failed login seems not logged?)

(2) Report usage (how to know it's reading and refreshing?)

 

Tried Excel and MS Log Parser but it's still hard to understand those event code and extract accurate user name from text field. Is there any detailed document for log event code, scope and configuration? 

 

Thanks!

1 ACCEPTED SOLUTION
Anonymous
Not applicable

Neither PBIRS nor IIS logs are capturing logon (successful or failed) info.

 

Finally I figured out to find the required log at:

Windows event viewer -> Windows logs -> Security -> (Right click) filter with "Event ID": 4625,4776
You can further specify "keywords" to be "Audit Failure" or "Audit Success" or both, "Computer" would be the server name

 

Pre-requisition: 
Local Computer Policy -> Computer Configuration -> Windows Setting -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group Policy Object -> Logon/Logoff -> need enable "Audit Logoff" and "Audit logon" depend on requirements

View solution in original post

5 REPLIES 5
Maverik91
Helper I
Helper I

Hi everyone, has anyone found a useful link to understand the previously mentioned log? I'm dealing with the same issue and would really appreciate some help. My challenge is figuring out how to retrieve deleted and overwritten items on the report server. Thanks, Marco.

Anonymous
Not applicable

Neither PBIRS nor IIS logs are capturing logon (successful or failed) info.

 

Finally I figured out to find the required log at:

Windows event viewer -> Windows logs -> Security -> (Right click) filter with "Event ID": 4625,4776
You can further specify "keywords" to be "Audit Failure" or "Audit Success" or both, "Computer" would be the server name

 

Pre-requisition: 
Local Computer Policy -> Computer Configuration -> Windows Setting -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group Policy Object -> Logon/Logoff -> need enable "Audit Logoff" and "Audit logon" depend on requirements

Hi @Anonymous ,

 

Thank you very much for your feedback, it is very helpful for us to solve such problems.😊


Best Regards,
Henry

 

v-henryk-mstf
Community Support
Community Support

Hi @Anonymous ,


According to your description, the various logs of the report server are used to record information about the server operations and status. There are two basic categories of logging: execution logging and trace logging. Execution log records include information about report execution statistics, auditing, performance diagnostics, and optimization. Trace log records are information about error messages and general diagnostics.

 

document link.


If the problem is still not resolved, please point it out and let me know immediately. Looking forward to your reply.


Best Regards,
Henry


If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Anonymous
Not applicable

Thanks the links above is the most useful link I read before. 

 

Most problem is still can't extract the login information, especially the failed login attempt. Any idea it will or won't be logged? Checked PBIRS http log and IIS log but still not found.

Helpful resources

Announcements
July 2025 community update carousel

Fabric Community Update - July 2025

Find out what's new and trending in the Fabric community.

July PBI25 Carousel

Power BI Monthly Update - July 2025

Check out the July 2025 Power BI update to learn about new features.