星外系统IIS日志分析常用的几个命令小结如下：
1、查询某IP访问某网站的某网页的次数，倒序排列：
命令：7i24iislog.exe i:BIN o:W3C "select clientipaddress,siteid,uristem,count(clientipaddress) from '{0}' to '{1}' group by clientipaddress,uristem,siteid order by count(clientipaddress) desc"
示例：7i24iislog.exe i:BIN o:W3C "select clientipaddress,siteid,uristem,count(clientipaddress) from 'd:\iislog\w3svc\sss.ibl' to 'd:\a.log' group by clientipaddress,uristem,siteid order by count(clientipaddress) desc"
2、某IP访问整个服务器网站的次数：
命令：7i24iislog.exe i:BIN o:W3C "select clientipaddress,count(clientipaddress) from '{0}' to '{1}' group by clientipaddress order by count(clientipaddress) desc"
示例：7i24iislog.exe i:BIN o:W3C "select clientipaddress,count(clientipaddress) from 'd:\iislog\w3svc\sss.ibl' to 'd:\a.log' group by clientipaddress order by count(clientipaddress) desc"
3、按照接收数据（用户上传）大小排列：
命令：7i24iislog.exe i:BIN o:W3C "select siteid,uristem,bytesreceived from '{0}' to '{1}' order by bytesreceived desc"
示例：7i24iislog.exe i:BIN o:W3C "select siteid,uristem,bytesreceived from 'd:\iislog\w3svc\sss.ibl' to 'd:\a.log' order by bytesreceived desc"
4、按照发送数据（用户下载）大小排列：
命令：7i24iislog.exe i:BIN o:W3C "select siteid,uristem,bytessent from '{0}' to '{1}' order by bytessent desc"
示例：7i24iislog.exe i:BIN o:W3C "select siteid,uristem,bytessent from 'd:\iislog\w3svc\sss.ibl' to 'd:\a.log' order by bytessent desc"
5、检测PHP发包：
命令：7i24iislog.exe i:BIN o:W3C "select siteid,uristem,uriquery from '{0}' to '{1}' where uriquery like '%port=%' and uriquery like '%ip=%'"
示例：7i24iislog.exe i:BIN o:W3C "select siteid,uristem,uriquery from 'd:\iislog\w3svc\sss.ibl' to 'd:\a.log' where uriquery like '%port=%' and uriquery like '%ip=%'"
这些命令中的{0}代表源日志文件的路径，实际运行时请替换为真实的日志文件路径；{1}代表日志导出到的文件的路径，同样需要替换为真实路径。