One of the coolest features in IIS 8.5 (Windows Server 2012 R2) is the option to write W3SVC log entries to ETW (Event Tracing for Windows) instead of the normal W3C log files. I've published a sample on how to capture these events. Check out the readme for more details.

Tomas Restrepo

Software developer located in Colombia. Sr. PFE at Microsoft.