Understanding Logging

When IIS logging is enabled, new log entries are generated whenever users access the server. This causes a steady increase in log file size and, eventually, in the number of log files. On a busy server, log files can quickly grow to several gigabytes and, therefore, you might need to balance the need to gather information against the need to limit log files to a manageable size.

Tip

Keep in mind that log files are stored as ASCII or Unicode Transformation Format 8 (UTF-8) text files, and, if you need to, you can split or combine log files as you would with any text file. If your server runs out of disk space when IIS is attempting to add a log entry to a file, IIS logging shuts down and logs a logging error event in the Application log. When disk space is available again, IIS resumes logging file access and writes a start-logging event in the Application log.

When you configure logging, you specify how log files are created and saved. Logs can be created according to a time schedule, such as hourly, daily, weekly, and monthly. Logs can also be set to a fixed file size, such as 100 MB, or they can be allowed to grow to an unlimited file size. A log file’s name indicates its log file format as well as the log’s time frame or sequence. The various naming formats are summarized in Table 14-8.

Table 14-8: Conventions for Log File Names by Log File Format

Format	Log Period	File Name
IIS log file format	By file size	INETSVNN.LOG
	Unlimited	INETSVNN.LOG
	Hourly	INYYMMDDHH.LOG
	Daily	INYYMMDD.LOG
	Weekly	INYYMMWW.LOG
	Monthly	INYYMM.LOG
NCSA common log file format	By file size	NCSANN.LOG
	Unlimited	NCSANN.LOG
	Hourly	NCYYMMDDHH.LOG
	Daily	NCYYMMDD.LOG
	Weekly	NCYYMMWW.LOG
	Monthly	NCYYMM.LOG
W3C extended log file format	By file size	EXTENDNN.LOG
	Unlimited	EXTENDNN.LOG
	Hourly	EXYYMMDDHH.LOG
	Daily	EXYYMMDD.LOG
	Weekly	EXYYMMWW.LOG
	Monthly	EXYYMM.LOG
Centralized binary logging	Hourly	RAYYMMDDHH.IBL
	Daily	RAYYMMDD.IBL
	Weekly	RAYYMMWW.IBL
	Monthly	RAYYMM.IBL

By default, log files are written to the \%WinDir%\System32\LogFiles directory. You can configure logging to a different directory, such as D:\LogFiles. Regardless of whether you use the default directory location or assign a new directory location for logs, you’ll find separate subdirectories for each service that’s enabled for logging under the primary directory.

Subdirectories for sites are named using the following syntax:

• MSFTPSVCN

• W3SVCN

• SMTPSVCN

where N is the index number of the service or a random tracking value. The only exception is when you use centralized binary logging. Here, Web site logs are stored in the %WinDir%\System32\LogFiles\W3SVC directory.

The default server created is number 1. Following this, you could have site directories named W3SVC1, MSFTPSVC1, and SMTPSVC1. If you create additional sites, a random 5- to 10-digit identifier is used. To correlate the identifier value to specific Web sites, select the Web Sites node in Internet Information Services (IIS) Manager and then look in the Description and Identifier columns in the right-hand pane to determine which identifier belongs to which site.

Note

As with many IIS 6 improvements, the reason identifiers are used is to enhance security by making it more difficult to determine where IIS data is being logged.

HTTP requests that return a status code indicating an internal server error are written to a central error log, which is stored in the %WinDir%\System32\LogFiles\Httperr directory. This error log file is named HttperrN.log, where N is the tracking number of the Web site experiencing the internal server errors.