Log File Formats

Four types of log files are used in IIS logging:

• W3C Extended log file format

• Microsoft IIS log format

• NCSA (National Center for Supercomputing Application) Common log file format

• Open database connectivity (ODBC) logging

The W3C Extended log file format, Microsoft IIS log file format, and NCSA log file format are all ASCII text formats. The W3C Extended and NCSA formats use a four-digit year, while the Microsoft IIS format uses a two-digit year format for backward compatibility with previous IIS versions.

Enabling Logging for Your Site

Logging is configured at either the individual site level or the component level of IIS. Web and FTP sites are grouped under the Web Sites level and FTP Sites level, respectively. NNTP and SMTP sites are not grouped at the component level, and each site has its own entry in the list of sites under the local computer in the IIS MMC. If you configure logging at the component level, it will apply to all the sites on this server. If you configure logging at the individual site level, it will apply only to that site.

To enable logging:

1. Open the IIS Microsoft Management Console (MMC) by choosing Start | Administrative Tools | Internet Information Services (IIS) Manager.

2. Right-click the site or component where you wish to configure logging, and choose Properties.

3. The logging options always appear on the default tab (the one that is open by default) of the chosen component’s Properties window, as shown in Figure 11-1.

   
   Figure 11-1: Web site Properties window

4. Place a check mark in the Enable Logging box.

5. Select the type of logging you want in the Active Log Format drop-down menu.

Logging Properties Window

Click the Properties button in the Enable Logging section of the Properties window, and you’ll see the Logging Properties window shown in Figure 11-2. For each type of logging (except ODBC Logging), the General tab appears pretty much the same way. The advanced tab is only visible when using W3C Extended Logging.

Figure 11-2: The Logging Properties window

New Log Schedule In this area, choose when you want IIS to create log files. A new log file is created based on the time period you choose:

• Hourly Created every hour on the hour.

• Daily Created with the first entry after midnight each day.

• Weekly Created with the first entry after midnight on Saturday (in other words, early Sunday morning).

• Monthly Created with the first entry after midnight on the last day of the month (meaning the first day of the month).

• Unlimited Always uses the same log file. Because of this, the log file can be accessed only when the service that is using that log file is stopped.

• When The File Size Reaches Creates a new log file when the specified size is reached. You can choose any size from 1 MB to 4000 MB.

  Tip 

  Choosing a shorter time period creates more log files on the hard disk and allows you more granular control over which period of log entries you want with various logging software. A longer or unlimited time period will mean a larger log file that may take quite a while to open if it gets too large.

Use Local Time for File Naming and Rollover This option appears only on the W3C Extended Logging Properties window. This is because all log file formats, except W3C logging, use the local time zone to determine midnight. W3C Extended logging uses Greenwich Mean Time, or GMT (also referred to as UTC, for Universal Time Format, which is in 24-hour format), for all times, including time to start a new log file. Since midnight local time is different from midnight UTC time in most cases, you may want to check this option. When the server starts a new log based on local time, it is easier for you to tell for which day the log is intended.

Tip 

It’s a good idea to make sure the time zone is set correctly on the server. If your time zone setting is incorrect, your logging times will be incorrect, and it will skew your data for web analysis.

Choose the Log File Directory You can also choose which log file directory to use. You can either type in the path or click the Browse button and navigate to the directory. By default, the directory assigned is %systemroot%\System32\LogFiles. Each site has its own directory under the LogFiles directory. The sites use the following naming conventions:

WWW sites	W3SVC#
FTP sites	MSFTPSVC#
SMTP sites	SmtpSvc#
NNTP sites	NntpSvc#

In each case, the # is a number that references the instance of that site. Each instance of a site created gets a different, randomly generated number. The default web site is always 1, so the default web site’s logging directory would be W3SVC1. If, for example, your second web site’s number is 34523453, the web logging directory for that site would be W3SVC34523453.

Log File Naming Conventions

The log files use a specific naming convention based on the time period being logged. This allows you to see what time period the log reflects.

The naming convention for log files is as follows for each type of logging:

Hourly	XXyymmddhh.log
Daily	XXyymmdd.log
Weekly	XXyymmww.log
Monthly	XXyym.log

In each case, the XX is replaced with a two-character abbreviation of the type of logging. The abbreviations are

W3C logging	ex
Microsoft logging	in
NCSA logging	nc

Note 

ODBC logging is covered later in the chapter in the section “ODBC Logging.”

Log Files and Disk Space

If, when IIS is attempting to add a log entry, it finds that the hard disk is full, IIS logging shuts down. Then an event is logged in the server application log. IIS will monitor the disk space, and when space becomes available again, IIS logging starts back up.

The Unlimited File Size logging and specified file size logging both use the same naming convention, which is very different based on the log file:

W3C logging	extend#.log
Microsoft logging	inetsv#.log
NCSA logging	ncsa#.log