Using Custom Logging Modules

Custom logging modules allow you to make your own file format with completely customized fields. This is done by creating a COM object that implements the ILogPlugin or ILogPluginEx COM interface. IIS then uses your object to log entries. When you use custom logging, IIS disables the kernel-mode cache, so your system will take a performance hit if you use custom logging. More information about writing your own COM object is included in the IIS SDK documentation.

IIS, by default, writes log files to the %systemroot%\System32\LogFiles directory. Normally, HTTP.SYS handles the writing of log file information to that directory. When you have defined a custom logging module, it uses the account of the worker process in which it's running. Because worker processes run as a Network Service by default, you may experience problems writing to any files under %systemroot%. The best way around that is to configure your custom log module write to another directory, and grant the IIS_WPG group permissions to write to that directory.

Setting Up a Custom Logging Module with IIS

When you want to use a custom logging module, you must first register it on the system. After you've registered your custom logging module, you use its Globally Unique Identifier (GUID) to identify the module in the metabase. After it has been identified, you can use that module in IIS by selecting it from the Active Log Format drop-down menu in the Enable Logging section in the MMC.

1. Open the MetaBase.xml file with Notepad (assuming you have edit-while-running enabled; see Chapter 9 for more on this option).

2. Go to the IISLogModules section of the metabase file, as shown in Figure 11-9.

   
   Figure 11-9: IISLogModule section of the metabase file

3. Insert an entry of IIsLogModule for the custom logging module, using the module friendly name in the location. The module-friendly name is the name you wish the module to be listed as in the Active Log Format drop-down menu.

4. Insert the LogModuleId, using the cls_id of the COM object.

5. Insert the LogModuleUiId, using the cls_id of the UI for the COM object.

   Caution 

   Again, editing the metabase is dangerous, and you can disable IIS so it won't start if you inject any errors or formatting mistakes into the metabase file. Please be careful.

The default COM object is {FF160663-DE82-11CF-BC0A-00AA006111E0}, which is the MS Custom Log Control, or iislog.dll.

After you've set up your custom log control, you can add it to the Active Log Format drop-down box in the IIS MMC. The list of available log modules is a 'per-service property,' which means, for example, that the WWW service's list would include options that aren't necessarily included on the FTP service's list. If you want to use logging for a service, you need to add logging for each service. To do this, you need to edit the metabase again.

1. Open the MetaBase.xml file with Notepad (assuming you have edit-while-running enabled).

2. Browse to the Info section of the registry. Each service will have its own section: IIsWebInfo, IIsSmtpInfo, IIsNntpInfo, and IIsFtpinfo.

3. Add your module to the list under the LogModuleList key in the metabase. The other entries are in comma-separated format.

Now you'll be able to select your custom log format in the Active Log Format drop-down box, as shown in Figure 11-10.

Figure 11-10: The Active Log Format drop-down box, with our new log module listed