Contents Index Previous Chapter Next Chapter


Logging Server Activity

Each of the services contained in Microsoft Internet Information Server can be configured to log information about who accessed the server and what information they accessed. This data can help you fine-tune your site, plan for the number of users that regularly gain access to your site, assess content, and audit security.

The logging feature in Internet Information Server has been designed for flexibility in the following areas:

This chapter explains how to:

To Top Configuring Logging

When you set up Internet Information Server, you can enable logging to see who has been using the server and how many times your online information was accessed.

To configure logging:

In Internet Service Manager, double-click the service to display its property sheets. The Logging property sheet sets logging for the selected information service.

Log to File

To start logging, select the Enable Logging check box on the Logging property sheet. To stop logging, clear the Enable Logging check box. Choose Log to File to log activity information for the selected information service to a text file.

Log Format

Use the Log Format box to select the logging format you want. Click the arrow and choose either Standard format or NCSA format, National Center for Supercomputing Applications (NCSA) Common Log File format.

Automatically open new log

This option generates new logs using the specified frequency. If not selected, the same log file will grow indefinitely.

Log file folder

This option sets the folder (directory) containing the log file.


This field shows the file name used for logging. If multiple services are configured to log to the same folder, they will use the same file.

To log to a file

For the Daily, Weekly, or Monthly options, the log file is closed the first time a log record is generated after midnight on the last day of the current log file. The new log file name will include the date of the first day in the log file.

For the When file size reaches option, every time the log file is closed and a new one is created, the sequential number in the file name is incremented.

When logging to a file, the maximum total log line is 1200 bytes. Each field is limited to 150 bytes.

Log to SQL/ODBC Database

When you install Microsoft Internet Information Server, logging to a file is the default method of logging. If you prefer to collect logs in a database, you must install ODBC version 2.5 or later. To access the pages, make sure that the WWW service is running, and then in the Internet Explorer Address box, type the local computer name. Alternatively, you can follow the manual procedure described later in this section.

For best results, log to a Microsoft SQL Server version 6.5 database. If you do not want to log to a database or use the Internet Database Connector on a Web server, do not install any ODBC drivers.

Choose Log to SQL/ODBC Database to log activity information to any Open Database Connectivity (ODBC)-compliant data source. Set the ODBC Data Source Name (DSN), Table, and specify the user name and password to use when logging to the database.

When using ODBC for logging, each field is limited to 255 bytes.

Note   Logging to a database increases the amount of time and resources needed to service WWW (HTTP), FTP, and gopher requests. Therefore, if your site has heavy traffic, you should log to the file system to maximize performance.

To manually prepare for logging to a database

Note   For Microsoft® Access, the system DSN is the file name of your database.

To log to a database

To Top How to Read Log Files

Following are three entries from a log from a server running the WWW, gopher, and FTP services; the entries are in two tables only because of page-width limitations.

Client’s IP address Client’s username Date Time Service Computer name IP address of server 12/11/95 7:55:20 W3SVC TREY1 anonymous 12/11/95 23:58:11 MSFTPSVC TREY1 12/11/95 0:00:34 GopherSvc TREY1

Elapsed time Bytes received Bytes sent Service status code Windows NT status code Name of the operation Target of the operation
4502 163 3223 200 0 GET small.gif
60 275 0 0 0 [376] PASS intro
6139 273 62184 0 0 file form1.bmp

Parameters for the operation, if applicable, will be listed in the final fields.

Note   All fields are terminated with a comma (,). A hyphen acts as a placeholder if there is no valid value for a certain field.

As a sample interpretation of logging data, the first entry in the table says that an anonymous client with the IP address of downloaded (issued a GET command for) the file Small.gif at 7:55 AM on December 11, 1995, from a server named TREY1 at IP address The 163-byte HTTP request had an elapsed processing time of 4502 milliseconds (almost half a second) to complete (without error) and returned 3223 bytes of data to the anonymous client.

The following example shows a log file in NCSA format: - REDMOND\doug [07/Jun/1996:17:39:04 -0800] "POST /iisadmin/default.htm?-, HTTP/1.0" 200 3401

Remote host name Client’s username Date Time REDMOND\doug 07/Jun/1996 17:39:10 -0800

Request Service Status code Bytes received
GET /scripts/iisadmin/ism.dll?http/serv, HTTP/1.0 200 5125

To Top Viewing Logs in Databases

You can use any ODBC-supported database to log server activity. By logging to a database, you can direct the logging of all Internet Information Server services to a single source.

You can use any ODBC-compliant application to view the log data in your database.

In addition, you can use the Internet Database Connector to view log data in a Web browser.

To Top Converting Log File Formats

Internet Service Manager provides a choice between two log formats:
In the Log Format box on the Logging property sheet, click the arrow and select the format you want.

if you have created Microsoft Internet Information Server log files in Standard format and want to convert them to either the EMWAC log file format or NCSA Common Log File format, use the Microsoft Internet Log Converter (Convlog.exe). At the command prompt, type convlog without parameters to see syntax and examples.

To convert logs to other formats

Contents Index Previous Chapter To Top Next Chapter

© 1996 by Microsoft Corporation. All rights reserved.