List of IIS W3C Log Fields

Here is the complete list of fields which are available for logging in IIS logging module under log file format W3C.

• Date (date): date of request.
• Time (time): time of the request in Coordinated Universal Time (UTC).
• Client IP Address (c-ip): the client IP address that made the request.
• User Name (cs-username): the name of the authenticated user who made the request. A hyphen indicates an anonymous user.
• Service Name (s-sitename): the site service name and instance number that handled the request.
• Server Name (s-computername): the name of the server on which request was made.
• Server IP Address (s-ip): the IP address of the server on which request was made.
• Server Port (s-port): the server port number that is configured for the service.
• Method (cs-method): the requested action, for example, a GET method.
• URI Stem (cs-uri-stem): the URI, or target, of the action.
• URI Query (cs-uri-query): the query, if any, that the client was trying to perform. A URI query is necessary only for dynamic pages.
• Protocol Status (sc-status): the HTTP request status code.
• Protocol Substatus (sc-substatus): the HTTP request substatus error code.
• Win32 Status (sc-win32-status): the Windows status code.
• Bytes Sent (sc-bytes): the number of bytes that the server sent to the client.
• Bytes Received (cs-bytes): the number of bytes that the server received from the client.
• Time Taken (time-taken): the time that request took to complete (in milliseconds).
• Protocol Version (cs-version): the HTTP protocol version that the client used.
• Host (cs-host): the hostname, if any.
• User Agent (cs(UserAgent)): the browser type that client used for request.
• Cookie (cs(Cookie)): the content of the cookie sent or received.
• Referrer (cs(Referrer)): the site that the user last visited. This site provided a link to the current site.

Reference: https://docs.microsoft.com/en-us/windows/win32/http/w3c-logging