Select Page

IIS Logs

Internet Information Server (IIS) is a web server from Microsoft that gets shipped with Windows Operating System. All the requests made to Web Serves are recorded in IIS Logs.

Configure IIS Logs

You can configure IIS logs to capture details of all the HTTP requests along with status that is processed by the sites hosted on that IIS. IIS logs can help you troubleshoot your site.

IIS logs can be configured at the Server or Site level. I personally prefer configuring logging at the Server level as this sets a default logging configuration for all the new sites.

IIS Manager can be used to configure logging. Note that HTTP Logging feature should be installed (refer image below) for logging to be available

Enable HTTP Log on Windows

Configure or change setting using IIS Manager as shown below

Configure IIS Logs

Based on your requirements you can configure the following fields:

  • One log file per Site or Server, the default value is site & I personally prefer site.
  • Log File Format – IIS, NCSA, W3C, or Custom. W3C is a customizable option with different fields so you can log important properties and limiting the log size if required.
  • Select Fields to be Logged (Only available for file format W3C). The detailed list of Fields is covered in the next section.
  • Directory where logs will be saved
  • Log Event Destination
  • Logfile rollover settings

List of IIS W3C Log Fields

Here is the complete list of fields that are available for logging in the IIS logging module under log file format W3C.

  • Date (date): date of request.
  • Time (time): time of the request in Coordinated Universal Time (UTC).
  • Client IP Address (c-ip): the client IP address that made the request.
  • User Name (cs-username): the name of the authenticated user who made the request. A hyphen indicates an anonymous user.
  • Service Name (s-sitename): the site service name and instance number that handled the request.
  • Server Name (s-computername): the name of the server on which request was made.
  • Server IP Address (s-ip): the IP address of the server on which request was made.
  • Server Port (s-port): the server port number that is configured for the service.
  • Method (cs-method): the requested action, for example, a GET method.
  • URI Stem (cs-uri-stem): the URI, or target, of the action.
  • URI Query (cs-uri-query): the query, if any, that the client was trying to perform. A URI query is necessary only for dynamic pages.
  • Protocol Status (sc-status): the HTTP request status code.
  • Protocol Substatus (sc-substatus): the HTTP request substatus error code.
  • Win32 Status (sc-win32-status): the Windows status code.
  • Bytes Sent (sc-bytes): the number of bytes that the server sent to the client.
  • Bytes Received (cs-bytes): the number of bytes that the server received from the client.
  • Time Taken (time-taken): the time that the request took to complete (in milliseconds).
  • Protocol Version (cs-version): the HTTP protocol version that the client used.
  • Host (cs-host): the hostname, if any.
  • User Agent (cs(UserAgent)): the browser type that client used for request.
  • Cookie (cs(Cookie)): the content of the cookie sent or received.
  • Referrer (cs(Referrer)): the site that the user last visited. This site provided a link to the current site.

Newsletter Subscription

Stay updated! Instantly get notified about my new articles in your mailbox by subscribing via email

IIS Logs Location

Normally default location for IIS Log files is %SystemDrive%\inetpub\logs\LogFiles. But one can even change this location and log to a different directory.

To verify or change IIS logs file directory follow below steps

1. Start IIS Manager (Version 8.5) by either from Start=>run “intetmgr” or from Control Panel=>Administrative Tools=>Internet Information Services (IIS) Manager

Start IIS Manager
Start IIS Manager

2. In IIS Manager from Connections Tree on the left Panel select the site for which Logs directory needs to be configured. From Feature View in center double click on Icon Logging

IIS Logs Location

On the Logging screen under Log File=>Directory you can find the configured location for IIS Log Files. Alternatively, you can click on action “View Log Files” to navigate directly to the logs folder in Windows Explorer.

IIS Logs Location

Analyze IIS Logs

You can use one of the various available tools to analyze IIS logs. One of the tools is WebLog Expert which provides a complete analysis report from IIS Logs.

You can also manually analyze IIS Logs using the free tool provided by Microsoft i.e. Log Parser. Log Parser is a command-line tool used to query IIS Logs. In fact, as per Microsoft, Log Parser is universal query access to text-based data such as log files, XML, CSV & Windows Event Logs. Log Parser supports a variety of output formats.

Log parser can be downloaded from this link. Installation is pretty easy. Alternatively, Log Parser Studio that is built on top of the log parser can also be used. Log Parser Studio is a graphical user interface based tool that comes with many predefined queries that can be used for analysis.

Reference: https://docs.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis

You can also check my another Article explaining how to analyze ASP.NET application issues – https://procodeguide.com/programming/analyze-aspnet-application-issues/