Configuring Logging Options in IIS

Article
06/16/2017

You can collect information about client requests by enabling logging for sites and services. IIS logs are stored in %SystemRoot%\system32\Logfiles\<service_name>, and can include information such as who has visited your site, what the visitor viewed, and when the information was last viewed.

To control the IIS log format through metabase properties:

Enable logging for a site or service by setting the LogType metabase property to 1. Set the DontLog property to on the child directories or files that you want to exempt from logging.
Specify the logging format by setting the LogPluginClsid metabase property to the Clsid of the logging module. For example, to use the NCSA log file format, set the LogPluginClsid metabase property to the Clsid of the LogModuleId metabase property found at the /Logging/NCSA Common Log File Format metabase node.
Specify the type of information that gets logged by setting the LogExtFileFlags metagbase property.

Example Code

The following example shows you how to use either Visual Basic Scripting Edition (VBScript) or JScript to list the available logging formats, identify the current log format, then set the log format to the W3C extended log format.The example also shows you how to specify which information to log. The VBScript code example uses ADSI. ADSI can refer to flags as properties. The JScript code example uses WMI.

IIS 5.1 and earlier: The IIS WMI provider is not available.

' Set up variables: 
Set IIsWebServiceObj = GetObject("IIS://localhost/W3SVC") 
Set IIsWebServerObj = GetObject("IIS://localhost/W3SVC/1") 
Dim sClsidNCSA 
Dim sClsidIIS 
Dim sClsidW3C 
Dim sLogPluginClsid 
Dim sNCSA 
Dim sIIS 
Dim sW3C 
sNCSA = "NCSA Common Log File Format" 
sIIS = "Microsoft IIS Log File Format" 
sW3C = "W3C Extended Log File Format" 

' List the available logging formats: 
WScript.Echo("Available logging formats are " & IIsWebServiceObj.LogModuleList) 

' Identify the Clsids of each logging module: 
Set IIsLogModuleObj = GetObject("IIS://localhost/Logging/" & sNCSA) 
sClsidNCSA = IIsLogModuleObj.LogModuleId 
Set IIsLogModuleObj = GetObject("IIS://localhost/Logging/" & sIIS) 
sClsidIIS = IIsLogModuleObj.LogModuleId 
Set IIsLogModuleObj = GetObject("IIS://localhost/Logging/" & sW3C) 
sClsidW3C = IIsLogModuleObj.LogModuleId 

' Get the logging format that is currently set for the default Web site: 
sLogPluginClsid = IIsWebServerObj.LogPluginClsid 
If (sLogPluginClsid = sClsidNCSA) Then  
  WScript.Echo("Log type is " & sNCSA) 
Elseif (sLogPluginClsid = sClsidIIS) Then  
  WScript.Echo("Log type is " & sIIS) 
Elseif (sLogPluginClsid = sClsidW3C) Then  
  WScript.Echo("Log type is " & sW3C)  
Else WScript.Echo("Log type is not one of the IIS provided types")  
End If 
WScript.Echo("LogExtFileFlags = " & IIsWebServerObj.LogExtFileFlags ) 

' Enable logging: 
If Not (IIsWebServerObj.LogType = 1) Then 
  IIsWebServerObj.Put "LogType", 1 
  IIsWebServerObj.SetInfo 
  WScript.Echo("Had to enable logging") 
End If 

' Set the logging format to W3C Extended: 
IIsWebServerObj.Put "LogPluginClsid", sClsidW3C 

' Log only the client IP address, the HTTP status, the time, and the URL. 
IIsWebServerObj.Put "LogExtFileClientIp", True 
IIsWebServerObj.Put "LogExtFileHttpStatus", True 
IIsWebServerObj.Put "LogExtFileTime", True 
IIsWebServerObj.Put "LogExtFileUriStem", True 
IIsWebServerObj.Put "LogExtFileMethod", False 
IIsWebServerObj.Put "LogExtFileDate", False 
IIsWebServerObj.Put "LogExtFileUserName", False 
IIsWebServerObj.Put "LogExtFileServerIp", False 
IIsWebServerObj.Put "LogExtFileUriQuery", False 
IIsWebServerObj.Put "LogExtFileWin32Status", False 
IIsWebServerObj.Put "LogExtFileServerPort", False 
IIsWebServerObj.Put "LogExtFileUserAgent", False 
' Uncomment the next line for IIS 6.0: 
'IIsWebServerObj.Put "LogExtFileHttpSubStatus", False 

IIsWebServerObj.SetInfo 
WScript.Echo("Logging has been changed to W3C Extended") 

' See what the new value is: 
IIsWebServerObj.GetInfo 
sLogPluginClsid = IIsWebServerObj.LogPluginClsid 
If (sLogPluginClsid = sClsidNCSA) Then  
  WScript.Echo("Log type is " & sNCSA) 
Elseif (sLogPluginClsid = sClsidIIS) Then  
  WScript.Echo("Log type is " & sIIS) 
Elseif (sLogPluginClsid = sClsidW3C) Then  
  WScript.Echo("Log type is " & sW3C)  
Else WScript.Echo("Log type is not one of the IIS provided types")  
End If 
WScript.Echo("LogExtFileFlags = " & IIsWebServerObj.LogExtFileFlags )

// Set up variables: 
var providerObj = GetObject("winmgmts://localhost/root/MicrosoftIISv2"); 
var IIsWebServiceObj = providerObj.get("IIsWebServiceSetting='W3SVC'"); 
var IIsWebServerObj = providerObj.get("IIsWebServerSetting='W3SVC/1'"); 
var sClsidNCSA; 
var sClsidIIS; 
var sClsidW3C; 
var sLogPluginClsid; 
var sNCSA = "NCSA Common Log File Format"; 
var sIIS = "Microsoft IIS Log File Format"; 
var sW3C = "W3C Extended Log File Format"; 

// List the available logging formats: 
WScript.Echo("Available logging formats are " + IIsWebServiceObj.LogModuleList); 

// Identify the Clsids of each logging module: 
var IIsLogModuleObj = providerObj.get("IIsLogModule='Logging/" + sNCSA + "'"); 
sClsidNCSA = IIsLogModuleObj.LogModuleId; 
var IIsLogModuleObj = providerObj.get("IIsLogModule='Logging/" + sIIS + "'"); 
sClsidIIS = IIsLogModuleObj.LogModuleId; 
var IIsLogModuleObj = providerObj.get("IIsLogModule='Logging/" + sW3C + "'"); 
sClsidW3C = IIsLogModuleObj.LogModuleId; 

// Get the logging format that is currently var for the default Web site: 
sLogPluginClsid = IIsWebServerObj.LogPluginClsid; 
if (sLogPluginClsid = sClsidNCSA) {  
  WScript.Echo("Log type is " + sNCSA); 
} else if (sLogPluginClsid = sClsidIIS) {  
  WScript.Echo("Log type is " + sIIS); 
} else if (sLogPluginClsid = sClsidW3C) { 
  WScript.Echo("Log type is " + sW3C);  
} else WScript.Echo("Log type is not one of the IIS provided types");  
WScript.Echo("LogExtFileFlags = " + IIsWebServerObj.LogExtFileFlags ); 

// Enable logging: 
if (!(IIsWebServerObj.LogType = 1)) { 
  IIsWebServerObj.Properties_("LogType").Value = 1; 
  IIsWebServerObj.Put_(); 
  WScript.Echo("Had to enable logging"); 
} 

// var the logging format to W3C Extended: 
IIsWebServerObj.Properties_("LogPluginClsid").Value = sClsidW3C; 

// Log only the client IP address, the HTTP status, the time, and the URL. 
IIsWebServerObj.Properties_("LogExtFileFlags").Value = 1286; 

IIsWebServerObj.Put_(); 
WScript.Echo("Logging has been changed to W3C Extended"); 

// See what the new value is: 
IIsWebServerObj.get; 
sLogPluginClsid = IIsWebServerObj.LogPluginClsid; 
if (sLogPluginClsid = sClsidNCSA) {  
  WScript.Echo("Log type is " + sNCSA); 
} else if (sLogPluginClsid = sClsidIIS) {  
  WScript.Echo("Log type is " + sIIS); 
} else if (sLogPluginClsid = sClsidW3C) { 
  WScript.Echo("Log type is " + sW3C);  
} else WScript.Echo("Log type is not one of the IIS provided types");  
WScript.Echo("LogExtFileFlags = " + IIsWebServerObj.LogExtFileFlags );

Share via

Configuring Logging Options in IIS

To control the IIS log format through metabase properties:

Example Code

See Also

Additional resources