IIS Logging Overview

Article
06/16/2017

IIS uses a flexible and efficient logging architecture. When a loggable event, usually an HTTP transaction, occurs, IIS calls the selected logging module, which then writes to one of the logs stored in %SystemRoot%\system32\Logfiles\<service_name>.

For example if IIS is configured to use the W3C extended log file format, your W3SVCn logs might look like the following:

#Software: Microsoft Internet Information Services 5.1
#Version: 1.0
#Date: 2004-09-29 00:13:03
#Fields: time c-ip cs-method cs-uri-stem sc-status 
00:13:03 100.30.184.000 OPTIONS / 200
00:13:03 100.30.184.000 PROPFIND / 207
22:36:56 100.30.184.000 GET /WebSites/default.htm 401
22:36:56 100.30.184.000 GET /WebSites/default.htm 304

Writing to IIS Logs

There are three options for writing to IIS log files.

Logging Modules Installed by IIS

IIS installs logging module plug-ins to help administrators customize the way that IIS server activity is logged. You can configure IIS logging options in IIS Manager.

IIS logging module plug-ins are COM components that implement the ILogPlugin or ILogPluginEx interfaces. The logging module plug-ins that are available with IIS are as follows:

Centralized binary logging format

IIS 5.1 and earlier: The Centralized binary logging plug-in is not available.

W3C extended log file format
NCSA common log file format
IIS log file format
ODBC log file format

ISAPI Filters

Previous to IIS 4.0, you could only add logging capabilities by creating a custom ISAPI filter that registered interest in particular server events and then wrote to a file or the Windows Event Viewer. Now, it is much easier to use one of the logging modules that come with IIS.

Custom Logging Modules

If you need to generate log files in a format that differs considerably from the manner in which IIS generates log files, you will need to create your own custom logging module.

Custom logging modules are added to IIS by registering a new COM component that implements ILogPlugin or ILogPluginEx. The newly registered component can then be established as the logging module for the server by using the administrative user interface, or programmatically by changing properties in the metabase. Your custom logging module will then be called by IIS to log requests, just as if it were one of the built-in logging modules.

If you create your own logging module, you also have the option of creating a user interface module, adding reading or configuring capabilities to your logging module.

Reading Log Files

IIS administrators often monitor IIS log files manually or programmatically, watching for server errors or suspicious client activity. The log files that are created by the IIS logging modules are easy to read manually, however the following methods can be used to monitor IIS log files programmatically.

The LogParser Tool

Log Parser 2.0 is a powerful, versatile tool that makes it possible to run SQL-like queries against log files of almost any format and produce the desired information either on the screen, in a file of any desired format or into a SQL database. Log Parser is available as a command-line tool and as a set of scriptable COM objects. LogParser can be downloaded from the Microsoft Download Center.

Displaying Data in ASP Pages

The ODBC logging module for IIS allows you to log to a database. With ASP, you can use ActiveX Data Objects (ADO) to display and manipulate data from the logging database. For more information, see Accessing Databases in IIS Applications.

Displaying Log Data in ASP.NET Pages

The ODBC logging module for IIS allows you to log to a database. With ASP.NET, you can use ADO.NET to display and manipulate data from supported data sources such as a database.

Use data source controls such as SqlDataSource, AccessDataSource, ObjectDataSource, or a custom control to connect to your data source. Then, to display your data in a formatted, customizable manner, bind the data to a server control such as the GridView, DataGrid, or Table control.

For more information, see Data Access in ASP.NET 2.0, Accessing Data with ADO.NET, or Displaying Database Information Using a Table Web Server Control.

The Logging Utility Component

The IIS logging component, %SystemRoot%\system32\inetsrv\Logscrpt.dll, implements the ILogScripting COM Interface interface, which enables your applications to read from the IIS log. This component allows you to quickly create, for example, ASP scripts or VB components that programmatically walk through daily log files so that certain types of information can be extracted.

The IIS logging component is deprecated. IIS 6.0 will be the last version that supports this component.

Share via