Logging traffic to your websites can offer a slew of information that maybe useful to IT staff, management and marketing. By determinig which pages are most popular, where visitors are coming from, and what browser they are using is helpful information you can use to improve your website.
IIS 6 supports four different logging formats:
- W3C Extended - This format offers the most choices when it comes to what information you would like logged however there is such a thing as too much information.
- Microsoft IIS - This simple CSV file logs the basic information in ASCII format. There is no customization available.
- NCSA Common - Similar to the Microsoft IIS format, it is also a basic ASCII formatted file, however it is more compatible with non-MS server logs.
- ODBC - This format logs to a database, rather than a flat file as the previous formats. It is not readable by most 3rd party log analyzers.
The Microsoft IIS log format specifies a two-digit year format in order for the logs to be backward compatible with older versions of IIS while the other formats use a four-digit year. You can enable logging at the server component or site level for WWW or FTP, and the site level for NNTP and SMTP. To configure logging, open up the IIS Management MMC and right-click the server component or site and select properties. On the General page check the box next to Enable Logging and select the log format from the drop down list.
Next, click the Properties button next to the log format type. Under the General page, you can specify how often a new log should be generated and the location to which to save the logs.
If you are using the W3C Extended Log format, one more option will appear. You will see a checkbox next to Use Local Time for File Naming and Rollover. The W3C Extended Log format does not use the local time, it is based on GMT. By checking this box, the log files will be in sync with the local timezone on the server. This makes it a lot easier to manage the logs. You can also choose where the log files should be saved. Type in the path, or click browse to find the location to save the logs to. The default is %systemroot%\System32\LogFiles and each site will have its own directory under the this LogFiles directory. If IIS cannot write or create log files due to the disk being full, logging will stop until disk space becomes available at which time IIS will begin logging again automatically. The sites use the following naming conventions:
- WWW sites - W3SVC#
- FTP sites - MSFTPSVC#
- SMTP sites - SmtpSvc#
- NNTP sites - NntpSvc#
The # is refers to the instance of that site and is also known as the identifier. The Default Web Site will always be 1 and every other site will have a random number assigned to it.
The filename for the logs also follows a specific naming convention as this list describes where XX defines the log format: Hourly - XXyymmddhh.log Daily - XXyymmdd.log Weekly - XXyymmww.log Monthly - XXyym.log W3C logging - ex Microsoft logging - in NCSA logging - nc If you specified Unlimited for the New Log Schedule, the log files will be named: W3C logging - extend#.log Microsoft logging - inetsv#.log NCSA logging - ncsa#.log Finally, under the Advanced page (for W3C Extended Logging) you can select which pieces of information you would like logged.
W3C Extended is by far your best option as it offers the most customization, and information. W3C Extended log files can be help you find errors in your webpages. IIS 6 cannot return HTTP substatus error codes, so trying to find out what the error is can be difficult. Your browser might show a 404 error but to see the full error message (i.e. 404.1 404.2 etc..) you will have to look it up in the log file.