• W3C Extended Log File Format
• Microsoft IIS Log Format
• NCSA Common Log File Format
• ODBC Logging

The ODBC logging format is only available on a Server so it is not available on Windows 2000 Professional or Windows XP professional.

The W3C Extended log file format, Microsoft IIS log file format, and NCSA log file format are all ASCII text formats. The W3C Extended and NCSA formats record logging data in four-digit year format. The Microsoft IIS format uses a two-digit year format and is provided for backward compatibility with earlier IIS versions.

The W3C Extended log file format provides the most features of all of the log formats because you can customise the fields which are logged thereby reducing the size of log files or making them a lot larger by providing a lot more features.

W3C Extended Log File Format

W3C Extended format is a customizable ASCII format with a variety of different fields.

• You can include fields important to you, while limiting log size by omitting unwanted fields.
• Fields are separated by spaces.
• Time is recorded as UTC (Greenwich Mean Time).

The example below shows lines from a file using the following fields: Time, Client IP Address, Method, URI Stem, HTTP Status, and HTTP Version.

The preceding entry indicates that:

• On May 2, 2003 at 5:42 P.M. UTC
• A user with a HTTP version 1.0 browser and the IP address of 172.16.255.255 issued an HTTP GET command for the file Default.htm.
• The request was returned without error (200)
   
• The #Date: field indicates when the first log entry was made, which is when the log was created or last modified.
• The #Version: field indicates that the W3C logging format 1.0 was used.

Any of the fields can be selected, but some fields may not have information available for some requests.

For fields that are selected, but for which there is no information, a dash (-) appears in the field as a placeholder. If you have your site configured for Anonymous user authentication the user shows as a dash (-).

Microsoft IIS Log Format

Microsoft IIS format is a fixed (non-customizable) ASCII format. It records more items of information than the NCSA Common format.

The Microsoft IIS format includes basic items such as:

• The user's IP address
• User name
• Request date and time
• HTTP status code
• The number of bytes received.

In addition, it includes detailed items such as:

• The elapsed time of the request
• The number of bytes sent
• The action (for example, a download carried out by a GET command) and the target file.
   
• The items are separated by commas
• The time is recorded as local time.

When you open a Microsoft IIS format file in a text editor, the entries are similar to the following examples:

The preceding sample entries are interpreted as follows:

• Users IP Address
• User Name
• Date
• Time
• Service and Instance
• Computer Name
• IP Address of Server
• Time taken in Ms
• Bytes Received
• Bytes Sent
• Service Status Code
• Windows NT/2000 Status Code
• Request type
• Target of the operation

So as text we have:

• An anonymous user with the IP address of 192.168.114.201
• issued an HTTP GET command for the image file DeptLogo.gif at 7:55 A.M. on March 20, 1998
• From a server named SALES1 at IP address 172.21.13.45.
• The 163-byte HTTP request had an elapsed processing time of 4502 milliseconds (4.5 seconds) to complete, and returned, without error, 3223 bytes of data to the anonymous user.

In the log file:

• All fields are terminated with a comma (,).
• A hyphen acts as a placeholder if there is no valid value for a certain field.

NCSA Common Log File Format

NCSA Common format is a fixed (non-customizable) ASCII format, available for Web sites but not for FTP sites.

It records basic information about user requests, such as:

• Remote host name
• User name
• Date
• Time
• Request type
• HTTP status code
• Number of bytes received by the server.
   
• The item are separated by spaces
• Time is recorded as local time.

When you open an NCSA Common format file in a text editor, the entries are similar to the following example:

Note   In the preceding entry, the second field (which would show the remote log name of the user) is empty and is represented by the hyphen following the IP address 172.21.13.45.

The preceding sample entry is interpreted as follows:

• Remote Host Name
• User Name
• Date
• Time & GMT offset
• Request Type
• Service Status Code
• Bytes Sent

• All fields are terminated with a space.
• A hyphen acts as a placeholder if there is no valid value for a certain field.

The entry indicates that a user named Fred in the REDMOND domain, with the IP address of 172.21.13.45, issued an HTTP GET command (that is, downloaded a file) at 5:39 P.M. on April 8, 1998. The request returned, without error, 3401 bytes of data to the user named Fred.

ODBC Logging

ODBC logging format is a record of a fixed set of data fields in an ODBC-compliant database, such as Microsoft Access or Microsoft SQL Server.

Some of the items logged are:

• The user's IP address
• User name
• Request date and time
• HTTP status code
• Bytes received
• Bytes sent
• Action carried out (for example, a download carried out by a GET command)
• The target (for example, the file that was downloaded).
   
• The time is recorded as local time
• You must specify the database to be logged to.
• You must setup the database table manually to receive the data.

To use ODBC logging, you must complete the following steps:

1. Create a database containing a table with the appropriate fields for the logging data.

   IIS includes a SQL template file which can be run in a SQL database to create a table that accepts log entries from IIS.

    The file is called Logtemp.sql