How to Read IIS Server Logs
Internet Information Service (IIS) is the main hosting application for Microsoft Windows web hosts. IIS records activity into plain text log files for administrators to monitor the activity on the server. There are several columns listed in the log files, and reading them only uses a simple text reader like Notepad. The files are saved in a configured directory through IIS.
Other People Are Reading
Instructions
-
-
1
Click the Windows "Start" button and select "Settings." Choose "Control Panel" from the menu.
-
2
Double-click "Administrative Tool" from the list of icons in Control Panel. Double-click "Internet Information Service" to open the IIS console.
-
-
3
Right-click the web server name in IIS and select "Properties." Click the "General" tab. In this tab, the location of the IIS files is listed. For example, the log files are normally configured to be located at "C:\Windows\System32\LogFiles."
-
4
Close the IIS console and navigate to the directory shown in the tab. In the folder, there is a list of files with the extension ".log." These files are plain text and opening them uses Notepad.
-
5
Read the file format. The log file has a specific column and order. The following list is the columns saved in each log file. All of these columns may not be visible. Any of these columns depend on the configuration of your IIS server: Client IP address, User name, Date, Time, Service and instance, Server name, Server IP address, Time taken, Client bytes sent, Server bytes sent, Service status code (200 means a successful request), Windows status code (0 indicates success), Request type, and Target of operation.
-
6
Evaluate sample data from a simple IIS configuration. The following is an example of an IIS server log setup to host ASP pages:
#Date: 2009-05-11 00:00:00
#Fields: time c-ip cs-method cs-uri-stem sc-status
00:00:36 192.168.1.96 GET /rss/rss.aspx 404
The first line is the date the file was saved. The second line tells you what data is saved and the column name.
00:00:36 - the time the page was accessed. This time corresponds with 12:36am.
192.168.1.96 - this is the IP address that accessed the file.
GET - the type of call to the server. Regularly accessed pages are usually GET. POST is the other method used when users submit forms.
/rss/rss.aspx - the file that was accessed.
404 - the status code. 404 means the file is missing. 200 is the success code.
-
1
