Log Definition Page

  • Article

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

Use the Log Definition feature page to create and edit log definitions, which define the logging fields that are logged and which set additional logging policy options such as log file rollover, base log file name, and so on.

UI Element List

The following tables describe the UI elements that are available on the Log Definition feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Base file name

Enter a name to use as part of the file name for the log files that will be generated. Environment variables can be used for the base file name. The Advanced Logging feature includes a default log definition named %COMPUTERNAME%-Server. %COMPUTERNAME% is an environment variable that the Advanced Logging feature replaces with the computer name in the log file name that it creates.

Note
The base file name and a timestamp form the complete log file name, for example, basefilename_timestamp.log. The timestamp value varies, depending on the Log File Rollover option that you select. For example, a log file that has the file name IISMedia-Server_D20090928-000000.log is created by the following process:

  • IISMedia-Server. The Base file name, where the environment variable %COMPUTERNAME% is replaced by the computer name IISMedia.

  • D. The Log File Rollover option that was selected. In this example, the default Schedule option Daily was selected. Other values that can appear in the log file name include:

    • H. The Schedule option Hourly was selected.

    • W. The Schedule option Weekly was selected.

    • M. The Schedule option Monthly was selected.

    • N. The Schedule option Never was selected.

    • T. The Maximum duration option was selected.

    • F. The Maximum file size option was selected.

  • 20090928-000000. The time when the log file was created, in Coordinated Universal Time (UTC), formatted as YearMonthDay-Milliseconds.

Enabled

Select this check box to enable the log definition and to begin creating log files.

Publish real-time events

Select this check box to publish the aggregated request data for a log entry in an event. Other IIS modules or log-analysis applications can process the event data in real time, instead of waiting to analyze the log entry after it is written to the log file. For example, a custom IIS module can receive the events that are published and write the data that they contain to a persistent database for real-time reporting. For more information, see Advanced Logging for IIS 7.0 – Real-Time Logging.

Write to disk

Clear this check box if you are processing real-time event data to persistent storage, such as a database, and you do not need to write the log entry to the log file.

Log File Rollover

Use the Log File Rollover area to select an option that specifies how often a new log file is created.

Element Name Description

Schedule

Create a new log file, based on one of the following values:

  • Hourly. Create a new log file each hour.

  • Daily. Create a new log file each day, at midnight UTC. This is the default value.

  • Weekly. Create a new log file each week, at midnight UTC.

  • Monthly. Create a new log file each month, at midnight UTC.

  • Never. Do not create new log files. This option means that all logging field data is stored in a single log file. It should only be used for Web servers or sites that experience very low traffic.

To create a new log file after you change the Schedule value, select the Start new log file when configuration changes check box.

Maximum Duration

Create a new log file after the amount of time (in seconds) that you specify elapses.

Maximum file size

Create a new log file after the current log file reaches the file size (in kilobytes) that you specify.

Selected Fields

The Selected Fields area displays the logging fields that are logged for the log definition in a list. The list displays the following information about each logging field:

  • ID. The friendly name of the logging field.

  • Header Name. The unique identifier of the logging field. The identifier is included in the #Fields directive in the log file header.

  • Required. Indicates whether data must be supplied for the logging field in a log entry. Log entries with logging fields that do not contain required data are not written to log files.

  • Default Value. A string value that marks missing logging field data in a log entry. This value replaces the hyphen character that is typically used to mark missing logging field data.

The logging fields are written to the log file in the order that they appear in the list.

The Selected Fields area includes the following elements for updating the logging fields in a log definition and for specifying how logging fields are ordered in log file entries.

Element Name Description

Select Fields

Opens the Select Logging Fields dialog box, in which you can select logging fields to add to the log definition.

Remove

Removes the selected logging field from the log definition.

Edit

Opens the Edit Field dialog box, in which you can edit the values for the selected logging field.

Move First

Moves the selected logging field to the top of the Selected Fields list.

Move Up

Moves the selected logging field up in the Selected Fields list.

Move Down

Moves the selected logging field down in the Selected Fields list.

Move Last

Moves the selected logging field to the bottom of the Selected Fields list.

Filter

The Filter area displays the filtering algorithm, if one is used for the log definition, in the Filter details box. A log definition filter allows you to refine the logging information that is written to log files. For example, if your log definition includes the Protocol Status (sc-status) logging field, you can specify that it should only be included in a log entry if it has the sc-status value of 404 (Not found). This simple filter expression would appear as follows in the Filter details box:

('Status' Equals '404')

You can further refine the information that is logged in the above example filter by excluding logging fields that contain a specific Protocol Substatus (sc-substatus) value. For example, if you are denying requests for files that have a specific file name extension, you may want to exclude the status code 404.7 (File extension denied) from being logged. This slightly more complex filter uses an AND logical conjunction that combines two filter expressions:

('Status' Equals '404') AND ('Substatus' Not Equals '7')

Because you can create multiple log definitions for each Web site on your server, you can filter information relevant to a log's purpose. As a simple example, you can create two log definitions for a Web site, and then use filters so that all client errors (4xx status codes) are logged to one log file and all server errors (5xx status codes) are logged to the other log file.

For more information about how to use the filtering feature, see Advanced Logging for IIS 7.0 – Log Filtering.

Element Name Description

Edit Filter

Opens the Edit Log Definition Filter dialog box, in which you can either create or change the filtering algorithm for the log definition.

Filter details

Displays the filtering algorithm details for the log definition. The filtering algorithm is also written as a #Filter directive to the log file header.

Actions Pane Elements

Element Name Description

Apply

Applies the changes that you made.

Cancel

Cancels the changes that you made.

View Log Files

Opens the log file directory for the log definition.

Return to Advanced Logging

Returns to the Advanced Logging feature page.

See Also

Concepts

Select Logging Fields Dialog Box
Edit Field Dialog Box
Edit Log Definition Filter Dialog Box
Advanced Logging Page