Updated: February 29, 2012
Applies To: Windows Server 2012 R2, Windows Server 2012
Use the Logging feature page to configure how IIS logs requests made to the web server and when new log files are created.
In this document
The following tables describe the UI elements that are available on the feature page and in the Actions pane.
One log file per
Specifies whether the web server maintains one log file for the whole server or one log file for each site on the server.
When you select Site, the settings that you specify on the Logging page at the server level are default values for all sites on your server. You can then open the Logging page at the site level to configure specific settings for a site.
Specifies the format of the log file that is created when a request is logged.
When you configure the web server to have one log file, you can select one of the following log file formats:
When you configure the web server to have one log file per site, you can select one of the following log file formats:
Opens the W3C Logging Fields dialog box in which you can select which fields to log. This button is available only when the W3C log file format is selected.
Specifies the physical path where the log file or files are stored. The default value is %SystemDrive%\inetpub\logs\LogFiles.
Specifies how the log file or log files are encoded: UTF-8 or ANSI.
Select UTF-8 when you want to enable both single-byte and multibyte characters in one string. This encoding enables you to read text-based logs, for example, W3C Extended, IIS, and National Center for Supercomputing Applications (NCSA) Common formats, in a language other than English. Additionally, if your web server serves URLs in a language or dialect other than the one supported by the server's default code page, you should enable UTF-8 encoding for log content.
By default, IIS tries to serve URLs in code pages other than the server's default code page. For security reasons, you might want to enable the UTF-8 format to reduce the effect of an attack that could cause UTF-8 URLs not to translate correctly to the default code page.
Log Event Destination
In Windows Server 2012 R2 and later, you can specify where you want the log events written:
Configures IIS to create new log files based one of the following values:
Maximum file size (in bytes)
Configures IIS to create a new log file when the file reaches a certain size (in bytes).
The minimum file size is 1048576 bytes. If this attribute is set to a value less than 1048576 bytes, the default value is implicitly assumed as 1048576 bytes.
Do not create new log files
Configures IIS to not create new log files. This means that there is a single log file that will continue to grow as information is logged.
Use local time for file naming and rollover
Specifies that log file naming and time for log file rollover uses the local server time. When this is not selected, Coordinated Universal Time (UTC) is used.
Saves the changes that you have made on the feature page.
Cancels the changes that you have made on the feature page.
Disables the feature.
View Log Files
Opens the log file directory.
Use the W3C Logging Fields dialog box to select the information that you want to include in log files. This dialog box is available only when you select W3C from the Format drop-down list on the Logging feature page.
Logs the date on which the request occurred. Selected by default.
Logs the time, in Coordinated Universal Time (UTC), at which the request occurred. Selected by default.
Client IP Address (c-ip)
Logs the IP address of the client that made the request. Selected by default.
User Name (cs-username)
Logs the name of the authenticated user who accessed the server. Anonymous users are indicated by a hyphen. Selected by default.
Service Name (s-sitename)
Logs the Internet service name and instance number that was running on the client at the time that the incident was logged.
Server Name (s-computername)
Logs the name of the server on which the log file entry was generated.
Server IP Address (s-ip)
Logs the IP address of the server on which the log file entry was generated. Selected by default.
Server Port (s-port)
Logs the server port number that is configured for the service. Selected by default.
Logs the HTTP method, such as GET, that is used in the request. Selected by default.
URI Stem (cs-uri-stem)
Logs the Uniform Resource Identifier (URI) that is the target of the action, such as Default.htm. Selected by default.
URI Query (cs-uri-query)
Logs the query, if any, that the client was trying to perform. A URI query is necessary only for dynamic pages. Selected by default.
Protocol Status (sc-status)
Logs the HTTP status code. Selected by default.
Protocol Substatus (sc-substatus)
Logs the HTTP substatus code. Selected by default.
Win32 Status (sc-win32-status)
Logs the Windows status code. Selected by default.
Bytes Sent (sc-bytes)
Logs the number of bytes that the server sent.
Bytes Received (cs-bytes)
Logs the number of bytes that the server received.
Time Taken (time-taken)
Logs the length of time that the action took in milliseconds. Selected by default.
Protocol Version (cs-version)
Logs the protocol version, HTTP or FTP, that the client used.
Logs the host header name, if any.
User Agent (cs(User-Agent))
Logs the browser from which the request came. Selected by default.
Logs the content of the cookie sent or received, if any.
Logs the site that the user last visited. This site provided a link to the current site.
In Windows Server 2012 R2 and later, you can perform enhanced logging by adding custom fields to the event log in addition to the standard fields listed above. This dialog box is available only when you select W3C from the Format drop-down list on the Logging feature page. Using the Log Event Destination option, you can specify that you want the log events to be sent to a log file, to Event Tracing for Windows (ETW), or both.
To add a custom field, in the W3C Logging Fields dialog box, click Add Field..., specify a Field Name, then select the Source Type - you can select Request Header, Response Header, or Server Variable. Depending on the Source Type you select, the Source field is updated to list the standard fields available. You can select one of the fields given, or type a custom source string. For more information on request and response headers, see HTTP protocol reference information. For more information on server variables, see IIS Server Variables.
Enhanced logging cannot log a server variable with a name that contains lower-case characters. To include a server variable in the event log, ensure that its name consists of all upper-case characters.
Note that if you add custom fields to the event log, the total size of the logged fields is limited to 64K bytes. If the total size of the custom fields that you define is greater, then the logged content is truncated to 64K bytes.
When enhanced logging is enabled, Kernel caching for request handling is disabled by IIS.