IIS 6.0 Log Header
Those of you, who support IIS6, it might be obvious to notice the following line at the start of IIS6 log file:
#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2009-01-30 02:05:59
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
It appeared to me that (because so far I never read exact configuration!!) when you perform following actions, HTTP.SYS will insert the extra header in log file:
1) Restart the Web Site
2) Restart the IIS Server.
3) When new log files get created.
4) Logging Configuration Changes
While troubleshooting IIS problem, I generally try to relate server event with one of those above but I caught multiple times when I could not. In addition to above list, HTTP.SYS has an idle time out for log file. To Preserve System Resources especially for server hosting large number of sites, HTTP.SYS will close the file handle after 15 minute of inactivity! So if you receive request at every 16th minute, you may notice that above header multiple times.
On a side note, IIS 6 logging is not synchronous hence you may need to wait for sometime before entries get flushed to disk and it is frustrating! I believed that restarting website or IIS server will force logbuffer to flush the entries but more often than not, it is not possible in live environment just to flush logbuffer. I also believed that changing Logging configuration forces IIS to write the log to disk but that is not the case either.
However in IIS7, we have a new option. Try following command by yourself to see the result, if you haven’t: