Share via

NCSA Common Log File Format

  • Article

Applies To: Windows Server 2003, Windows Server 2003 with SP1

The NCSA Common log file format is a fixed ASCII text-based format, so you cannot customize it. The NCSA Common log file format is available for Web sites and for SMTP and NNTP services, but it is not available for FTP sites. Because HTTP.sys handles the NCSA Common log file format, this format records HTTP.sys kernel-mode cache hits.

The NCSA Common log file format records the following data:

  • Remote host address

  • Remote log name (This value is always a hyphen.)

  • User name

  • Date, time, and Greenwich mean time (GMT) offset

  • Request and protocol version

  • Service status code (A value of 200 indicates that the request was fulfilled successfully.)

  • Bytes sent

Not all fields will contain information. For fields for which there is no information, a hyphen (-) appears as a placeholder. If a field contains a nonprintable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format. This typically occurs with virus attacks, when, for example, a malicious user sends carriage returns and line feeds that, if not replaced with the plus sign (+), would break the log file format.

Fields are separated by spaces, and time is recorded as local time with the GMT offset.