Configures default settings for handling and storage of log files for all sites.
Syntax
Attributes and Elements
The following sections describe attributes, child elements, and parent elements for this section.
Attributes
Attribute
Description
customLogPluginClsid
Optional string attribute.
Specifies the COM object class ID (CLSID) or IDs, in order of precedence, for custom modules.
directory
Optional string attribute.
Specifies the logging directory, where the log file and logging-related support files are stored.
The default value is %systemdrive%\inetpub\logs\LogFiles.
enabled
Optional Boolean attribute.
Specifies whether logging is enabled (true) or disabled (false) for a site.
Note
ASP and ODBC errors are not logged in the IIS log files.
The default value is true.
localTimeRollover
Optional Boolean attribute.
Specifies whether a new log file is created based on local time or Coordinated Universal Time (UTC), which was previously called Greenwich Mean Time (GMT). When false, a new log file is created based on UTC.
Note
Regardless of the setting, the time stamp for each W3C Extended Logging log record is UTC-based.
The default value is false.
logExtFileFlags
Optional flags attribute.
Specifies the categories of information that are written to either the log file (when you use W3C Extended log file format) or to the ODBC data source during logging events for a site.
The logExtFileFlags attribute can be one or more of the following values. If you specify more than one value, separate them with a comma (,). The default values are Date, Time, ClientIP, UserName, ServerIP, Method, UriStem, UriQuery, HttpStatus, Win32Status, ServerPort, UserAgent, HttpSubStatus.
Value
Description
BytesRecv
Log the number of bytes that the server received.
BytesSent
Log the number of bytes that the server sent.
ClientIP
Log the IP address of the client that made the request.
ComputerName
Log the name of the server on which the log file entry was generated.
Cookie
Log the content of the cookie sent or received, if any.
Date
Log the date on which the activity occurred.
Host
Log the host header name, if any.
HttpStatus
Log the HTTP status code.
HttpSubStatus
Log the sub-status code of the HTTP error. For example, for the 500.18 HTTP error, the status code is 500 and the sub-status code is 18.
Method
Log the requested action, for example, a GET method.
ProtocolVersion
Log the protocol version that the client used.
Referer
Log the site that the user last visited. This site provided a link to the current site.
ServerIP
Log the IP address of the server on which the log file entry was generated.
ServerPort
Log the server port number that is configured for the service.
SiteName
Log the Internet service name and instance number that was running on the client.
Time
Log the time in Coordinated Universal Time (UTC), at which the activity occurred.
TimeTaken
Log the length of time taken for a request to be completed. The time taken is recorded in milliseconds.
Note
The client-request timestamp is initialized when HTTP.sys receives the first byte, but before HTTP.sys begins to parse the request. The client-request timestamp is stopped when the last IIS send completion occurs. Time taken does not reflect time across the network. The first request to the site shows a slightly longer time taken than other similar requests because HTTP.sys opens the log file that contains the first request.
UriQuery
Log the query, if any, that the client was trying to perform. A Universal Resource Identifier (URI) query is necessary only for dynamic pages, and usually consists of parameters passed to the URL by using the URL?Parameters format.
UriStem
Log the Universal Resource Identifier (URI) stem information, which is the target of the action such as Default.htm.
UserAgent
Log the browser type that the client used.
UserName
Log the name of the authenticated user who accessed your server. Anonymous users are indicated by a hyphen.
Win32Status
Log the Windows status code.
logFormat
Optional enum attribute.
Specifies the log file format.
The logFormat attribute can be one of the following values. The default value is W3C.
Value
Description
Custom
Use a custom log file format for a custom logging module.The numeric value is 3.
IIS
Use the Microsoft IIS log file format to log information about a site. This format is handled by HTTP.sys, and is a fixed ASCII text-based format, which means that you cannot customize the fields that are logged. Fields are separated by commas, and time is recorded as local time.The following list is a list of fields that are logged when you use the IIS log file format:
Client IP address
User name
Date
Time
Service and instance
Server name
Server IP address
Time taken
Client bytes sent
Server bytes sent
Service status code (A value of 200 indicates that the request was fulfilled successfully.)
Windows status code (A value of 0 indicates that the request was fulfilled successfully.)
Request type
Target of operation
Parameters (the parameters that are passed to a script)
Not all fields will contain data. When a field does not contain data, a hyphen (-) appears as a placeholder. When a field contains a non-printable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format.The numeric value is 0.
NCSA
Use the National Center for Supercomputing Applications (NCSA) Common log file format to log information about a site. This format is handled by HTTP.sys, and is a fixed ASCII text-based format, which means that you cannot customize the fields that are logged. Fields are separated by spaces, and time is recorded as local time with the Coordinated Universal Time (UTC) offset.The following list is a list of fields that are logged when you use the NCSA Common log file format:
Remote host address
Remote log name (This value is always a hyphen.)
User name
Date, time, and UTC offset
Request and protocol version
Service status code (A value of 200 indicates that the request was fulfilled successfully.)
Bytes sent
Not all fields will contain data. When a field does not contain data, a hyphen (-) appears as a placeholder. When a field contains a non-printable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format.The numeric value is 1.
W3C
Use the W3C Extended log file format to log information about a site. This format is handled by HTTP.sys, and is a customizable ASCII text-based format, which means that you specify the fields that are logged. Specify the fields that are logged in the logExtFileFlags attribute. Fields are separated by spaces, and time is recorded in Coordinated Universal Time (UTC).The numeric value is 2.
period
Optional enum attribute.
Specifies how often IIS creates a new log file.
The period attribute can be one of the following possible values. The default value is Daily.
Value
Description
Daily
Create a new log file daily. The numeric value is 1.
Hourly
Create a new log file hourly. The numeric value is 4.
MaxSize
Create a new log file when a maximum size is reached. The maximum size is specified in the truncateSize attribute. The numeric value is 0.
Monthly
Create a new log file monthly. The numeric value is 3.
Weekly
Create a new log file weekly. The numeric value is 2.
truncateSize
Optional int64 attribute.
Specifies the maximum size of the log file (in bytes) after which to create a new log file. This value is only applicable when MaxSize is chosen for the period attribute.
The minimum file size is 131,072 bytes. If this attribute is set to a value less than 131,072 bytes, the default value is implicitly assumed as 131,072 bytes.
The default value is 20971520.
Child Elements
None.
Parent Elements
Element
Description
configuration
Specifies the root element in every configuration file that is used by IIS 7.
system.applicationHost
Specifies the root element for configuring Web process settings.
sites
Specifies configuration settings for all sites on the server, and includes settings for applications and virtual directories in those sites.
siteDefaults
Specifies default settings for all sites on the server.