Configuring Logging Options in IIS
You can collect information about client requests by enabling logging for sites and services. IIS logs are stored in %SystemRoot%\system32\Logfiles\<service_name>, and can include information such as who has visited your site, what the visitor viewed, and when the information was last viewed.
To control the IIS log format through metabase properties:
Enable logging for a site or service by setting the LogType metabase property to 1. Set the DontLog property to on the child directories or files that you want to exempt from logging.
Specify the logging format by setting the LogPluginClsid metabase property to the Clsid of the logging module. For example, to use the NCSA log file format, set the LogPluginClsid metabase property to the Clsid of the LogModuleId metabase property found at the /Logging/NCSA Common Log File Format metabase node.
Specify the type of information that gets logged by setting the LogExtFileFlags metagbase property.
Example Code
The following example shows you how to use either Visual Basic Scripting Edition (VBScript) or JScript to list the available logging formats, identify the current log format, then set the log format to the W3C extended log format.The example also shows you how to specify which information to log. The VBScript code example uses ADSI. ADSI can refer to flags as properties. The JScript code example uses WMI.
IIS 5.1 and earlier: The IIS WMI provider is not available.
' Set up variables:
Set IIsWebServiceObj = GetObject("IIS://localhost/W3SVC")
Set IIsWebServerObj = GetObject("IIS://localhost/W3SVC/1")
Dim sClsidNCSA
Dim sClsidIIS
Dim sClsidW3C
Dim sLogPluginClsid
Dim sNCSA
Dim sIIS
Dim sW3C
sNCSA = "NCSA Common Log File Format"
sIIS = "Microsoft IIS Log File Format"
sW3C = "W3C Extended Log File Format"
' List the available logging formats:
WScript.Echo("Available logging formats are " & IIsWebServiceObj.LogModuleList)
' Identify the Clsids of each logging module:
Set IIsLogModuleObj = GetObject("IIS://localhost/Logging/" & sNCSA)
sClsidNCSA = IIsLogModuleObj.LogModuleId
Set IIsLogModuleObj = GetObject("IIS://localhost/Logging/" & sIIS)
sClsidIIS = IIsLogModuleObj.LogModuleId
Set IIsLogModuleObj = GetObject("IIS://localhost/Logging/" & sW3C)
sClsidW3C = IIsLogModuleObj.LogModuleId
' Get the logging format that is currently set for the default Web site:
sLogPluginClsid = IIsWebServerObj.LogPluginClsid
If (sLogPluginClsid = sClsidNCSA) Then
WScript.Echo("Log type is " & sNCSA)
Elseif (sLogPluginClsid = sClsidIIS) Then
WScript.Echo("Log type is " & sIIS)
Elseif (sLogPluginClsid = sClsidW3C) Then
WScript.Echo("Log type is " & sW3C)
Else WScript.Echo("Log type is not one of the IIS provided types")
End If
WScript.Echo("LogExtFileFlags = " & IIsWebServerObj.LogExtFileFlags )
' Enable logging:
If Not (IIsWebServerObj.LogType = 1) Then
IIsWebServerObj.Put "LogType", 1
IIsWebServerObj.SetInfo
WScript.Echo("Had to enable logging")
End If
' Set the logging format to W3C Extended:
IIsWebServerObj.Put "LogPluginClsid", sClsidW3C
' Log only the client IP address, the HTTP status, the time, and the URL.
IIsWebServerObj.Put "LogExtFileClientIp", True
IIsWebServerObj.Put "LogExtFileHttpStatus", True
IIsWebServerObj.Put "LogExtFileTime", True
IIsWebServerObj.Put "LogExtFileUriStem", True
IIsWebServerObj.Put "LogExtFileMethod", False
IIsWebServerObj.Put "LogExtFileDate", False
IIsWebServerObj.Put "LogExtFileUserName", False
IIsWebServerObj.Put "LogExtFileServerIp", False
IIsWebServerObj.Put "LogExtFileUriQuery", False
IIsWebServerObj.Put "LogExtFileWin32Status", False
IIsWebServerObj.Put "LogExtFileServerPort", False
IIsWebServerObj.Put "LogExtFileUserAgent", False
' Uncomment the next line for IIS 6.0:
'IIsWebServerObj.Put "LogExtFileHttpSubStatus", False
IIsWebServerObj.SetInfo
WScript.Echo("Logging has been changed to W3C Extended")
' See what the new value is:
IIsWebServerObj.GetInfo
sLogPluginClsid = IIsWebServerObj.LogPluginClsid
If (sLogPluginClsid = sClsidNCSA) Then
WScript.Echo("Log type is " & sNCSA)
Elseif (sLogPluginClsid = sClsidIIS) Then
WScript.Echo("Log type is " & sIIS)
Elseif (sLogPluginClsid = sClsidW3C) Then
WScript.Echo("Log type is " & sW3C)
Else WScript.Echo("Log type is not one of the IIS provided types")
End If
WScript.Echo("LogExtFileFlags = " & IIsWebServerObj.LogExtFileFlags )
// Set up variables:
var providerObj = GetObject("winmgmts://localhost/root/MicrosoftIISv2");
var IIsWebServiceObj = providerObj.get("IIsWebServiceSetting='W3SVC'");
var IIsWebServerObj = providerObj.get("IIsWebServerSetting='W3SVC/1'");
var sClsidNCSA;
var sClsidIIS;
var sClsidW3C;
var sLogPluginClsid;
var sNCSA = "NCSA Common Log File Format";
var sIIS = "Microsoft IIS Log File Format";
var sW3C = "W3C Extended Log File Format";
// List the available logging formats:
WScript.Echo("Available logging formats are " + IIsWebServiceObj.LogModuleList);
// Identify the Clsids of each logging module:
var IIsLogModuleObj = providerObj.get("IIsLogModule='Logging/" + sNCSA + "'");
sClsidNCSA = IIsLogModuleObj.LogModuleId;
var IIsLogModuleObj = providerObj.get("IIsLogModule='Logging/" + sIIS + "'");
sClsidIIS = IIsLogModuleObj.LogModuleId;
var IIsLogModuleObj = providerObj.get("IIsLogModule='Logging/" + sW3C + "'");
sClsidW3C = IIsLogModuleObj.LogModuleId;
// Get the logging format that is currently var for the default Web site:
sLogPluginClsid = IIsWebServerObj.LogPluginClsid;
if (sLogPluginClsid = sClsidNCSA) {
WScript.Echo("Log type is " + sNCSA);
} else if (sLogPluginClsid = sClsidIIS) {
WScript.Echo("Log type is " + sIIS);
} else if (sLogPluginClsid = sClsidW3C) {
WScript.Echo("Log type is " + sW3C);
} else WScript.Echo("Log type is not one of the IIS provided types");
WScript.Echo("LogExtFileFlags = " + IIsWebServerObj.LogExtFileFlags );
// Enable logging:
if (!(IIsWebServerObj.LogType = 1)) {
IIsWebServerObj.Properties_("LogType").Value = 1;
IIsWebServerObj.Put_();
WScript.Echo("Had to enable logging");
}
// var the logging format to W3C Extended:
IIsWebServerObj.Properties_("LogPluginClsid").Value = sClsidW3C;
// Log only the client IP address, the HTTP status, the time, and the URL.
IIsWebServerObj.Properties_("LogExtFileFlags").Value = 1286;
IIsWebServerObj.Put_();
WScript.Echo("Logging has been changed to W3C Extended");
// See what the new value is:
IIsWebServerObj.get;
sLogPluginClsid = IIsWebServerObj.LogPluginClsid;
if (sLogPluginClsid = sClsidNCSA) {
WScript.Echo("Log type is " + sNCSA);
} else if (sLogPluginClsid = sClsidIIS) {
WScript.Echo("Log type is " + sIIS);
} else if (sLogPluginClsid = sClsidW3C) {
WScript.Echo("Log type is " + sW3C);
} else WScript.Echo("Log type is not one of the IIS provided types");
WScript.Echo("LogExtFileFlags = " + IIsWebServerObj.LogExtFileFlags );