IIS 7 Full Strategy logging configuration (excerpt from Network)

IIS 7 Full Introduction log logging configuration

Fountain of origin

　"IT168 Zhuangao" In addition to the logging capabilities that Windows provides, IIS 7.0 provides additional logging capabilities. For example, you can select the log file format and specify the request to log.

　(i) Enable or disable logging

If you want IIS to selectively record specific server requests based on the configured criteria, you should enable logging for the server. Once server logging is enabled, selective logging can be enabled for any site on the server. You can then view the log files to see the failed and successful requests.

If you no longer want IIS to selectively record requests for a site, you should disable logging for that site.

Note: In IIS 7.0, logging is enabled by default.

1. Open IIS Manager and navigate to the level you want to manage.

2. In the features view, double-click Logs.

3. On the log page, in the actions pane, click Enable to enable logging, or click Disable to disable logging.

(ii) Configure per-site logging options at the server level

If you want logging settings to be applied by default to all sites on the server, you can configure the per-site logging option at the server level. You can then open the logs page at the site level to configure specific settings for a Web site.

1. Open IIS Manager and navigate to the level you want to manage.

2. In the features view, double-click Logs.

3. On the log page, under one log file per site, select site from the drop-down list. By default, site is selected.

4. Under format, in the Log file section, select one of the following log file formats:

-IIS: Use the Microsoft IIS log file format to record information about the site. This format is handled by HTTP. SYS and is a fixed ASCII text-based format, which means that the fields of the record cannot be customized. The fields are separated by commas, and the time recorded is local time.

-NCSA: Use the National supercomputing Application Center (NCSA) Common log file format to record information about the site. This format is handled by HTTP. SYS and is a fixed ASCII text-based format, which means that the fields of the record cannot be customized. Fields are separated by spaces, and the time recorded is local time with a Coordinated Universal Time (UTC) bias.

-World NEWS: Use the centralized Web log file format to record information about all sites on the server. This format is handled by HTTP. SYS and is a customizable ASCII-based text format, which means that the fields of the record can be specified. Specify the fields that are recorded in the World Record Fields dialog box by clicking Select field on the Log page. Fields are separated by spaces, and the recorded time is in Coordinated Universal Time (UTC) format.

-Custom: Use a custom format for your custom logging module. If you select this option, the log page is disabled because custom logging cannot be configured in IIS Manager.

5. Under directory, specify the path where the log files should be stored. The default path is%systemdrive%\inetpub\logs\logfiles.

Note: It is a best practice to store log files (such as failed request tracking logs) in a directory other than systemroot.

6. Under encoding, select one of the following options from the drop-down list:

-UTF-8: Allows both single-byte and multibyte characters to be present in a string.

-ANSI: Only single-byte characters are allowed in a string.

7. In the log file rollover section, select one of the following options:

-Schedule: Create a new log file based on one of the following values:

-Hourly: Create a new log file every hour.

-Daily: Create a new log file every day.

-Weekly: Create a new log file weekly.

-Monthly: Create a new log file every month.

-Maximum file Size (bytes): Creates a new log file when the file reaches a certain size (in bytes). The minimum file size is 1048576 bytes. If this property is set to a value less than 1048576 bytes, the default value is implicitly assumed to be 1048576 bytes.

-Do not create a new log file: There is only one log file that will continue to grow in the process of recording information.

8. Select Use local time for file naming and rollover to specify that log file naming and rollover times use local server time. If this item is not selected, Coordinated Universal Time (UTC) is used.

Note: Regardless of the value of this setting, the timestamp in the actual log file will use this time format for the log format selected from the Format list. For example, the NCSA and the log file format use the UTC time format for timestamps.

9. In the actions pane, click Apply.

(iii) Configuring logging options at the site level

If you want to set up logging settings that are different from the server level for a site, you need to configure logging options at the site level.

1. Open IIS Manager and navigate to the site you want to manage.

2. In the features view, double-click Logs.

3. On the log page, under Format, in the Log file section, select one of the following log file formats:

-IIS: Use the Microsoft IIS log file format to record information about the site. This format is handled by HTTP. SYS and is a fixed ASCII text-based format, which means that the fields of the record cannot be customized. The fields are separated by commas, and the time recorded is local time.

-NCSA: Use the National supercomputing Application Center (NCSA) Common log file format to record information about the site. This format is handled by HTTP. SYS and is a fixed ASCII text-based format, which means that the fields of the record cannot be customized. Fields are separated by spaces, and the time recorded is local time with a Coordinated Universal Time (UTC) bias.

-World NEWS: Use the centralized Web log file format to record information about all sites on the server. This format is handled by HTTP. SYS and is a customizable ASCII-based text format, which means that the fields of the record can be specified. Specify the fields that are recorded in the World Record Fields dialog box by clicking Select field on the Log page. Fields are separated by spaces, and the recorded time is in Coordinated Universal Time (UTC) format.

-Custom: Use a custom format for your custom logging module. If you select this option, the log page is disabled because custom logging cannot be configured in IIS Manager.

4. Under directory, specify the path where the log files should be stored. The default path is%systemdrive%\inetpub\logs\logfiles.

Note: It is a best practice to store log files (such as failed request tracking logs) in a directory other than systemroot.

5. In the Log file rollover section, select one of the following options:

-Schedule: Create a new log file based on one of the following values:

-Hourly: Create a new log file every hour.

-Daily: Create a new log file every day.

-Weekly: Create a new log file weekly.

-Monthly: Create a new log file every month.

-Maximum file Size (bytes): Creates a new log file when the file reaches a certain size (in bytes). The minimum file size is 1048576 bytes. If this property is set to a value less than 1048576 bytes, the default value is implicitly assumed to be 1048576 bytes.

-Do not create a new log file: There is only one log file that will continue to grow in the process of recording information.

6. Select Use local time for file naming and rollover to specify that log file naming and rollover times use local server time. If this item is not selected, Coordinated Universal Time (UTC) is used.

Note: Regardless of the value of this setting, the timestamp in the actual log file will use this time format for the log format selected from the Format list. For example, the NCSA and the log file format use the UTC time format for timestamps.

7. In the actions pane, click Apply.

(iv) Configuring per-server logging options

If you want logging settings to be applied by default to all sites on the server, you can configure per-server logging options.

1. Open IIS Manager and navigate to the level you want to manage.

2. In the features view, double-click Logs.

3. On the log page, under one log file per site, select Server from the drop-down list. By default, site is selected.

4. Under format, in the Log file section, select one of the following log file formats:

-IIS: Use the Microsoft IIS log file format to record information about the site. This format is handled by HTTP. SYS and is a fixed ASCII text-based format, which means that the fields of the record cannot be customized. The fields are separated by commas, and the time recorded is local time.

-NCSA: Use the National supercomputing Application Center (NCSA) Common log file format to record information about the site. This format is handled by HTTP. SYS and is a fixed ASCII text-based format, which means that the fields of the record cannot be customized. Fields are separated by spaces, and the time recorded is local time with a Coordinated Universal Time (UTC) bias.

-World NEWS: Use the centralized Web log file format to record information about all sites on the server. This format is handled by HTTP. SYS and is a customizable ASCII-based text format, which means that the fields of the record can be specified. Specify the fields that are recorded in the World Record Fields dialog box by clicking Select field on the Log page. Fields are separated by spaces, and the recorded time is in Coordinated Universal Time (UTC) format.

-Custom: Use a custom format for your custom logging module. If you select this option, the log page is disabled because custom logging cannot be configured in IIS Manager.

5. Under directory, specify the path where the log files should be stored. The default path is%systemdrive%\inetpub\logs\logfiles.

Note: It is a best practice to store log files (such as failed request tracking logs) in a directory other than systemroot.

6. Under encoding, select one of the following options from the drop-down list:

-UTF-8: Allows both single-byte and multibyte characters to be present in a string.

-ANSI: Only single-byte characters are allowed in a string.

7. In the log file rollover section, select one of the following options:

-Schedule: Create a new log file based on one of the following values:

-Hourly: Create a new log file every hour.

-Daily: Create a new log file every day.

-Weekly: Create a new log file weekly.

-Monthly: Create a new log file every month.

-Maximum file Size (bytes): Creates a new log file when the file reaches a certain size (in bytes). The minimum file size is 1048576 bytes. If this property is set to a value less than 1048576 bytes, the default value is implicitly assumed to be 1048576 bytes.

-Do not create a new log file: There is only one log file that will continue to grow in the process of recording information.

8. Select Use local time for file naming and rollover to specify that log file naming and rollover times use local server time. If this item is not selected, Coordinated Universal Time (UTC) is used.

Note: Regardless of the value of this setting, the timestamp in the actual log file will use this time format for the log format selected from the Format list. For example, the NCSA and the log file format use the UTC time format for timestamps.

9. In the actions pane, click Apply.

(v) Select a field to record

If you want to control the amount of data stored in a log file, you can select a field to record.

1. Open IIS Manager and navigate to the level you want to manage.

2. In the features view, double-click Logs.

3. On the log page, under Format, click Select field in the Log Files section.

4. In the "Wide-Field Logging fields" dialog box, select one or more of the following options:

-Date: The date the request was made.

-Time: The time at which the request was made (Coordinated Universal Time (UTC)).

-Client IP address (C-IP): The IP address of the client making the request.

-User name (Cs-username): The name of the authenticated user who accessed the server. The anonymous user is represented by a hyphen character.

-Service Name (s-sitename): The site instance number that satisfies the request.

-Server name (s-computername): The name of the server that generated the log file entry.

-Server IP address (S-IP): The IP address of the server that generated the log file entry.

-Server Port (s-port): The server port number that is configured for the service.

-Method (Cs-method): The requested operation, such as the GET method.

-URI Resource (Cs-uri-stem): the Uniform Resource Identifier or target of the operation.

-URI Query (cs-uri-query): The query that the client tries to execute, if any. Only dynamic pages require a Uniform Resource Identifier (URI) query.

-Protocol status (sc-status): HTTP or FTP status code.

-Protocol sub-Status (sc-substatus): HTTP or FTP sub-status code.

-Win32 status (sc-win32-status): Windows status code.

-Number of bytes sent (sc-bytes): The number of bytes sent by the server.

-Number of bytes received (cs-bytes): The number of bytes received by the server.

-Elapsed Time (Time-taken): The amount of time (in milliseconds) the operation took.

-Protocol version (Cs-version): The protocol version (HTTP or FTP) used by the client.

-Host (Cs-host): Host name (if any).

-User agent (CS (useragent)): The type of browser used by the client.

-Cookie (CS (cookie)): The content of the cookie (if any) sent or received.

-Reference site (CS (Referer)): The site that the user last visited. This site provides links to the current site.

5. In the actions pane, click Apply.

　　(vi) Configure log file rollover options

If you want to control the length of time that log file data is stored on the server, you need to configure the log file rollover option.

1. Open IIS Manager and navigate to the level you want to manage.

2. In the features view, double-click Logs.

3. In the log file rollover section of the logs pane, select one of the following options:

-Schedule: Create a new log file based on one of the following values:

-Hourly: Create a new log file every hour.

-Daily: Create a new log file every day.

-Weekly: Create a new log file weekly.

-Monthly: Create a new log file every month.

-Maximum file Size (bytes): Creates a new log file when the file reaches a certain size (in bytes). The minimum file size is 1048576 bytes. If this property is set to a value less than 1048576 bytes, the default value is implicitly assumed to be 1048576 bytes.

-Do not create a new log file: This means that there will be only one log file that will continue to grow in the process of recording information. If you use a single log file for your site, it may be helpful to use the Log Analysis utility, but this may also create large log files that can affect the overall performance of your server.

4. Select Use local time for file naming and rollover to specify that log file naming and rollover times use local server time. If this item is not selected, Coordinated Universal Time (UTC) is used.

Note: Regardless of the value of this setting, the timestamp in the actual log file will use this time format for the log format selected from the Format list. For example, the NCSA and the log file format use the UTC time format for timestamps.

5. In the actions pane, click Apply.

IIS 7 Full Strategy logging configuration (excerpt from Network)