CHAPTER 7

Logging Server Activity

Configuring Logging
How to Read Log Files
Viewing Logs in Databases
Converting Log File Formats

Each of the services contained in Microsoft Internet Information Server can be configured to log information about who accessed the server and what information they accessed. This data can help you fine-tune your site, plan for the number of users that regularly gain access to your site, assess content, and audit security.

The logging feature in Internet Information Server has been designed for flexibility in the following areas:

• Choice of data stores:

File system or Microsoft® SQL Server.

• Various log-file formats:

Standard format, European Microsoft Windows NT Academic Centre (EMWAC) format, or National Center for Supercomputing (NCSA) Common Log File format.

• Location of log files within the system.

• Creation of new log files:

In logging to file, new log files can be created whenever the files achieve a particular size, or whenever the day, week, or month changes.

This chapter explains how to:

• Configure logging.

• Read file logs.

• View logs in databases.

• Convert log files to other formats.

Configuring Logging

To configure logging:

• Determine in which folder the logs will be stored.

• Specify how often logs are to be rotated (every day, every week, every month, and so on).

• Select the log tools you want to use to analyze the logs your server collects.

Log to File

Log Format

Automatically open new log

Log file folder

Filename

To log to a file

1. In Internet Service Manager, double-click a service to display its property sheets, then click the Logging tab.

2. Select the Enable Logging check box.

3. Select Log to File.

4. In the Log Format box, select the logging format you want, either Standard or NCSA.

5. To create a new log file when certain conditions are met, select the Automatically open new log check box.

The service will close the log file and create a new one with a different name in the same folder when the appropriate interval or file size is reached. Log file names are as follows:

• Inetsv1.log if Automatically open new log is not selected.

• Inetsvnnn.log (where nnn is a sequentially increasing number) if When file size reaches is selected.

• Inmmddyy.log (where mmddyy is the month, day, and year when the log file is created) if one of the Daily, Weekly, or Monthly options is enabled.

For the When file size reaches option, every time the log file is closed and a new one is created, the sequential number in the file name is incremented.

When logging to a file, the maximum total log line is 1200 bytes. Each field is limited to 150 bytes.

Log to SQL/ODBC Database

For best results, log to a Microsoft SQL Server version 6.5 database. If you do not want to log to a database or use the Internet Database Connector on a Web server, do not install any ODBC drivers.

Choose Log to SQL/ODBC Database to log activity information to any Open Database Connectivity (ODBC)-compliant data source. Set the ODBC Data Source Name (DSN), Table, and specify the user name and password to use when logging to the database.

When using ODBC for logging, each field is limited to 255 bytes.

Note   Logging to a database increases the amount of time and resources needed to service WWW (HTTP), FTP, and gopher requests. Therefore, if your site has heavy traffic, you should log to the file system to maximize performance.

To manually prepare for logging to a database

1. Create a table that conforms to the sizes of the fields for your database programs, such as Microsoft SQL Server.

In Microsoft SQL Server, the sizes of the fields for a table are as follows:

ClientHost varchar(255), username varchar(255), LogTime datetime, service varchar(255), machine varchar(255), serverip varchar(50), processingtime int, bytesrecvd int, bytessent int, servicestatus int, win32status int, operation varchar(255), target varchar(255), parameters varchar(255)

You can find these values in the Logtemp.sql file in the Inetsrv folder.

2. Set up a database on your server and create a system Data Source Name (DSN).

Note   For Microsoft® Access, the system DSN is the file name of your database.

To log to a database

1. In Internet Service Manager, double-click the service for which you want to set up the database.

2. Click the Logging tab.

3. Select the Enable Logging check box.

4. Select Log to SQL/ODBC database.

5. In the ODBC Data Source Name (DSN) box, type the system DSN that you added in step 2 of the previous procedure.

6. In the Table field, type the name of the table (not the file name of the table).

7. In the User Name and Password fields, type a user name and password that is valid for the computer on which the database resides.

8. Click Apply and then click OK.

How to Read Log Files

Client’s IP address	Client’s username	Date	Time	Service	Computer name	IP address of server
10.75.176.21	—	12/11/95	7:55:20	W3SVC	TREY1	10.107.1.121
10.16.7.165	anonymous	12/11/95	23:58:11	MSFTPSVC	TREY1	10.107.1.121
10.55.82.244	—	12/11/95	0:00:34	GopherSvc	TREY1	10.107.1.121

Elapsed time	Bytes received	Bytes sent	Service status code	Windows NT status code	Name of the operation	Target of the operation
4502	163	3223	200	0	GET	small.gif
60	275	0	0	0	[376] PASS	intro
6139	273	62184	0	0	file	form1.bmp

Parameters for the operation, if applicable, will be listed in the final fields.

Note   All fields are terminated with a comma (,). A hyphen acts as a placeholder if there is no valid value for a certain field.

As a sample interpretation of logging data, the first entry in the table says that an anonymous client with the IP address of 10.75.176.21 downloaded (issued a GET command for) the file Small.gif at 7:55 AM on December 11, 1995, from a server named TREY1 at IP address 10.107.1.121. The 163-byte HTTP request had an elapsed processing time of 4502 milliseconds (almost half a second) to complete (without error) and returned 3223 bytes of data to the anonymous client.

The following example shows a log file in NCSA format:

157.55.85.138 - REDMOND\doug [07/Jun/1996:17:39:04 -0800] "POST /iisadmin/default.htm?-, HTTP/1.0" 200 3401

Remote host name	Client’s username	Date	Time
157.55.85.138	REDMOND\doug	07/Jun/1996	17:39:10 -0800

Request	Service Status code	Bytes received
GET /scripts/iisadmin/ism.dll?http/serv, HTTP/1.0	200	5125

Viewing Logs in Databases

You can use any ODBC-compliant application to view the log data in your database.

In addition, you can use the Internet Database Connector to view log data in a Web browser.

Converting Log File Formats

• Standard format (Microsoft Professional Internet Services format)

• NCSA Common Log File format

if you have created Microsoft Internet Information Server log files in Standard format and want to convert them to either the EMWAC log file format or NCSA Common Log File format, use the Microsoft Internet Log Converter (Convlog.exe). At the command prompt, type convlog without parameters to see syntax and examples.

To convert logs to other formats

1. Add Convlog.exe (in the \Inetsrv folder, by default) to your path.

2. In a command-prompt window, type the convlog command. See the syntax and examples below.

Syntax

convlog -s[f|g|w] -t [emwac | ncsa[:GMTOffset] | none]

-o [output directory] -f [temp file directory] -h LogFilename

-d<m:[cachesize]>

Parameters

-s[f|g|w]

Specifies the service for which to convert log entries.

f = Process FTP log entries

g = Process gopher log entries

w = Process WWW log entries

The default for the -s switch is to convert logs for all services.

-t [emwac | ncsa[:GMTOffset] | none]

Specifies the destination conversion format. The default is to create output files in EMWAC format.

-o [output directory]

Specifies the directory for the converted files. The default is the current directory.

-f [temp file directory]

Specifies a temporary directory to hold temporary files created by convlog. The default is C:\Temp or the directory specified by the “tmp” environment variable.

-n[m:[cachesize]|i]

Specifies whether to convert IP addresses to computer or domain names. The default is to not convert IP addresses.

m[cachesize] = Specifies to convert IP addresses to computer names. The default cachesize is 5000 bytes.

i = Specifies to not convert IP addresses to computer names.

-h

Displays Help.

LogFilename

Specifies the name of the log to be converted. Convlog will display the file name for the converted file.

-dm:[cachesize]

Converts IP addresses in NCSA log format to computer names or domain names. The default is to not convert IP addresses. The default cachesize is 5000 bytes.

Examples

convlog -sf -t ncsa -o c:\logs in*.log

convlog -t ncsa:-0300 in*.log

convlog -o \\stats\logs c:\logs\in*.log

convlog -sfg in*.log

convlog -nm *.log

convlog -t none -nm:20000 *.log

---

© 1996 by Microsoft Corporation. All rights reserved.