Administering an ISP Installation

Logging Resources

Historically, logging has been a complex and time-consuming task. Web servers had to collect information about activity on a server and put it into a single file (sometimes several hundred megabytes in size). ISPs were then forced to extract information about specific Web sites from this file.

IIS 5.0 simplifies logging. You can now set various levels of granularity when analyzing the activity on your server. Log files can include or exclude information about individual Web sites, individual directories, and individual files.

By using IIS 5.0 logging, you can track which users access a site and when, which helps to identify potential security and performance problems. You can direct logging either to a file that can be studied offline, or to an Open Database Connectivity (ODBC) Data Source Name (DSN) for online evaluation.

IIS 5.0 has several logging features to help customize information about an IIS 5.0 Web site:

Customized Extended Logging IIS 5.0 supports the latest industry-standard W3C extended logging format, a customizable ASCII format that allows you to rerecord a variety of fields (items). You can gather detailed information and still limit log size by omitting unneeded fields. These fields include about 20 different items, such as date, time, client IP address, and browser type.
Resource Logging As with most configuration settings in IIS 5.0, logging can be set on a per-file basis. With resource logging, you can limit logging to specific resources. This will improve performance, reduce the size of the log file, and make it easier to interpret log files. For example, to reduce the log file size, you could put all the image files in one directory and choose not to log the files in that directory.
COM Logging Interface Developers can create custom modules to log information about a Web site. Each module is responsible for processing request events and writing either to a SQL Server data source or to a log file. IIS 5.0 logging capabilities can be extended by “plugging in” additional logging modules that developers or third-party vendors create.

To see the various levels of logging

Right-click the Web site for which you want to record a log.
On the Web Site property sheet, click the down arrow in the Active log format box.
Select the style of logging you want, and click the Properties button.
On the General Properties (or ODBC Properties) dialog box, select the desired granularity of logging.
If you’ve selected the W3C Extended Log File Format, select your preferred logging options in the Extended Logging Options dialog box.

For example, in the following log file, requests for files in the Images directory are included. If this page were to be requested several thousand times, the GET request for the image would be logged several thousand times as well.

#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 1999-01-01 22:20:57
#Fields: time c-ip cs-method cs-uri-stem sc-status
22:20:57 172.16.1.1 GET /samplecorp/ 404
22:21:03 172.16.1.1 GET /Default.htm 304
22:21:37 172.16.1.1 GET /images/undercon.gif 304

The following example shows a log file that doesn’t log the Images directory. Note that it doesn’t include the GET request for /Images/Undercon.gif.

CLIENT REQUEST
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 1997-10-16 22:23:32
#Fields: time c-ip cs-method cs-uri-stem sc-status
22:23:32 172.16.1.1 GET /samplecorp/ 404
22:24:14 172.16.1.1 GET /Default.htm 304

To further customize logging, you can create other logging modules with Microsoft® Visual C++® or Visual Basic. For more information, see the IIS 5.0 online product documentation.

For information about how to set extended logging options, see the “Customizing W3C Extended Logging” topic in the IIS 5.0 online product documentation. For a list of logging options and other information, see the “Logging Properties Reference” topic in the IIS 5.0 online product documentation.