A Guide to IIS Access and Error Logs

Microsoft Internet Information Services (IIS) is a popular web server used on Windows platforms to host websites, web applications, and services. Understanding how IIS handles logging is crucial for optimizing server performance, troubleshooting issues, and enhancing security.

IIS primarily maintains two types of logs:

1. Access Logs – Track incoming HTTP requests to your server.
2. Error Logs – Record server-side errors, failed requests, and application-level issues.

This guide will walk you through the structure, configuration, and practical use of both types of logs in IIS.

---

Log & Configuration File Locations

Before getting into the details, it’s helpful to understand where IIS stores its logs and configuration files.

Description	Location
Access Logs	C:\inetpub\logs\LogFiles\W3SVC<SiteID>\
Failed Request Logs	C:\inetpub\logs\FailedReqLogFiles\W3SVC<SiteID>\
Error Logs (Event Viewer)	Windows Event Viewer > Applications and Services Logs
IIS Configuration	C:\Windows\System32\inetsrv\config\applicationHost.config

---

Understanding IIS Access Logs

What Are Access Logs?

Access logs capture details of all incoming HTTP requests processed by IIS. They are invaluable for:

• Monitoring traffic patterns
• Identifying potential security threats
• Analyzing client behavior (e.g., pages visited, user agents)

Enabling and Configuring Access Logs

To enable and configure access logging in IIS:

1. Open IIS Manager:
   • Navigate to Sites > Your Website.
   • Double-click Logging under the IIS section.
2. Configure Log Settings:
   • Format: The default format is W3C, which records critical request data.
   • Log File Directory: Typically located in C:\inetpub\logs\LogFiles\.
   • Fields: You can customize which fields to log (e.g., client IP, user agent, status code).
3. Customizing Log Fields
   • Click on Select Fields to include or exclude specific details like the referrer, server port, or HTTP substatus.

Access Log Format

IIS uses the W3C extended log format, which includes details like the client IP, HTTP method, URL, and status codes.

Sample Access Log Entry:

#Fields: date time cs-method cs-uri-stem sc-status sc-bytes cs(User-Agent) c-ip
2024-11-14 10:15:23 GET /index.html 200 4523 "Mozilla/5.0" 192.168.1.10

Field	Description
date	Date of the request
time	Time of the request
cs-method	HTTP method (GET, POST, etc.)
cs-uri-stem	Requested URL path
sc-status	HTTP status code
sc-bytes	Size of the response sent to the client
cs(User-Agent)	Client’s browser information
c-ip	Client IP address

Understanding IIS Error Logs

What Are Error Logs?

Error logs capture issues that occur while IIS processes requests. These logs are crucial for diagnosing server errors, application crashes, and configuration problems.

Types of IIS Error Logs

IIS uses multiple sources for logging errors:

1. HTTP Error Logs:
   • Located in C:\inetpub\logs\LogFiles\W3SVC<SiteID>.
   • Capture HTTP errors such as 404 (Not Found) or 500 (Internal Server Error).
2. Failed Request Tracing (FREB) Logs:
   • Provide detailed information on failed requests.
   • Located in C:\inetpub\logs\FailedReqLogFiles\W3SVC<SiteID>\.
   • To enable, go to IIS Manager > Failed Request Tracing Rules.
3. Windows Event Viewer:
   • Captures system-level errors, application crashes, and critical events.
   • Access via Event Viewer > Windows Logs > Application or System.

Configuring Error Logs

To enable Failed Request Tracing:

1. Open IIS Manager and select your website.
2. Click on Failed Request Tracing.
3. Enable the feature and set the number of trace files to keep.
4. Define specific conditions to capture, such as status codes (e.g., 500 errors).

Sample Error Log Entry (FREB)

<Event>
  <DateTime>2024-11-14T10:20:45.123Z</DateTime>
  <SiteID>1</SiteID>
  <RequestStatus>500</RequestStatus>
  <FailureReason>Module_Detail_Error</FailureReason>
  <ModuleName>FastCgiModule</ModuleName>
  <ErrorCode>0x8007000d</ErrorCode>
  <URL>/api/data</URL>
  <ClientIP>192.168.1.15</ClientIP>
</Event>

Explanation:

• The error log indicates a 500 Internal Server Error due to an issue with the FastCGI module.

Common Error Types

Here are some common IIS error messages:

Error Code	Description
400	Bad Request – Malformed request sent by the client
401	Unauthorized – Authentication required
403	Forbidden – Access denied
404	Not Found – Resource not found
500	Internal Server Error – Application or server error
503	Service Unavailable – Application pool is stopped

Configuring Logs for Multiple Websites

If you are hosting multiple websites on the same IIS server, it’s useful to configure separate logs for each site:

1. In IIS Manager, select the site you want to configure.
2. Open Logging and specify a unique log directory.
3. Adjust the settings to include or exclude specific fields as needed.

Example:

• Site 1: Logs stored in C:\inetpub\logs\LogFiles\W3SVC1\
• Site 2: Logs stored in C:\inetpub\logs\LogFiles\W3SVC2\

---

Mastering IIS logs is essential for maintaining a stable and secure web environment. By properly configuring and analyzing access and error logs, you can optimize server performance, identify issues quickly, and enhance security.

Use this guide to improve your IIS logging setup and server management capabilities.