IIS w3c logfile order of the different fields

formatiislogging

I have a W3C logfile of IIS access log.
I can't find out what the numbers mean:

2012-10-25 19:18:00 10.234.150.43 GET /status.aspx - 8080 - 10.0.0.1 - 200 0 0 0

Of course some of the fields are clear, but what do the three zero's at the end stand for?

I didn't customize the logging in any way…

Best Answer

The header of the log file should contain a header which contains the fieldnames:

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken

Related Solutions

SSL Negotiation Logging – How to Log SSL Negotiation in IIS

SSL negotiation happens before any HTTP headers are processed so you won't see this in the IIS logs. Have you looked through your event logs to see if there is anything there?

EDIT:
You can also have a go with SSL Diagnostics from Microsoft, specifically SSLMon. Looks like it might have something that will be of benefit to you, although I admittedly have not played with it yet.

Iis – Splunk: How Do I Extract Fields from W3C Extended Format

You can filter the lines beginning with a # using a transform.

In props.conf (you can just add the extra line below your existing setup):

[iis_w3c_default]
TRANSFORMS-blacklist-hash = iis_blacklist_hash

In transforms.conf:

[iis_blacklist_hash]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue

Best Answer

Related Solutions

SSL Negotiation Logging – How to Log SSL Negotiation in IIS

Iis – Splunk: How Do I Extract Fields from W3C Extended Format

Related Topic