At Alentus, we use Microsoft™ IIS W3SVC Extended Logging. Log file analyzers, such as our use of Urchin, utilize this log file data to produce the detailed web site statistics often used for sales and marketing analysis.

Alentus does allow you access to your log files, but take note that many web hosting companies do not. We recommend you FTP download your log files down to your desktop PC at least every 60 days, as we automatically delete the log files every 60 days to prevent them from taking up unnecessary space on the server's hard drive, and avoid unnecessary space usage with respect to your sites hosting plan.

Interpreting W3C Extended Log Files

Because you can customize W3C Extended Log File Format, the entries will vary, depending on the fields you have selected.

The example below shows lines from a file using the following fields: Time, Client IP Address, Method, URI Stem, and HTTP Status.

#Software: Microsoft Internet Information Server 4.0
#Version: 1.0
#Date: 1997-05-02 17:42:15
#Fields: time c-ip cs-method cs-uri-stem sc-status cs-version
17:42:15 157.56.115.201 GET /default.htm 200 HTTP/1.0

The preceding entry says that on May 2, 1997 at 5:42 P.M., a user with HTTP version 1.0 and the IP address of 157.56.115.201 issued a GET command (that is, downloaded) the file Default.htm. The request returned without error.

Note: The example shows abbreviations used in W3C Extended logging: cs stands for client-to-server actions, sc for server-to-client actions, c for client actions, and s for server actions.

Note: Any of the fields can be selected, but not all fields will have information available for logging. For fields that are selected, but for which there is no information, a dash (—) will appear in the field as a placeholder.

Interpreting Microsoft IIS Log Files

When you open a Microsoft IIS Log Format file in a text editor, the entries will be similar to the following examples:

10.75.176.21, —, 03/20/97, 7:55:20, W3SVC, SALES1, 10.107.1.121

10.16.7.165, anonymous, 03/20/97, 23:58:11, MSFTPSVC, SALES1, 10.107.1.121

The preceding sample entries are interpreted in the following tables. The top row in both tables is from a Web site (which appears under "Service" as W3SVC), the bottom row from an FTP site (which appears under "Service" as MSFTPSVC). The example is shown in two tables because of page-width limitations.

user’s IP address user’s user name Date Time Service Computer name IP address of server
10.75.176.21 — 03/20/97 7:55:20 W3SVC SALES1 10.107.1.121
10.16.7.165 anonymous 03/20/97 23:58:11 MSFTPSVC SALES1 10.107.1.121




Elapsed time Bytes received Bytes sent Service status code Windows NT status code Name of the operation Target of the operation
4502 163 3223 200 0 GET DeptLogo.gif
60 275 0 0 0 [376] PASS intro

In the preceding example, the first entry says that an anonymous user with the IP address of 10.75.176.21 issued a GET command (that is, downloaded) the image file DeptLogo.gif at 7:55 A.M. on March 20, 1997, from a server named SALES1 at IP address 10.107.1.121. The 163-byte HTTP request had an elapsed processing time of 4502 milliseconds (4.5 seconds) to complete, and returned, without error, 3223 bytes of data to the anonymous user.

In the log file, all fields are terminated with a comma (,). A hyphen acts as a placeholder if there is no valid value for a certain field.