[This is preliminary documentation and subject to change]

Logging Properties Reference

This topic lists definitions of logging properties and their values for the W3C Extended logging format. It is divided into these sections:

For more information on the W3C Extended log format, see the World Wide Web Consortium Web site.

W3C Extended Logging Definitions

PrefixMeaning
s-Server actions.
c-Client actions.
cs-Client-to-server actions.
sc-Server-to-client actions.


FieldAppears AsDescription
DatedateThe date on which the activity occurred.
TimetimeThe time the activity occurred.
Client IP Addressc-ipThe IP address of the client that accessed your server.
User Namecs-usernameThe name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen "-".
Service Names-sitenameThe Internet service and instance number that was accessed by a client.
Server Names-computernameThe name of the server on which the log entry was generated.
Server IP Addresss-ipThe IP address of the server on which the log entry was generated.
Server Ports-portThe port number the client is connected to.
Methodcs-methodThe action the client was trying to perform (for example, a GET method).
URI Stemcs-uri-stemThe resource accessed; for example, Default.htm.
URI Querycs-uri-queryThe query, if any, the client was trying to perform.
Protocol Statussc-statusThe status of the action, in HTTP or FTP terms.
Win32 Statussc-win32-statusThe status of the action, in terms used by Windows.
Bytes Sentsc-bytesThe number of bytes sent by the server.
Bytes Receivedcs-bytesThe number of bytes received by the server.
Time Takentime-takenThe length of time the action took.
Protocol Versioncs-versionThe protocol (HTTP, FTP) version used by the client. For HTTP this will be either HTTP 1.0 or HTTP 1.1.
Hostcs-hostDisplays the content of the host header.
User Agentcs(User-Agent)The browser used on the client.
Cookiecs(Cookie)The content of the cookie sent or received, if any.
Referrercs(Referer)The previous site visited by the user. This site provided a link to the current site.

Process Accounting Logging Definitions

FieldAppears AsDescription
Process Events-eventWhich event was triggered: Site-Stop, Site-Start, Site-Pause, Periodic-Log, Interval-Start, Interval-End, Interval-Change, Log-Change-Int/Start/Stop, Eventlog-Limit, Priority-Limit, Process-Stop-Limit, Site-Pause-Limit, Eventlog-Limit-Reset, Priority-Limit-Reset, Process-Stop-Limit-Reset, or Site-Pause-Limit-Reset. Click for a description of these values.
Process Types-process-typeThe type of process that triggered the event, either CGI or out-of-process application. The type can be CGI, Application, or All.
Total User Times-user-timeThe total accumulated User Mode processor time % that the site used during the current interval.
Total Kernel Times-kernel-timeThe total accumulated Kernel Mode processor % that the site used during the current interval.
Total Page Faultss-page-faultsThe total number of memory references that resulted in memory page faults.
Total Processess-total-procsThe total number of CGI and out-of-process applications created during the current interval.
Active Processess-active-procsThe total number of CGI and out-of-process applications running when the log was recorded.
Total Terminated Processess-stopped-procsThe total number of CGI and out-of-process applications stopped due to process throttling during the current interval.

ValueMeaning
Site-StopThe Web site was stopped for some reason.
Site-StartThe Web site was started or restarted.
Site-PauseThe Web site was paused.
Periodic-LogThis is a regularly defined log entry whose interval was specified by the administrator.
Reset-Interval-StartThe Reset Interval has begun.
Reset-Interval-EndThe Reset Interval has been reached and reset.
Reset-Interval-ChangeThe Web site administrator changed the value for the Reset Interval.
Log-Change-Int/Start/StopOne of these events happened: the log interval was changed; an interval event took place; or the site either stopped, started, or paused.
Eventlog-LimitAn event log was made for the Web site because a CGI or out-of-process application reached the event log limit set by the administrator.
Priority-LimitThe Web site had a CGI or out-of-process application set to low priority because it reached the low priority limit set by the administrator.
Process-Stop-LimitThe Web site had a CGI or out-of-process application stopped because it reached the process stopping limit set by the administrator.
Site-Pause-LimitThe Web site was paused because a CGI or out-of-process application reached the site pause limit set by the administrator.
Eventlog-Limit-ResetThe Reset Interval was reached, or the Eventlog-Limit was manually reset.
Priority-Limit-ResetThe Reset Interval was reached, or the Priority-Limit was manually reset.
Process-Stop-Limit-ResetThe Reset Interval was reached, or the Process-Stop-Limit was manually reset.
Site-Pause-Limit-ResetThe Reset Interval was reached, or the Site-Pause-Limit was manually reset.

Microsoft IIS Log Definitions

FieldDescription
Client's IP addressIP address of the client machine that made the request.
User nameThe name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen "-".
DateThe date on which the activity occurred
TimeThe time the activity occurred.
Service and InstanceA Web site instance is displayed as W3SVC#, an FTP site instance is displayed as MSFTPSVC#, where # is the instance of the site.
Computer nameThe server's NetBios name.
IP address of serverThe IP address of the server that the request was serviced through.
Time takenThe length of time the action took.
Bytes sentNumber of bytes sent to the server.
Bytes receivedNumber of bytes received from the server.
Service status codeHTTP or FTP status code.
Windows status codeThe status of the action, in terms used by Windows.
Request typeThe type of request received by the server (eg.GET and PASS).
Target of the operationThe URL that was the target of the operation.
ParametersThe parameters that are passed to a script.

NCSA Common Log File Format

FieldDescription
Remote host addressIP address of the client machine that made the request.
Remote Log NameThis value is always a hyphen "-".
UsernameIn the format of Domain\username for authenticated users, or a hyphen "-" for anonymous users.
DateThe date on which the activity occurred.
Time and GMT offsetThe time the activity occurred followed by the GMT offset.
Request, and versionThe request type that was used, the URL that was targeted, the parameters that were passed to a script, if any, and the HTTP version that the client used.
Server Status codeHTTP status code.
Bytes sentThe number of bytes the server sent to the client.

© 1997-2001 Microsoft Corporation. All rights reserved.