Each of the services that comprise Microsoft® Internet Information Server can be individually configured to log information about who accessed the server and what information they accessed. This data can be useful for performance tuning, capacity planning, content assessment, and security auditing. Logging in Internet Information Server was designed to be flexible:

• Flexible data stores (file system or SQL Server)
• Flexible logfile formats: Microsoft Professional Internet Services log format, European Microsoft Windows NT Academic Centre (EMWAC) log format, or NCSA Common Log File format.
• Flexible logfile location within the file system
• Flexible log turnover: You can configure new log files to be created whenever the files achieve a particular size or whenever the day, week, or month changes.

Logging to SQL Server
By using the Internet Information Server database logging feature, sites can integrate their Internet Server activities with automatic analysis and report generation. Internet Information Server can be configured for logging to a SQL Server database. Note: database logging does increase the amount of time and resources taken to service FTP, HTTP, and Gopher requests. Sites with very heavy traffic should log to the file system for maximum performance.

Log Contents
Every access to an Internet Information Server service causes a log entry to be recorded. Log entries have the following format:

Client IP Address, Client Username, Date, Time, Service, Computer Name, IP address of server, Processing time (ms), Bytes received, Bytes sent, Service status code, Windows NT status code, Name of operation, Target of operation

Here's an example:

157.55.92.28, -, 12/28/95, 17:45:17, W3SVC, INETSRV12, 157.55.84.1, 220, 250, 1696, 200, 0, GET, /samples/tour/netsec.htm, -,

indicating that the an anonymous client with IP address 157.55.92.28 issued a GET command for netsec.htm at 5:45 PM on 28 December, 1995 from the virtual server on 157.55.84.1. The 250-byte request took 220 milliseconds to execute (without error) and resulted in a data return of 1696 bytes.

You can use the convlog utility provided with Internet Information Server (it's in C:\Inetsrv\Server or the directory where you installed Internet Information Server) to convert a log in this format to NCSA Common Log File or EMWAC format as well as perform reverse-lookup replacing all IP addresses with domain names.