IIS Logging

Issue

It is essential to log your Web site events regularly to find invalid usage or identify malicious user activity and access.

Solution

Enable logging on your Internet Information Services (IIS) server and use the W3C Extended Log File Format to log additional event properties.

Instructions

To enable IIS event logging in Windows XP Professional

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Information Services.
  2. Double-click your server, right-click the Web site or FTP site, and then click Properties.
  3. On the Website or FTP Site tab, select the Enable Logging check box.
  4. In the Active log format list, click W3C Extended Log File Format.
  5. Click Properties.
  6. In the Extended Logging Properties dialog box, enable extended properties by selecting the check box and then select the following: Client IP Address, User Name, Method, URI Stem, Protocol Status, Win32 Status, User Agent, Server IP Address, and Server Port.

To enable IIS event logging in Windows 2000

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
  2. Double-click your server, right-click the Web site or FTP site, and then click Properties.
  3. On the Website or FTP Site tab, select the Enable Logging check box.
  4. In the Active log format list, click W3C Extended Log File Format.
  5. Click Properties.
  6. In the Extended Logging Properties dialog box, select the following check boxes: Client IP Address, User Name, Method, URI Stem, HTTP Status, Win32 Status, User Agent, Server IP Address, and Server Port.

To enable IIS event logging in Windows NT

  1. Click Start, point to Programs, point to Windows NT 4.0 Option Pack, point to Microsoft Internet Information Server, and then click Internet Service Manager.
  2. Double-click your server, right-click the Web site or FTP site, and then click Properties.
  3. On the Website or FTP Site tab, select the Enable Logging check box.
  4. In the Active log format list, click W3C Extended Log File Format.
  5. Click Properties.
  6. In the Extended Logging Properties dialog box, select the following check boxes: Client IP Address, User Name, Method, URI Stem, HTTP Status, Win32 Status, User Agent, Server IP Address, and Server Port.

Additional Information

HOW TO: Enable IIS Logging Site Activity (Q300390)

⌐ 2002 Microsoft Corporation. All rights reserved.