IIS Logging

Issue

It is essential to log your Web site events regularly to find invalid usage or identify malicious user activity and access.

Solution

Enable logging on your server running Internet Information Services (IIS) and use the W3C Extended Log File Format to log additional event properties.

Instructions

To enable IIS event logging in Microsoft® Windows Server® 2003

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
  2. Double-click your server, right-click the Web site or FTP site, and then click Properties.
  3. On the Website or FTP Site tab, select the Enable Logging check box.
  4. In the Active log format list, click W3C Extended Log File Format.
  5. Click Properties.
  6. In the Extended Logging Properties dialog box, enable extended properties by selecting the check box, and then select the following: Client IP Address, User Name, Method, URI Stem, Protocol Status, Win32 Status, User Agent, Server IP Address, and Server Port.

To enable IIS event logging in Microsoft Windows XP Professional

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Information Services.
  2. Double-click your server, right-click the Web site or FTP site, and then click Properties.
  3. On the Website or FTP Site tab, select the Enable Logging check box.
  4. In the Active log format list, click W3C Extended Log File Format.
  5. Click Properties.
  6. In the Extended Logging Properties dialog box, enable extended properties by selecting the check box, and then select the following: Client IP Address, User Name, Method, URI Stem, Protocol Status, Win32 Status, User Agent, Server IP Address, and Server Port.

To enable IIS event logging in Windows 2000

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
  2. Double-click your server, right-click the Web site or FTP site, and then click Properties.
  3. On the Website or FTP Site tab, select the Enable Logging check box.
  4. In the Active log format list, click W3C Extended Log File Format.
  5. Click Properties.
  6. In the Extended Logging Properties dialog box, select the following check boxes: Client IP Address, User Name, Method, URI Stem, Protocol Status, Win32 Status, User Agent, Server IP Address, and Server Port.

Additional Information

HOW TO: Enable IIS Logging Site Activity (300390)


©2002-2005 Microsoft Corporation. All rights reserved.