Viewing the Server Logs
After your web server is
chugging along and serving pages to all and sundry, you might start to
wonder which pages are popular with surfers and which ones are
languishing. You might also want to know whether users are getting
errors when they try to access your site.
You can tell all of this
and more by working with the IIS logs. A log is a text file that records
all the activity on your website, including the IP address and computer
name (if applicable) of the surfer, the file that was served, the date
and time the file was shipped to the browser, and the server return code
(see the next Note box). For each server request, the log file writes a
sequence of space-separated values, which makes it easy to import the
file into a database or spreadsheet program for analysis.
The log files are stored in the \inetpub\logs\LogFiles\W3SVC1
folder of your Windows 7 system drive. (As you navigate to this folder,
you may see one or two dialog boxes telling you that you don’t have
permission to open a particular folder. In each case, click Continue and
enter your UAC credentials.)
Each filename takes the form u_exyymmdd.log, where yy is the two-digit year, mm is the two-digit month, and dd is the two-digit day. For example, the log for August 23, 2008 would be stored in u_ex080823.log. Figure 8 shows a typical log file.
At first glance, an IIS log
file appears to be nothing but a jumble of letters, numbers, and
symbols. However, there’s a bit of method in the apparent madness.
First, know that each line (that is, each line that doesn’t begin with #)
represents an object that IIS served. This could be a file, and image,
or some other content on the website. Second, remember that each field
is separated by a space. Third, notice the #Fields line, which appears from time to time in the log:
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
This line tells you the name of each log field. To help you make sense of what you’re looking at, Table 1 gives you a summary of what you see in each field.
Table 1. Description of the Fields Found in an IIS Log File
Field | Description |
---|
date | The date on which the item (file or folder) was served. |
time | The time at which the item was served. |
s-ip | The IP address of the computer that’s running the web server. |
cs-method | The method used to request the item. (This is almost always GET.) |
cs-uri-stem | The name of the requested item. |
cs-uri-query | The query used to generate the item request. (This will usually be blank, represented by a dash.) |
s-port | The port used to exchange the data. (This will always be 80.) |
cs-username | The
name—and sometimes the computer name—of the authenticated user. You
only see values in this field if you turn on basic authentication for
the website or a folder. |
c-ip | The IP address of the user who requested the item. |
cs(User-Agent) | A string that identifies the user’s web browser. |
sc-status | A code that specifies whether the request was handled successfully and, if not, what the error was. |
sc-substatus | A secondary error code if the request failed. |
sc-win32-status | The Windows status during the request. |
A sc-status code of 200
means the document was sent successfully to the browser. For
unsuccessful operations, here’s a summary of some of the return codes
you’ll find in the log:
Return Code | What It Means |
---|
204 | File contains no content |
301 | File moved permanently |
302 | File moved temporarily |
304 | File not modified |
400 | Bad request |
401 | Unauthorized access |
402 | Payment required |
403 | Access forbidden |
404 | File not found |
500 | Internal server error |
501 | Service not implemented |
502 | Bad gateway |
503 | Service unavailable |