IIS w3c logfile order of the different fields?

Question

I have a W3C logfile of IIS access log. I can't find out what the numbers mean:

2012-10-25 19:18:00 10.234.150.43 GET /status.aspx - 8080 - 10.0.0.1 - 200 0 0 0

Of course some of the fields are clear, but what do the three zero's at the end stand for?

I didn't customize the logging in any way...

I'm stupid, didn't look at the top of the file, there's a header there! — Jaap, Oct 25 '12 at 21:10

score 1 · Accepted Answer · answered Oct 25 '12 at 21:10

1

The header of the log file should contain a header which contains the fieldnames:

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken

answered Oct 25 '12 at 21:10

Jaap

367
3
16

I don't have any headers in my log files, unfortunately. I can't check the settings without disabling logging, either, which seems crazy. – DCShannon May 10 '17 at 21:40
I gave up and disabled logging, but the Select Fields button is still grey, so I guess I can't look at the settings anyway. Argh. – DCShannon May 10 '17 at 21:45

score 1 · Answer 2 · answered Oct 25 '12 at 21:36

1

To piggy back Jaap's answer:

"sc-" Server-to-client actions

sc-substatus - The substatus error code.
sc-win32-status - The Windows status code.
time-taken - The length of time that the action took, in milliseconds.

Source

answered Oct 25 '12 at 21:36

bmurtagh

773
2
6
13

IIS w3c logfile order of the different fields?

2 Answers2