Version: <integer>.<integer>
The version of the extended log file format used. This draft defines version 1.0.
Fields: [<specifier>...]
lists a sequence of field identifiers specifying the information recorded in each entry.
Software: string
Identifies the software which generated the log.
Start-Date: <date> <time>
The date and time at which the log was started.
End-Date:<date> <time>
The date and time at which the log was finished.
Date:<date> <time>
The date and time at which the entry was added.
Remark: <text>
Comment information. Data recorded in this field should be ignored by analysis tools.
The directives Version and Fields are required and should precede all entries in the log. The Fields directive specifies the data recorded in the fields of each entry.
| Prefix |
Meaning |
s- |
Server actions. |
c- |
Client actions. |
cs- |
Client-to-server actions. |
sc- |
Server-to-client actions. |
| Field |
Appears As |
Description |
| Date |
date |
The date that the activity occurred. |
| Time |
time |
The time that the activity occurred. |
| Client IP Address |
c-ip |
The IP address of the client that accessed your server. |
| User Name |
cs-username |
The name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-). |
| Service Name |
s-sitename |
The Internet service and instance number that was accessed by a client. |
| Server Name |
s-computername |
The name of the server on which the log entry was generated. |
| Server IP Address |
s-ip |
The IP address of the server on which the log entry was generated. |
| Server Port |
s-port |
The port number the client is connected to. |
| Method |
cs-method |
The action the client was trying to perform (for example, a GET method). |
| URI Stem |
cs-uri-stem |
The resource accessed; for example, Default.htm. |
| URI Query |
cs-uri-query |
The query, if any, the client was trying to perform. |
| Protocol Status |
sc-status |
The status of the action, in HTTP or FTP terms. |
| Win32® Status |
sc-win32-status |
The status of the action, in terms used by Microsoft Windows®. |
| Bytes Sent |
sc-bytes |
The number of bytes sent by the server. |
| Bytes Received |
cs-bytes |
The number of bytes received by the server. |
| Time Taken |
time-taken |
The duration of time, in milliseconds, that the action consumed. |
| Protocol Version |
cs-version |
The protocol (HTTP, FTP) version used by the client. For HTTP this will be either HTTP 1.0 or HTTP 1.1. |
| Host |
cs-host |
Displays the content of the host header. |
| User Agent |
cs(User-Agent) |
The browser used on the client. |
| Cookie |
cs(Cookie) |
The content of the cookie sent or received, if any. |
| Referrer |
cs(Referer) |
The previous site visited by the user. This site provided a link to the current site. |
The following is an example of a record in the extended log format that was produced by the Microsoft Internet Information Server (IIS):
--------------------------------------------------------------------------------
#Software: Microsoft Internet Information Server 6.0
#Version: 1.0
#Date: 1998-11-19 22:48:39
#Fields: date time c-ip cs-username s-ip cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes time-taken cs-version cs(User-Agent) cs(Cookie) cs(Referrer)
1998-11-19 22:48:39 206.175.82.5 - 208.201.133.173 GET /global/images/navlineboards.gif - 200 540 324 157 HTTP/1.0 Mozilla/4.0+(compatible;+MSIE+4.01;+Windows+95) USERID=CustomerA;+IMPID=01234 http://www.loganalyzer.net
--------------------------------------------------------------------------------
Note that cookies in the W3C format (in contrast to the Combined format), are not quoted, and multiple cookies are delimited by + characters. Also note that Site Analyzer parses the + sign in cookies and user-agents by treating them as space characters. This is important to keep in mind especially when creating filters. (See the online help in the filters window for more information.)
Nihuo Web Log Analyzer can process log files in Microsoft IIS W3C Extended Log Format and generate dynamic statistics from them, analyzing and reporting server traffic. Please give try, you will find the best IIS log analyzer and the best Apache log file analyzer in the world.
Nihuo Web Log Analyzer also supports other log formats; See the list containing Microsoft IIS W3C Extended Log Format and all other supported formats.
