When IIS logging is enabled, new log entries are generated whenever users access the server. This causes a steady increase in log file size and, eventually, in the number of log files. On a busy server, log files can quickly grow to several gigabytes and, therefore, you might need to balance the need to gather information against the need to limit log files to a manageable size.

Tip

Keep in mind that log files are stored as ASCII or Unicode Transformation Format 8 (UTF-8) text files, and, if you need to, you can split or combine log files as you would with any text file. If your server runs out of disk space when IIS is attempting to add a log entry to a file, IIS logging shuts down and logs a logging error event in the Application log. When disk space is available again, IIS resumes logging file access and writes a start-logging event in the Application log.

When you configure logging, you specify how log files are created and saved. Logs can be created according to a time schedule, such as hourly, daily, weekly, and monthly. Logs can also be set to a fixed file size, such as 100 MB, or they can be allowed to grow to an unlimited file size. A log file’s name indicates its log file format as well as the log’s time frame or sequence. The various naming formats are summarized in Table 14-8.

By default, log files are written to the \%WinDir%System32LogFiles directory. You can configure logging to a different directory, such as D:LogFiles. Regardless of whether you use the default directory location or assign a new directory location for logs, you’ll find separate subdirectories for each service that’s enabled for logging under the primary directory.

Subdirectories for sites are named using the following syntax:

where N is the index number of the service or a random tracking value. The only exception is when you use centralized binary logging. Here, Web site logs are stored in the %WinDir%System32LogFilesW3SVC directory.

The default server created is number 1. Following this, you could have site directories named W3SVC1, MSFTPSVC1, and SMTPSVC1. If you create additional sites, a random 5- to 10-digit identifier is used. To correlate the identifier value to specific Web sites, select the Web Sites node in Internet Information Services (IIS) Manager and then look in the Description and Identifier columns in the right-hand pane to determine which identifier belongs to which site.

Note

As with many IIS 6 improvements, the reason identifiers are used is to enhance security by making it more difficult to determine where IIS data is being logged.

HTTP requests that return a status code indicating an internal server error are written to a central error log, which is stored in the %WinDir%System32Log-FilesHttperr directory. This error log file is named HttperrN.log, where N is the tracking number of the Web site experiencing the internal server errors.