Logging Properties Reference

This topic lists definitions of logging properties and their values for the W3C Extended logging format. It is divided into these sections:

For more information on the W3C Extended log format, see the World Wide Web Consortium Web site.

W3C Extended Logging Definitions

Prefix Meaning
s- Server actions
c- Client actions
cs- Client-to-server actions
sc- Server-to-client actions


Field Appears As Description
Date date The date on which the activity occurred.
Time time The time the activity occurred.
Client IP Address c-ip The IP address of the client that accessed your server.
User Name cs-username The name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen "-".
Service Name s-sitename The Internet service and instance number that was accessed by a client.
Server Name s-computername The name of the server on which the log entry was generated.
Server IP Address s-ip The IP address of the server on which the log entry was generated.
Server Port s-port The port number the client is connected to.
Method cs-method The action the client was trying to perform (for example, a GET method).
URI Stem cs-uri-stem The resource accessed; for example, Default.htm.
URI Query cs-uri-query The query, if any, the client was trying to perform.
Protocol Status sc-status The status of the action, in HTTP or FTP terms.
Win32 Status sc-win32-status The status of the action, in terms used by Windows.
Bytes Sent sc-bytes The number of bytes sent by the server.
Bytes Received cs-bytes The number of bytes received by the server.
Time Taken time-taken The length of time the action took.
Protocol Version cs-version The protocol (HTTP, FTP) version used by the client. For HTTP this will be either HTTP 1.0 or HTTP 1.1.
Host cs-host Displays the content of the host header.
User Agent cs(User-Agent) The browser used on the client.
Cookie cs(Cookie) The content of the cookie sent or received, if any.
Referrer cs(Referer) The previous site visited by the user. This site provided a link to the current site.

Process Accounting Logging Definitions

Field Appears As Description
Process Event s-event Which event was triggered: Site-Stop, Site-Start, Site-Pause, Periodic-Log, Interval-Start, Interval-End, Interval-Change, Log-Change-Int/Start/Stop, Eventlog-Limit, Priority-Limit, Process-Stop-Limit, Site-Pause-Limit, Eventlog-Limit-Reset, Priority-Limit-Reset, Process-Stop-Limit-Reset, or Site-Pause-Limit-Reset. Click for a description of these values.
Process Type s-process-type The type of process that triggered the event, either CGI or out-of-process application. The type can be CGI, Application, or All.
Total User Time s-user-time The total accumulated User Mode processor time % that the site used during the current interval.
Total Kernel Time s-kernel-time The total accumulated Kernel Mode processor % that the site used during the current interval.
Total Page Faults s-page-faults The total number of memory references that resulted in memory page faults.
Total Processes s-total-procs The total number of CGI and out-of-process applications created during the current interval.
Active Processes s-active-procs The total number of CGI and out-of-process applications running when the log was recorded.
Total Terminated Processes s-stopped-procs The total number of CGI and out-of-process applications stopped due to process throttling during the current interval.

Value Meaning
Site-Stop The Web site was stopped for some reason.
Site-Start The Web site was started or restarted.
Site-Pause The Web site was paused.
Periodic-Log This is a regularly defined log entry whose interval was specified by the administrator.
Reset-Interval-Start The Reset Interval has begun.
Reset-Interval-End The Reset Interval has been reached and reset.
Reset-Interval-Change The Web site administrator changed the value for the Reset Interval.
Log-Change-Int/Start/Stop One of these events happened: the log interval was changed; an interval event took place; or the site either stopped, started, or paused.
Eventlog-Limit An event log was made for the Web site because a CGI or out-of-process application reached the event log limit set by the administrator.
Priority-Limit The Web site had a CGI or out-of-process application set to low priority because it reached the low priority limit set by the administrator.
Process-Stop-Limit The Web site had a CGI or out-of-process application stopped because it reached the process stopping limit set by the administrator.
Site-Pause-Limit The Web site was paused because a CGI or out-of-process application reached the site pause limit set by the administrator.
Eventlog-Limit-Reset The Reset Interval was reached, or the Eventlog-Limit was manually reset.
Priority-Limit-Reset The Reset Interval was reached, or the Priority-Limit was manually reset.
Process-Stop-Limit-Reset The Reset Interval was reached, or the Process-Stop-Limit was manually reset.
Site-Pause-Limit-Reset The Reset Interval was reached, or the Site-Pause-Limit was manually reset.

Microsoft IIS Log Definitions

Field Description
Client's IP address IP address of the client machine that made the request.
User name The name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen "-".
Date The date on which the activity occurred
Time The time the activity occurred.
Service and Instance A Web site instance is displayed as W3SVC#, an FTP site instance is displayed as MSFTPSVC#, where # is the instance of the site.
Computer name The server's NetBios name.
IP address of server The IP address of the server that the request was serviced through.
Time taken The length of time the action took.
Bytes sent Number of bytes sent to the server.
Bytes received Number of bytes recieved from the server.
Service status code HTTP or FTP status code.
Windows status code The status of the action, in terms used by Windows.
Request type The type of request recieved by the server (eg.GET and PASS).
Target of the operation The URL that was the target of the operation.
Parameters The parameters that are passed to a script.

NCSA Common Log File Format

Field Description
Remote host address IP address of the client machine that made the request.
Remote Log Name This value is always a hyphen "-".
Username In the format of Domain\username for authenticated users, or a hyphen "-" for anonymous users.
Date The date on which the activity occurred.
Time and GMT offset The time the activity occurred followed by the GMT offset.
Request, and version The request type that was used, the URL that was targeted, the parameters that were passed to a script, if any, and the HTTP version that the client used.
Server Status code HTTP status code.
Bytes sent The number of bytes the server sent to the client.

© 1997-2001 Microsoft Corporation. All rights reserved.