Forum Moderators: open

Message Too Old, No Replies

Logs

         

blankmonkey

1:13 am on Dec 15, 2006 (gmt 0)

10+ Year Member



This is IIS6 on Win 2k3

I am trying to decipher my web logs, to find out if i can delete some websites. I found the w3c web logs at \windows\sys32\log files\, but they did not look like I expected (W3SVC). Instead I found these folders;
W3SVC1
W3SVC1889382736
W3SVC259463726
W3SVC456758617
W3SVC998577302

so i look in the first folder, and it has truck loads of data, but no column information, so i don't know the source IP, or the page that was viewed.

some of the other folders have log files also, and they have column titles, but they look weird;
date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status

Can someone help out with what these columns are, or point me to a doc?
What are the differences in these folders?
Are these the logs I want to be looking at, or am i totally in the wrong place?

blankmonkey

12:13 am on Dec 16, 2006 (gmt 0)

10+ Year Member



well i got some info here for those who would like to know the answer, at least partially.

as far as the column's, those that have titles, you can find out what their abbreviations mean from here;
[microsoft.com...]

also, to connect the number with the website;
search \windows\sys32\inetsrv\metabase.xml for the web name. the number after the W3SVC# should precede it and look like IIsWebServer Location="/LM/W3SVC/1889382736

still wondering what is in that first log with no column titles, and any other input others may have.