Logging Properties Reference

This topic lists definitions of logging properties and their values for the W3C Extended logging format. It is divided into these sections:

W3C Extended Logging Definitions: General properties available to the W3C Extended log file format.
Process Accounting Logging Definitions: Additional properties for process accounting that appear in the W3C Extended log files.
Microsoft IIS Log Definitions: General properties available to the Microsoft IIS log file format.
NCSA Common Log File Format: General properties available to the NCSA Common log file format.

For more information on the W3C Extended log format, see the World Wide Web Consortium Web site.

W3C Extended Logging Definitions

Prefix	Meaning
s-	Server actions
c-	Client actions
cs-	Client-to-server actions
sc-	Server-to-client actions

Field	Appears As	Description
Date	`date`	The date on which the activity occurred.
Time	`time`	The time the activity occurred.
Client IP Address	`c-ip`	The IP address of the client that accessed your server.
User Name	`cs-username`	The name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen "-".
Service Name	`s-sitename`	The Internet service and instance number that was accessed by a client.
Server Name	`s-computername`	The name of the server on which the log entry was generated.
Server IP Address	`s-ip`	The IP address of the server on which the log entry was generated.
Server Port	`s-port`	The port number the client is connected to.
Method	`cs-method`	The action the client was trying to perform (for example, a GET method).
URI Stem	`cs-uri-stem`	The resource accessed; for example, Default.htm.
URI Query	`cs-uri-query`	The query, if any, the client was trying to perform.
Protocol Status	`sc-status`	The status of the action, in HTTP or FTP terms.
Win32 Status	`sc-win32-status`	The status of the action, in terms used by Windows.
Bytes Sent	`sc-bytes`	The number of bytes sent by the server.
Bytes Received	`cs-bytes`	The number of bytes received by the server.
Time Taken	`time-taken`	The length of time the action took.
Protocol Version	`cs-version`	The protocol (HTTP, FTP) version used by the client. For HTTP this will be either HTTP 1.0 or HTTP 1.1.
Host	`cs-host`	Displays the content of the host header.
User Agent	`cs(User-Agent)`	The browser used on the client.
Cookie	`cs(Cookie)`	The content of the cookie sent or received, if any.
Referrer	`cs(Referer)`	The previous site visited by the user. This site provided a link to the current site.

Process Accounting Logging Definitions

Field	Appears As	Description
Process Event	`s-event`	Which event was triggered: Site-Stop, Site-Start, Site-Pause, Periodic-Log, Interval-Start, Interval-End, Interval-Change, Log-Change-Int/Start/Stop, Eventlog-Limit, Priority-Limit, Process-Stop-Limit, Site-Pause-Limit, Eventlog-Limit-Reset, Priority-Limit-Reset, Process-Stop-Limit-Reset, or Site-Pause-Limit-Reset. Click for a description of these values.
Process Type	`s-process-type`	The type of process that triggered the event, either CGI or out-of-process application. The type can be CGI, Application, or All.
Total User Time	`s-user-time`	The total accumulated User Mode processor time % that the site used during the current interval.
Total Kernel Time	`s-kernel-time`	The total accumulated Kernel Mode processor % that the site used during the current interval.
Total Page Faults	`s-page-faults`	The total number of memory references that resulted in memory page faults.
Total Processes	`s-total-procs`	The total number of CGI and out-of-process applications created during the current interval.
Active Processes	`s-active-procs`	The total number of CGI and out-of-process applications running when the log was recorded.
Total Terminated Processes	`s-stopped-procs`	The total number of CGI and out-of-process applications stopped due to process throttling during the current interval.

Value	Meaning
Site-Stop	The Web site was stopped for some reason.
Site-Start	The Web site was started or restarted.
Site-Pause	The Web site was paused.
Periodic-Log	This is a regularly defined log entry whose interval was specified by the administrator.
Reset-Interval-Start	The Reset Interval has begun.
Reset-Interval-End	The Reset Interval has been reached and reset.
Reset-Interval-Change	The Web site administrator changed the value for the Reset Interval.
Log-Change-Int/Start/Stop	One of these events happened: the log interval was changed; an interval event took place; or the site either stopped, started, or paused.
Eventlog-Limit	An event log was made for the Web site because a CGI or out-of-process application reached the event log limit set by the administrator.
Priority-Limit	The Web site had a CGI or out-of-process application set to low priority because it reached the low priority limit set by the administrator.
Process-Stop-Limit	The Web site had a CGI or out-of-process application stopped because it reached the process stopping limit set by the administrator.
Site-Pause-Limit	The Web site was paused because a CGI or out-of-process application reached the site pause limit set by the administrator.
Eventlog-Limit-Reset	The Reset Interval was reached, or the Eventlog-Limit was manually reset.
Priority-Limit-Reset	The Reset Interval was reached, or the Priority-Limit was manually reset.
Process-Stop-Limit-Reset	The Reset Interval was reached, or the Process-Stop-Limit was manually reset.
Site-Pause-Limit-Reset	The Reset Interval was reached, or the Site-Pause-Limit was manually reset.

Microsoft IIS Log Definitions

Field	Description
Client's IP address	IP address of the client machine that made the request.
User name	The name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen "-".
Date	The date on which the activity occurred
Time	The time the activity occurred.
Service and Instance	A Web site instance is displayed as W3SVC#, an FTP site instance is displayed as MSFTPSVC#, where # is the instance of the site.
Computer name	The server's NetBios name.
IP address of server	The IP address of the server that the request was serviced through.
Time taken	The length of time the action took.
Bytes sent	Number of bytes sent to the server.
Bytes received	Number of bytes recieved from the server.
Service status code	HTTP or FTP status code.
Windows status code	The status of the action, in terms used by Windows.
Request type	The type of request recieved by the server (eg.GET and PASS).
Target of the operation	The URL that was the target of the operation.
Parameters	The parameters that are passed to a script.

NCSA Common Log File Format

Field	Description
Remote host address	IP address of the client machine that made the request.
Remote Log Name	This value is always a hyphen "-".
Username	In the format of Domain\username for authenticated users, or a hyphen "-" for anonymous users.
Date	The date on which the activity occurred.
Time and GMT offset	The time the activity occurred followed by the GMT offset.
Request, and version	The request type that was used, the URL that was targeted, the parameters that were passed to a script, if any, and the HTTP version that the client used.
Server Status code	HTTP status code.
Bytes sent	The number of bytes the server sent to the client.