Introduction
The W3C Extended Log File Format is a web server log format in which the file itself says which fields each line holds. It was proposed by the World Wide Web Consortium in 1996 as a more flexible replacement for the Common Log Format.
It is the default log format of Microsoft’s web server, Internet Information Services
(IIS). IIS writes one file per site per day, with names such as
u_ex261106.log, under C:\inetpub\logs\LogFiles.
Structure
The file is plain text. Lines that start with # are directives.
#Version gives the format version, 1.0; #Software and
#Date say what wrote the log and when; and #Fields lists the
fields that every following line holds, in order. Field names use prefixes for who the
value belongs to: c- for the client, s- for the server,
cs- for data sent from client to server, and sc- for data sent
back. Directives can appear again later in the file, for example when the server
restarts.
Every other line is one request, with the fields separated by spaces and a hyphen for a field with no value. Times are in UTC.
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-11-06 10:00:00
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port c-ip sc-status time-taken
2026-11-06 10:00:01 192.0.2.5 GET /index.html - 443 198.51.100.7 200 15
Also used for
- Common Log Format .log
- Plain text log .log
Links
Software
- Internet Information Services (IIS), which writes these logs (Windows)
- GoAccess, a log analyser that reads W3C logs (Linux, macOS)
- Any text editor
Reference
- Extended Log File Format, the W3C working draft