The format is defined by the W3C working draft Extended Log File Format
(WD-logfile-960323, March 1996), which never went further but is what IIS and other
servers write. A log is lines ending in LF or CR LF: directives, which start with
#, and entries, one per request.
Directives
| Directive | Value |
|---|---|
#Version: | The format version, 1.0. Required, before any entry. |
#Fields: | The fields of each following entry, in order, separated by spaces. Required, before any entry; a new #Fields changes the layout from that point. |
#Software: | The program that wrote the log. |
#Start-Date: | When logging started: date and time. |
#End-Date: | When logging finished. |
#Date: | The date and time at which the next entries were added. |
#Remark: | A comment; ignored by analysis tools. |
Entries
Each entry holds the fields named in #Fields, separated by whitespace
(the draft prefers tabs; Microsoft’s HTTP Server API uses spaces). A field with no value is -.
Entries contain no control characters; a reader that meets a damaged line skips to
the next line break.
Field identifiers
A field is written in one of three ways: an identifier on its own, about the whole
transaction (time-taken); a prefix, a hyphen and an identifier, about one
party or one direction (cs-method); or a prefix and an HTTP header in
brackets (cs(User-Agent)), whose value is a string.
| Prefix | Meaning |
|---|---|
c | Client |
s | Server |
r | Remote (the server a proxy forwards to) |
cs | Client to server |
sc | Server to client |
sr | Server to remote server (proxies) |
rs | Remote server to server (proxies) |
x | Application-specific |
| Identifier | Prefix | Type | Meaning |
|---|---|---|---|
date | none | date | When the transaction completed |
time | none | time | When the transaction completed |
time-taken | none | fixed | How long it took, in seconds |
bytes | none | integer | Bytes transferred |
cached | none | integer | Whether it was a cache hit; 0 a miss |
ip | yes | address | IP address and port |
dns | yes | name | DNS name |
status | yes | integer | Status code |
comment | yes | text | The comment returned with the status |
method | yes | name | Request method |
uri | yes | URI | The URI |
uri-stem | yes | URI | The URI without its query |
uri-query | yes | URI | The query part of the URI |
For logs that summarise many requests, count (first, required) gives the
number of requests in each line, and time-from, time-to and
interval give the period in place of time.
Data types
| Type | Form |
|---|---|
| integer | Digits. |
| fixed | Digits with an optional fraction, such as 0.015. |
| URI | An absolute or relative URI, with no spaces or control characters. |
| date | YYYY-MM-DD, in GMT. |
| time | HH:MM, HH:MM:SS or HH:MM:SS.S, 24-hour, in GMT. |
| string | In double quotes; a double quote inside is doubled. |
| text | Free text; directives only. |
| name | A DNS name. |
| address | An IP address, optionally with a port. |
Fields written by Windows (HTTP Server API)
Microsoft’s HTTP Server API writes the W3C format with these
fields, in this order when present (Microsoft Learn, W3C Logging). An
application chooses which to log; a chosen field with no value is -,
non-printable characters are replaced by +, and fields are separated by
spaces.
| Field | Meaning |
|---|---|
date, time | When the activity occurred; the time is in UTC |
s-sitename | Internet service name and instance number |
s-computername | The server’s name |
s-ip | The server’s IP address |
cs-method, cs-uri-stem, cs-uri-query | Method, target and query |
s-port | The server port |
cs-username | The authenticated user; - for anonymous |
c-ip | The client’s IP address |
cs-version | HTTP version |
cs(User-Agent), cs(Cookie), cs(Referrer), cs-host | Request headers (Microsoft writes Referrer) |
sc-status, sc-substatus, sc-win32-status | HTTP status, sub-status, and Windows status code |
sc-bytes, cs-bytes | Bytes sent, and bytes received and processed |
time-taken | How long the action took, in milliseconds (not seconds as in the draft), from the first byte received to the last send completing |
streamid | The stream ID |