An Internet Information Services (IIS) Web server can be configured for Site, Central Binary, or Central W3C logging. In Central W3C logging, all client requests for all sites are logged to a single log file in W3C centralized format on the server. Central Binary logging also logs all sites centrally to a single file, but does so in centralized binary format. In Site logging, all client requests are logged at the site level, not centrally at the server level. These logging types depend on the World Wide Web Publishing Service for their configuration.
Configure the central logging format
Both centralized binary logging and centralized W3C logging are enabled. Because only one type of logging can be enabled at a time, the system has defaulted to central W3C logging. Use the following procedure to configure either W3C or binary logging.
Note: If you want to use binary logging, you must perform this procedure.
To configure centralized logging by using IIS Manager:
Click Start, click Control Panel, and then click Administrative Tools.
Right-click Internet Information Services (IIS) Manager and select Run as administrator.
In the IIS Manager Connections pane, select the Web server whose central logging you want to configure.
In Features View, double-click Logging.
In the Logging window, under One log file per:, make sure that Server is selected.
Under Log File Format:, select either W3C or Binary.
In the Actions pane, click Apply.
Target | Microsoft.Windows.InternetInformationServices.6.2.WebServer |
Category | Alert |
Enabled | True |
Event_ID | 1133 |
Event Source | Microsoft-Windows-IIS-W3SVC |
Alert Generate | False |
Remotable | True |
Event Log | System |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
WA | WriteAction | Microsoft.Windows.Server.IIS.6.2.GenerateAlertAction.SuppressedByDescription | Default |
<Rule ID="Microsoft.Windows.InternetInformationServices.6.2.Only.one.type.of.logging.can.be.enabled.at.a.time" Enabled="true" Target="Microsoft.Windows.InternetInformationServices.6.2.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-IIS-W3SVC</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1133</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.6.2.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.6.2.Only.one.type.of.logging.can.be.enabled.at.a.time.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>