IISW3C Input Format Fields

The input records generated by the IISW3C input format contain the following fields:

Name Type Description
LogFilename STRING Full path of the log file containing this entry
LogRow INTEGER Line in the log file containing this entry
date TIMESTAMP The date on which the request was served (Universal Time Coordinates (UTC) time)
time TIMESTAMP The time at which the request was served (Universal Time Coordinates (UTC) time)
c-ip STRING The IP address of the client that made the request
cs-username STRING The name of the authenticated user that made the request, or NULL if the request was from an anonymous user
s-sitename STRING The IIS service name and site instance number that served the request
s-computername STRING The name of the server that served the request
s-ip STRING The IP address of the server that served the request
s-port INTEGER The server port number that received the request
cs-method STRING The HTTP request verb or FTP operation
cs-uri-stem STRING The HTTP request uri-stem or FTP operation target
cs-uri-query STRING The HTTP request uri-query, or NULL if the requested URI did not include a uri-query
sc-status INTEGER The response HTTP or FTP status code
sc-substatus INTEGER The response HTTP sub-status code (this field is logged by IIS version 6.0 and later only)
sc-win32-status INTEGER The Windows status code associated with the response HTTP or FTP status code
sc-bytes INTEGER The number of bytes in the response sent by the server
cs-bytes INTEGER The number of bytes in the request sent by the client
time-taken INTEGER The number of milliseconds elapsed since the moment the server received the request to the moment the server sent the last response chunk to the client
cs-version STRING The HTTP version of the client request
cs-host STRING The client request Host header
cs(User-Agent) STRING The client request User-Agent header
cs(Cookie) STRING The client request Cookie header
cs(Referer) STRING The client request Referer header
s-event STRING The type of log event (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)
s-process-type STRING The type of process that triggered the log event (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)
s-user-time REAL The total accumulated User Mode processor time, in percentage, that the site used during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)
s-kernel-time REAL The total accumulated Kernel Mode processor time, in percentage, that the site used during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)
s-page-faults INTEGER The total number of memory references that resulted in memory page faults during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)
s-total-procs INTEGER The total number of applications created during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)
s-active-procs INTEGER The total number of applications running when the log event was triggered (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)
s-stopped-procs INTEGER The total number of applications stopped due to process throttling during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled)

© 2004 Microsoft Corporation. All rights reserved.