Event ID 1133 — IIS W3SVC Logging

Applies To: Windows Server 2008 R2

An Internet Information Services (IIS) Web server can be configured for Site, Central Binary, or Central W3C logging. In Central W3C logging, all client requests for all sites are logged to a single log file in W3C centralized format on the server. Central Binary logging also logs all sites centrally to a single file, but does so in centralized binary format. In Site logging, all client requests are logged at the site level, not centrally at the server level. These logging types depend on the World Wide Web Publishing Service for their configuration.

Event Details

Resolve

Configure the central logging format

Both centralized binary logging and centralized W3C logging are enabled. Because only one type of logging can be enabled at a time, the system has defaulted to central W3C logging. Use the following procedure to configure either W3C or binary logging.

Note:  If you want to use binary logging, you must perform this procedure.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To configure centralized logging by using IIS Manager:

1. Click Start, click Control Panel, and then click Administrative Tools.
2. Right-click Internet Information Services (IIS) Manager and select Run as administrator.
3. In the IIS Manager Connections pane, select the Web server whose central logging you want to configure.
4. In Features View, double-click Logging.
5. In the Logging window, under One log file per:, make sure that Server is selected.
6. Under Log File Format:, select either W3C or Binary.
7. In the Actions pane, click Apply.

Verify

To verify that logging is working, follow these steps:

• Note the Site ID and test browse the site.
• Check the log file directory.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

Note the Site ID and Test Browse the site

To note the Site ID and Test Browse the site:

1. Click Start, click Control Panel, and then click Administrative Tools.
2. Right-click Internet Information Services (IIS) Manager and select Run as administrator.
3. In the IIS Manager Connections pane, expand the computer name.
4. Click Sites. A list of the server's Web sites appears in Features View on the right.
5. Under the ID column in Features View, note the ID of the Web site for which you want to verify the logging.
6. In Features View, single-click the Web site that you want to verify.
7. In the Actions pane, click the link under Browse Web Site. The Web page for the site should appear.

Check the log file directory

To check the log file directory:

1. Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

2. Navigate to the log file directory. If you are using the default location, type cd %SystemDrive%\inetpub\logs\LogFiles\W3SVCnumber, where number corresponds to the Web site ID that you noted earlier. For example, the site ID for the Default Web Site is typically 1, so the directory name that you type would be W3SVC1.

3. Type dir /od to list the log files. The most recent log file appears last in the list. W3C log files will have the format u_exyymmdd, where yymmdd represents the year, month, and date in six-digit format. The last log file in the list should have today's date and a recent time stamp.

4. Type notepad logfilename to open the last (most recent) log file. Your test browse should have resulted in the log file being created and/or your test browse being logged in the file.

   Note:  There might be a short delay between the time of the test browse and the time that the test browse is logged.

Related Management Information

IIS W3SVC Logging

Internet Information Services (IIS) 7.5