Where Are IIS Logs Located

IIS logs provide critical visibility into your web server's interactions, from user requests to server response times. These logs are vital for diagnosing issues, monitoring performance, and improving website reliability. Understanding how to locate and leverage these logs is essential for maintaining a high-performing web infrastructure. This information can include:

• Time and date of the event
• Who made the request, both IP address and authenticated user (if any)
• The particular page requested and query made
• What agent was used
• Status and error codes, if any
• Time it took to respond

Administrators can choose the log format, such as IIS, W3C, or NCSA, using the IIS Manager application. Although W3C allows admins to choose what to log, NCSA and IIS formats cannot be changed. With IIS monitoring, the more data that is logged, the more insight administrators and developers can glean from those logs.

If you're wondering what IIS logs look like, here is an example in W3C format:

#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2025-02-18 23:41:30
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2025-02-18 23:41:27 127.0.0.1 GET /inetpub/davidsbuick/home.htm - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:135.0)+Gecko/20100101+Firefox/135.0 - 404 0 2 63
2025-02-18 23:41:29 127.0.0.1 GET /inetpub/davidsbuick/home.htm - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:135.0)+Gecko/20100101+Firefox/135.0 - 404 0 2 0
2025-02-18 23:41:29 127.0.0.1 GET /inetpub/davidsbuick/home.htm - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:135.0)+Gecko/20100101+Firefox/135.0 - 404 0 2 0
2025-02-18 23:51:13 127.0.0.1 GET /DavidsBuick - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:135.0)+Gecko/20100101+Firefox/135.0 - 404 0 2 67
2025-02-18 23:51:13 127.0.0.1 GET /favicon.ico - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:135.0)+Gecko/20100101+Firefox/135.0 http://localhost/DavidsBuick 404 0 2 0

IIS Log File Locations Across Different Platforms

Web properties are often distributed across multiple servers and even multiple platforms, such as dedicated servers and cloud services. As a result, multiple IIS logs for different web properties can be siloed across those servers and platforms. Here's how to find log locations across various infrastructures.

How to find IIS log files on IIS 7 and later

1. From the Start Menu enter "inetmgr" in the search field. Alternatively, click the Internet Information Services (IIS) Manager shortcut under the Windows Tools in the All apps menu for Windows 11. (Your location may differ, depending on what Windows you are using).
2. In the left side of the window that appears, expand the tree and click on Sites to see a list of sites on the local server.
3. In the right side of the window, click on the ID number of the site you want to investigate. Logs are saved by site ID.
4. Double-click the Logging icon to see logging settings. Under the Log File section, you can see the log directory and the log format.
5. Either click on 'View Log Files…' in the Actions list on the right side of the screen or navigate to your IIS log files directory using the directory Explorer.
6. Find the subdirectory ending with the ID number of the site you want to investigate and open the directory. The number at the end of the folder name corresponds to the site ID.

How to find IIS log files on IIS 6 and earlier

1. From Windows Start, hover over Administrative Tools and click on Internet Information Services (IIS) Manager.
2. In the left-hand tree, expand the name of your server's folder, then right-click on your site and select Properties.
3. The log file directory is listed under the Active Log Format section, usually %WinDir%\System32\LogFiles.

How to find IIS log files on Azure

Log file locations differ between Azure Cloud and Azure App Services.

Azure cloud

IIS log files are automatically saved in Azure Cloud Services.

1. Using the Remote Desktop, connect to the specific server you are investigating.
2. Log files are stored in a path similar to
   C:\Resources\directory\{some random guid}.{app name}.DiagnosticStore\LogFiles\Web\W3SVC{random number}

Azure app services

1. Ensure that web server logging is enabled.
2. Set web server logging to save to the file system.

Access the log files using the KUDU console. The files will be located under
D:\home\LogFiles\http\RawLogs via.

What to Do If You Still Can't Find Your IIS Logs

There are other services that deal with HTTP requests before the IIS server. If you cannot find an appropriate log file, it's possible the interaction never hit the IIS server. Or, logging-or the site-might not be running.

How to check if the site is running

On the left sidee of the window that appears, expand the tree and click on Sites to see a list of sites on the local server.

1. Click on the desired site and verify that Restart or Stop are active under the Actions menu on the right. If Start is active, the site is not running. Click on Start to run it.

How to check if IIS logging is enabled

1. From the Start Menu enter "inetmgr" in the search field. Alternatively, click the Internet Information Services (IIS) Manager shortcut under Windows Tools on the All apps menu (Windows 11).
2. In the left side of the window that appears, expand the tree and click on Sites to see a list of sites on the local server.
3. In the right side of the window, click on the ID number of the site you want to investigate. Logs are saved by site ID.
4. Double-click the Logging icon.
5. Under the Actions menu on the right, if Disable is shown, logging is enabled. If Enable is shown, logging is disabled. Click on Enable to start logging.

In later versions of IIS Manager, logging starts immediately on a change to status. You don't need to restart the site. To check if logging is running, navigate to the site's log directory and look for a new log file. It might take a few seconds to appear, depending on traffic. If a log file does not appear, return to the site's section under IIS Manager and click on Restart under the Actions menu.

Other places to look for errors

HTTPERR

Before reaching the IIS server, incoming requests are handled by HTTP.SYS. So, it is possible that the request you are looking for never made it to IIS, or IIS wasn't running. Common errors ending up in HTTPERR include:

• 400 Bad Request
• Timeouts
• 503 Service Unavailable and similar types of issues

If IIS is running, check the HTTPERR log at C:\Windows\System32\LogFiles\HTTPERR

Look for ASP.NET core exceptions in Windows Event Viewer

By default, ASP.NET Core will log unhandled 500 level exceptions to the Windows Application EventLog. The ASP.NET Core Health Monitoring feature handles these types of errors. Unfortunately, the number of errors written to the Application EventLog is rate-limited, so an error of interest might not be there. But, it offers IT managers another place to look.

Use Failed Request Tracing (FRT) for advanced IIS error logging

If you still cannot locate an error, you can activate Failed Request Tracing (FRT) for robust IIS logging. Enable FRT in the IIS Manager. (You may need to install it first). You can configure rules for all requests, slow requests, or just certain response status codes. FRT tracks every detail and step of the IIS pipeline, thus it is rich with data and can take time to decipher the logs.

IIS Logs Best Practices for Real-Time Monitoring

IIS logs update continuously when active, potentially creating large, somewhat unwieldy log files to manage. The Logging section of your site can not only specify where to locate log files, but this section can also be used to constrain the size of your log files to make them more manageable. To help manage the impact of logs on your infrastructure, you can:

• Locate the log files off site or in a central location by specifying a common directory path.
• Change the Log Event Destination-log file only, ETW (Event Tracing for Windows) event only, or both.
• Schedule log file rollover by a schedule or file size.

Selecting items you want to log can help you more easily pinpoint problems. But, unless you use W3C logging format, you cannot select the items you want logged. IIS and NCSA formats are not changeable. Many administrators set times to manually review logs for potential security threats and performance issues.

Using a dedicated log management tool can simplify log file analysis. IIS, New Relic's log monitoring and analysis agent incorporates dashboards and configurable alerts to easily detect changes that can signal a problem and help you resolve issues faster.

New Relic's IIS services provide rich, robust features that reduce the complexity of analyzing multi-site, distributed logs. The IIS monitoring tool automatically collects log data and measures web server performance from logged data. Teams get real-time insights that help troubleshoot potential issues and optimize web server performance. The IIS tool helps you:

• Identify security breaches, DDoS attacks, and other issues
• Track response times
• Reduce bottlenecks and increase throughput to improve performance
• Locate slow SQL queries
• Troubleshoot problems with visuals that offer quick insights
• Streamline data analysis and identify patterns

Next steps

Get started monitoring IIS logs in real-time

Web properties are often distributed across servers and platforms with their log files siloed in a variety of directories. As a result, this scattered, siloed approach can make it more difficult to find the right error logs and take fast action to remedy them.

Consolidating log analysis with New Relic IIS simplifies the difficult tasks administrators face when optimizing website, giving them a clearer view across siloes in a single dashboard. This visibility enables organizations to make the most of their time and resources when working across a variety of distributed infrastructures. The result? Less downtime, fewer errors, and increased customer satisfaction.

Ready to simplify IIS log analysis?. Contact us today to get started.