When the web server has trouble, what do you check first? — Logs. Logging is an indispensable feature that ensures admins have something to use to review the events leading up to an issue. The IIS server on Windows 2022 and earlier versions includes this feature by default unless you explicitly exclude it from the IIS installation.
But how familiar are you with it? Did you know there are several log formats available or that you can move the HTTP logs to another location for better performance and bigger storage space?
Stay tuned and let’s explore how to configure, view and change the IIS logs location.
Table of Contents
Requirements
- Windows Server 2012 with the Internet Information Service (IIS) installed. This post uses Windows Server 2022 with IIS 10.
Checking the IIS HTTP Logging Feature
While the HTTP Logging feature is a default selection during the IIS installation, it may have been left out by whoever installed it. So let’s first check it is installed. To do so, open PowerShell as admin and run the below command.
Get-WindowsFeature -Name Web-Http-Logging
In this example, it is confirmed that HTTP Logging is installed.
But in case it isn’t, you can install it by running this command:
Install-WindowsFeature -Name Web-Http-Logging
Configuring IIS HTTP Logging
So HTTP Logging is enabled. Now it’s time to plow through the configuration items. But before that, you must open the IIS Management console. Here are the ways you can launch it.
From the Server Manager.
From the Windows Administrative Tools folder.
From the Run dialog.
Per Server vs Per Site
You can configure IIS Logs on the server level or per site. As you can see in the next two screenshots, the Logging feature is available on the server and the site separately.
When you choose to enable one log per server:
- The HTTP log will contain the events for all websites on the server.
- The IIS log settings on the server level will be the default settings inherited by each site.
- You cannot customize the logging feature per site anymore.
When you choose one log per site:
- The IIS log settings on the server level will be the default settings inherited by each site.
- You can still customize the logging settings per site, like changing the log format and location.
- Each site will have its separate log file(s).
Log File Format and Location
There are five log formats available to use. Each log file format has different characteristics that may suit your requirements.
Here is the list of IIS log format options.
| Format | Level | Fields Selection | Notes | |||
|---|---|---|---|---|---|---|
| Binary | Per Server | Fixed | This option generates binary unformatted data to the log file. This format conserves memory and CPU resources. | |||
| W3C | Per Server, Per Site | Customizable | The default HTTP logging format. Time is recorded in UTC. | |||
| IIS | Per Site | Fixed | This log format is command-separated. Time is recorded in local time. Empty fields appear as a hyphen (-). Non-printable characters are replaced with a plus sign (+). | |||
| NCSA | Per Site | Fixed | Fields in this log format are separated with spaces. Time is recorded in UTC. Empty fields appear as a hyphen (-). Non-printable characters are replaced with a plus sign (+). | |||
| Custom | Per Site | – | Custom logging cannot be managed in IIS. Choosing this format disables the Logging page. | |||
By default, the IIS log files location is pointed to %SystemDrive%\inetpub\logs\LogFiles, where %SystemDrive% is the operating system drive.
You can change this location by manually typing the new location in the Directory box.
Or by clicking Browse and selecting the new IIS log location.
Because the IIS logs can grow exponentially, especially on busy servers, it is recommended to move the IIS log location away from the OS drive and into a separate disk. You should also consider clearing the old log files to keep the disk usage under control.
Note. Check our guide on how to clear IIS logs on Windows Server 2012 to 2022.
Log Destination
The default IIS log event destination is a log file, no matter which log format you select. But if you choose W3C log format on a per-site level, you can choose from three log event destination options.
- Log file only — writes events to a log file.
- ETW event only — saves HTTP logs to a specific trace log via the Event Tracing for Windows (ETW) service. ETW does not replace a regular event log and usually serves for short-term diagnostics of applications or the system.
Note. ETW event logging is only available on Windows 2012 R2 using the W3C log format. - Both log file and ETW event – send the log entries to both the log file and ETW event.
Log File Rollover Type
The Log File Rollover Type setting lets you define when IIS creates a new log file or not at all.
- Schedule — You can select whether a new log file is created Hourly, Daily, Weekly, and Monthly. The default schedule is daily. This rollover type ignores the log file size.
- Maximum file size (in bytes) — You can set the maximum log file size before IIS creates a new log file.
- Do not create new log files — If selected, IIS will not create new log files. This option will let the existing log file grow. And when you need to perform housekeeping, you will have to stop the IIS service to delete the log file.
For the convenience of analyzing log files, it is recommended to enable the option Use local time for file naming and rollover. But this can be based on your preference or whatever is your logging requirement.
Changing the IIS HTTP Log Location using PowerShell
Moving IIS log location on one or two servers with few websites might be ok to do manually. But in multiple IIS server deployments, automation is the best way to go. Fortunately, you can do the same with PowerShell.
IIS comes with the WebAdministration PowerShell module. This module, when imported, adds a PSDrive called IIS into the session.
Say you have one website called ‘Default Web Site 1’. To change its log file location to L:\IIS_Logs, run the below command in PowerShell.
Import-Module WebAdministration Set-ItemProperty -Path 'IIS:\Sites\Default Web Site' ` -Name logFile.Directory ` -Value 'L:\IIS_Logs'
Then confirm that the IIS log location has changed.
Get-ItemProperty 'IIS:\Sites\Default Web Site' ` -Name logFile.Directory.Value
Conclusion
Configuring, viewing, and changing the IIS log location on Windows Server 2022 is a straightforward process that can help you manage your server resources more efficiently. By modifying the default log location, you can avoid filling up the system drive and improve performance.
You can choose to store the logs on a separate drive or partition, making it easier to manage and analyze the data. Additionally, by understanding the various log formats and fields, you can gain valuable insights into your website’s traffic and performance.
With the help of this guide, you should now be able to easily configure, view, and change the IIS log location on your Windows Server 2022 server.
