IISW3C Input Format Fields
The input records generated by the IISW3C input format contain the following fields:
| Name | Type | Description |
|---|---|---|
| LogFilename | STRING | Full path of the log file containing this entry |
| LogRow | INTEGER | Line in the log file containing this entry |
| date | TIMESTAMP | The date on which the request was served (Universal Time Coordinates (UTC) time) |
| time | TIMESTAMP | The time at which the request was served (Universal Time Coordinates (UTC) time) |
| c-ip | STRING | The IP address of the client that made the request |
| cs-username | STRING | The name of the authenticated user that made the request, or NULL if the request was from an anonymous user |
| s-sitename | STRING | The IIS service name and site instance number that served the request |
| s-computername | STRING | The name of the server that served the request |
| s-ip | STRING | The IP address of the server that served the request |
| s-port | INTEGER | The server port number that received the request |
| cs-method | STRING | The HTTP request verb or FTP operation |
| cs-uri-stem | STRING | The HTTP request uri-stem or FTP operation target |
| cs-uri-query | STRING | The HTTP request uri-query, or NULL if the requested URI did not include a uri-query |
| sc-status | INTEGER | The response HTTP or FTP status code |
| sc-substatus | INTEGER | The response HTTP sub-status code (this field is logged by IIS version 6.0 and later only) |
| sc-win32-status | INTEGER | The Windows status code associated with the response HTTP or FTP status code |
| sc-bytes | INTEGER | The number of bytes in the response sent by the server |
| cs-bytes | INTEGER | The number of bytes in the request sent by the client |
| time-taken | INTEGER | The number of milliseconds elapsed since the moment the server received the request to the moment the server sent the last response chunk to the client |
| cs-version | STRING | The HTTP version of the client request |
| cs-host | STRING | The client request Host header |
| cs(User-Agent) | STRING | The client request User-Agent header |
| cs(Cookie) | STRING | The client request Cookie header |
| cs(Referer) | STRING | The client request Referer header |
| s-event | STRING | The type of log event (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |
| s-process-type | STRING | The type of process that triggered the log event (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |
| s-user-time | REAL | The total accumulated User Mode processor time, in percentage, that the site used during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |
| s-kernel-time | REAL | The total accumulated Kernel Mode processor time, in percentage, that the site used during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |
| s-page-faults | INTEGER | The total number of memory references that resulted in memory page faults during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |
| s-total-procs | INTEGER | The total number of applications created during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |
| s-active-procs | INTEGER | The total number of applications running when the log event was triggered (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |
| s-stopped-procs | INTEGER | The total number of applications stopped due to process throttling during the current interval (this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled) |