Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From what little I know about PCI compliance I need to be logging all web site activity and keeping said logs online for at least 3 months. What I have not been able to get a straight answer on, however, is what fields or properties must be included from the Advanced tab in IIS Logging properties. Some seem obvious and need to be included (e.g. date,time,client IP) but others are not so obvious.

Here is this list of available fields (defaults in bold):

  • Date
  • Time
  • Client IP Address
  • User Name
  • Service Name
  • Server Name
  • Server IP Address
  • Server Port
  • Method
  • URI Stem
  • URI Query
  • Protocol Status
  • Protocol Substatus
  • Win32 Status
  • Bytes Sent
  • Bytes Received
  • Time Taken
  • Protocol Version
  • Host
  • User Agent
  • Cookie
  • Referer
share|improve this question
up vote 2 down vote accepted

The ones in bold above are all that are needed for PCI compliance. Basically time/date/what they visited/details about them/respond information.

However, I would enabled all of them except for Cookie and Protocol. Cookie can have cardholder data, so don't add it.

Time taken, bytes, host, referer are all useful columns that you will likely find useful. Log files can be compressed well so it doesn't hurt to have extra data for when you need it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.