Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a stack of IIS logs with the extended logging options:

client ip address
user name
server ip address
server port
uri stem
uri query
protocol status
protocol substatus
Win32 Status
User agent.

How do I figure out what the LogFormat should be within awstats?

Thanks in advance

share|improve this question


# Enter here your log format (Must agree with your web server. See setup 
# instructions in README.txt to know how to configure your web server to have 
# the required log format). 
# Possible values: 1,2,3,4 or "your_own_personalized_log_format" 
# 1 - Apache or Lotus Notes/Domino native combined log format (NCSA combined/XLF/ELF log format) 
# 2 - IIS or ISA format (IIS W3C log format). See FAQ-COM115 For ISA. 
# 3 - Webstar native log format. 
# 4 - Apache or Squid native common log format (NCSA common/CLF log format) 
# With LogFormat=4, some features (browsers, os, keywords...) can't work. 
# "your_own_personalized_log_format" = If your log is ftp, mail or other format, 
# you must use following keys to define the log format string (See FAQ for 
# ftp, mail or exotic web log format examples): 
# %host Client hostname or IP address (or Sender host for mail log) 
# %host_r Receiver hostname or IP address (for mail log) 
# %lognamequot Authenticated login/user with format: "alex" 
# %logname Authenticated login/user with format: alex 
# %time1 Date and time with format: [dd/mon/yyyy:hh:mm:ss +0000] or [dd/mon/yyyy:hh:mm:ss] 
# %time2 Date and time with format: yyyy-mm-dd hh-mm-ss 
# %time3 Date and time with format: Mon dd hh:mm:ss or Mon dd hh:mm:ss yyyy 
# %time4 Date and time with unix timestamp format: dddddddddd 
# %methodurl Method and URL with format: "GET /index.html HTTP/x.x" 
# %methodurlnoprot Method and URL with format: "GET /index.html" 
# %method Method with format: GET 
# %url URL only with format: /index.html 
# %query Query string (used by URLWithQuery option) 
# %code Return code status (with format for web log: 999) 
# %bytesd Size of document in bytes 
# %refererquot Referer page with format: "" 
# %referer Referer page with format: 
# %uaquot User agent with format: "Mozilla/4.0 (compatible, ...)" 
# %ua User agent with format: Mozilla/4.0_(compatible...) 
# %gzipin mod_gzip compression input bytes: In:XXX 
# %gzipout mod_gzip compression output bytes & ratio: Out:YYY:ZZpct. 
# %gzipratio mod_gzip compression ratio: ZZpct. 
# %deflateratio mod_deflate compression ratio with format: (ZZ) 
# %email EMail sender (for mail log) 
# %email_r EMail receiver (for mail log) 
# %virtualname Web sever virtual hostname. Use this tag when same log 
# contains data of several virtual web servers. AWStats 
# will discard records not in SiteDomain nor HostAliases 
# %cluster If log file is provided from several computers (merged by 
#, this tag define field of cluster id. 
# %extraX Another field that you plan to use for building a 
# personalized report with ExtraSection feature (See later). 
# If your log format has some fields not included in this list, use 
# %other Means another field 
# %otherquot Means another not used double quoted field 
# Examples for Apache combined logs (following two examples are equivalent): 
# LogFormat = 1 
# LogFormat = "%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot" 
# Example for IIS: 
# LogFormat = 2 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.