Find IIS site logs and HTTPERR logs

IIS site logs normally live under %SystemDrive%\inetpub\logs\LogFiles, often C:\inetpub\logs\LogFiles. In the usual per-site W3C configuration, each site has a directory such as W3SVC1 or W3SVC2. Confirm the actual configuration before assuming a missing default directory means logging is broken.

HTTP.sys has a separate error log, normally under %SystemRoot%\System32\LogFiles\HTTPERR. It can explain kernel-level rejections, queue failures, and connection timeouts that do not appear as ordinary site requests. It is not a replacement location for the site's access log.

Distinguish the two layers

A site log can include successful responses and errors such as 404 or 500. HTTPERR covers HTTP.sys behavior; it is too narrow to describe every entry as a request rejected before entering IIS. For example, an idle keep-alive timeout is a connection event, not necessarily an application failure.

Check the active directory in IIS Manager

1. Open IIS Manager and select the server or site.
2. Open Logging in the IIS feature view.
3. Inspect the configured directory, format, and logging options.

Site settings can override server defaults. Also account for centralized logging or another selected log format.

Match a directory to a site

The number after W3SVC is the site ID. Select Sites in IIS Manager and compare the ID column with the directory name.

Request a test URL that you can identify uniquely, then allow for log buffering and confirm which file receives it. A query-string marker is useful only if the relevant query field is enabled. For Guance, configure DataKit file collection for that location and validate parsing against the W3C #Fields header. Match the status, URI, and duration back to the raw entry.

Frequently asked questions

Why is the directory empty?

Confirm logging is enabled, the HTTP Logging role service is available, and requests reach this particular server. A load balancer may route your test elsewhere. Also check the configured destination, permissions, buffering, and whether enough time has passed for a write.

Why are timestamps eight hours behind local time?

W3C record timestamps use UTC. Convert them in the analysis tool. The setting for local-time file naming and rollover does not change the W3C record timestamps themselves.

What does Timer_ConnectionIdle mean?

HTTP.sys closed an idle connection after its timeout. This can occur with ordinary keep-alive traffic and is not, by itself, proof of an outage. Investigate it alongside failed requests and unusual changes in volume.

References: IIS logging settings and Microsoft's explanation of idle-connection entries.