Order of Logged Options

I'm currently using AWStats (www.awstats.org) to analyze our logs and
report. We recently upgraded to Windows Server 2003 (and obviously IIS6) and
I noticed that while the same logging options are selected, the order of
those options has changed! In fact, it doesn't even match the order of
columns shown in the W3C log properties.

What has this changed? Is there some way I can change the order, perhaps by
modifying the metabase or hacking the registry? It's important that this
gets changed because AWStats expects a certain order and, unfortunately,
doesn't include a custom format option for the cs-method logging option (at
least by itself, since it has moved positions).

TIA

--

Heath Stewart, Microsoft MVP
Director of Technology
Proplanner
http://www.proplanner.com

v-wzhang
Wed Feb 11 01:30:18 CST 2004

Hi Heath,

I'm afraid this is not workable. The W3C extended log module is
{FF160663-DE82-11CF-BC0A-00AA006111E0}
\WINDOWS\system32\inetsrv\iislog.dll, which seems hard-code the order
info. There is no additional registry settings to change the order
and I've tested that changing the meta data under /LM/Logging/Custom
Logging/Extended Properties/ doesn't help as well.

IIS 6 online help suggests users create custom logging modules if the
defaults styles cannot achieve some requirements.(See chapter: Custom
Logging Modules)
I reviewed the code sample on MSDN:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/iissd
k/iis/creatingacustomloggingmodule.asp
It was developped for IIS5, which may not work on IIS6 without being
modified.

Anyway, I agree it reasonable to allow users configure the items'
order of the log. If you can submit this as feature request to MS
Wish, it will be much appreciated.
http://register.microsoft.com/mswish/suggestion.asp

Please don't hesitate to post here if you meet any issues on IIS in
future. Our pleasure to be of assistance.
Have a nice day,

WenJun Zhang
Microsoft Online Support
This posting is provided "AS IS" with no warranties, and confers no
rights.
Get Secure! - www.microsoft.com/security

Heath
Wed Feb 11 07:42:12 CST 2004

Thank you for the suggestion. I did consider that and since you mentioned
there no workaround with the existing module, I suppose I'll have to do
that.

Instead of asking on thw wish-list, I'd really rather post it as a bug.
Why - after so many versions of IIS - have they changed it? Did Microsoft
not consider that this will break MANY existing log analyzers? That's why I
consider this more of a bug.

--

Heath Stewart, Microsoft MVP
Director of Technology
Proplanner
http://www.proplanner.com

David
Wed Feb 11 08:22:45 CST 2004

W3C log specifications permits properties to be reordered as long as the
header tells how to interpret the columns. IIS6 does this.

So, this is just a bad bug in AWStats in not following the specifications.

You may try using LogParser as a post-processing step to reorder columns;
there is no IIS configuration for this change -- IIS is totally within
specifications.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Heath Stewart" <nospam.clubstew@hotmail.com> wrote in message
news:uG%23vBo97DHA.3448@TK2MSFTNGP09.phx.gbl...
I'm currently using AWStats (www.awstats.org) to analyze our logs and
report. We recently upgraded to Windows Server 2003 (and obviously IIS6) and
I noticed that while the same logging options are selected, the order of
those options has changed! In fact, it doesn't even match the order of
columns shown in the W3C log properties.

What has this changed? Is there some way I can change the order, perhaps by
modifying the metabase or hacking the registry? It's important that this
gets changed because AWStats expects a certain order and, unfortunately,
doesn't include a custom format option for the cs-method logging option (at
least by itself, since it has moved positions).

TIA

--

Heath Stewart, Microsoft MVP
Director of Technology
Proplanner
http://www.proplanner.com

Heath
Wed Feb 11 08:56:12 CST 2004

I understand that and wasn't trying to imply that IIS isn't within
specifications (I figured any good spec isn't going to be so fixed in
nature), just that IIS has been using the same order for a while and all of
a sudden switched. I agree that AWStats should include a better parser, but
I know they're not the only one.

I'll take a look at LogParser from the reskit. Thank you.

--

Heath Stewart, Microsoft MVP
Director of Technology
Proplanner
http://www.proplanner.com

David
Wed Feb 11 22:57:04 CST 2004

We did not decide to switch it for no good reason. We had technical reasons
for switching the order -- you realize that the entire IIS networking stack
was rewritten in IIS6, so there are tons of behavior change. In cases that
made sense, we preserved (or tried to) the existing behavior. In other
cases where it didn't make sense or was technically challenging for little
benefit, we kept the difference. In cases where the change is erroneous,
there are KB articles and ongoing bugs. In cases where the change is within
reason, we still publish some KB articles.

This would be an instance of the latter case.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Heath Stewart" <nospam.clubstew@hotmail.com> wrote in message
news:%2374Qy8K8DHA.2480@TK2MSFTNGP12.phx.gbl...
I understand that and wasn't trying to imply that IIS isn't within
specifications (I figured any good spec isn't going to be so fixed in
nature), just that IIS has been using the same order for a while and all of
a sudden switched. I agree that AWStats should include a better parser, but
I know they're not the only one.

I'll take a look at LogParser from the reskit. Thank you.

--

Heath Stewart, Microsoft MVP
Director of Technology
Proplanner
http://www.proplanner.com

jcochran
Thu Feb 12 07:25:04 CST 2004

On Wed, 11 Feb 2004 06:22:45 -0800, "David Wang [Msft]"
<someone@online.microsoft.com> wrote:

>W3C log specifications permits properties to be reordered as long as the
>header tells how to interpret the columns. IIS6 does this.
>
>So, this is just a bad bug in AWStats in not following the specifications.

FWIW, Analog has no problems with the IIS log file formats.

Jeff

Heath
Fri Feb 13 11:00:33 CST 2004

Actually, I googled for a workaround with AWStats and found an undocumented
(so far as I can tell) way of simply using the log options themselves in the
LogFormat variable of AWStat's config file (like cs-username). Thanks for
the suggestion, though. I just didn't want to switch if possible so that all
our old log databases generated by AWStats didn't go to waste (and I don't
have time to convert them to a new one if possible).

--

Heath Stewart, Microsoft MVP
Director of Technology
Proplanner
http://www.proplanner.com