What is IISLogs?

A program to help administrators and developers easily manage log files created by Internet Information Server 5.0, 6.0, 7.x and 3rd party programs.  IISLogs provides configurable options compressing files using ZIP format, and/or just deleting files after a configurable setting.  Another benefit you don’t have to write or maintain custom scripts.   This goes with our motto of Install, Configure, Forget!

How do I get a copy of the IISLogs?

Visit IISLogs evaluation webpage

What platforms will IISLogs run on?

Windows XP SP3, Windows 2003 SP2, Windows 2008 and greater, Windows Vista, Windows 7.

What version of .NET Framework needed to run?

.Net Framework 4.0

What are the main *features* of IISLogs?

There are many options to configure IISLogs, each option provides their own configurable settings to provide flexibility.  The first option will allow for monitoring one or more specific directories (c:wwwLogsw3svc1mySite).  An additional option will monitor entire directory structures. 

Either option will compress and/or delete files based on configured settings.  IISLogs can be setup to just compress files and/or delete files in the same directory structure.  What we mean by directory structures? 

This is simple, by default, Internet Information Server puts web log files in %SystemRoot%System32Logfiles or %SystemDrive%InetpubLogsLogfiles directory with several sub-directories below. There could be sub-directories for FTP, SMTP and WWW services; they might be named such as (MSFTPSVC1, SMTPSVC1, W3SVC1, W3SVC2 etc.).  This option provides to monitor all of these sub-directories.  If your running many websites on the same server, you might have configured IIS to store these log files in a different directory IE D:wwwlogs).   IISLogs can monitor custom directory structures also.   

The second feature is to monitor the directories associated with the Microsoft SMTP Service.  If your web applications use this functionality, these directories fill up with un-needed files. This feature is simple; it deletes files after a certain configurable date.  This SMTP feature
is effective in helping keep those directories free of 1000’s of bad emails and old files. 

The third feature is similar to the SMTP option; it will monitor specific directories and delete files based on its own configured setting.  Why does IISLogs have this option when it can be setup in the first option?   First of all, this option monitors just single directories not entire directory structures like the first option does.  There are occasions where certain directories need to have different retention periods that other directory structures.  This option provides for this very situation. File Naming Options allows for someone to control what the ZIP file is named.  This is available in both the Stand-Alone and Windows Service version.  Introduced in IISLogs 2.0, IISLogs offers an option to have Per Directory settings using the PerDirectory feature. The PerDirectory feature allows on a per folder basis to have its own set of settings.

Starting in IISLogs 2.0, we introduced a feature called PerDirectory.  The PerDirectory option provides the ability to control compressing and deleting files on a per folder basis.  Within the PerDirectory option, we added an option to process files with no extension or ‘unknown’ extensions. This can be useful when 3rd party products have their own naming convention. Additional in IISLogs, we added functionality to run IISLogs in IISLogsGUI.  Another requested feature was an ‘Auto-Add’ option. If configured, every time IISLogs executes, the ‘Auto-Add’ feature queries the local metabase for new sites, if found IISLogs will process the new folders and add them to the configuration file.

Starting with IISLogs 4.0, another feature called ZipFile Storage preference.  There are three options (Daily, Weekly, Monthly).  This has been a very popular request among clients.  The ZipFile Storage preference is available both IISLogs Classic (SpecificDirectories, Advanced Dir Config and PerDirectory feature.  Another option is when IISLogs compresses a file stored in an alternative location, either a different directory on the same machine or UNC path. By default, IISLogs preserves the original folder path when writing to disk.  For example, if store your IISLogs on c:inetpublogslogfilesw3svc1, when a file is stored, keeps the original log path.  When you disable PreserveDirPath, IISLogs will not retain the original folder path and write to the root of the alternative folder path.

For more information on IISLogs 4.0 features, check out.

Will IISLogs monitor multiple directories?

It can monitor multiple directories or a single directory, the preference is yours. The SpecificDirectories monitors a specific folder.  The AdvancedDirConfig monitors an entire folder structure.   The PerDirectory offers the same option, either an individual folder or and be recursive.

How much will IISLogs cost?

Visit our purchase page,

Will IISLogs run as a Windows Service or a stand-alone EXE?

There are two versions (IISLogs Stand-alone EXE (.NET console application) and IISLogs Windows Service).

Will IISLogs require running as an Administrator credentials?

This has to be worked out with your configuration, the default architecture is not to require running as an Administrator when using IISLogsEXE or IISLogsSVC.  If you are using IISLogsEXE, it will require permissions to the directories where log files are configured.  IISLogsSVC is set to run as SYSTEM.  IISLogsSVC can run as a non-Administrator if the account the service is running as needs permissions to files and folders where log files are stored.

Does IISLogs read the IIS Metabase to get any IIS settings?

Yes, using the IISLogsGUI, part of the IISLogs suite has a feature called EasyConfig that will read the metabase and automatically configure the required specific Directories.  To use this feature on Windows Server 2008 and above, the IIS 6 Metabase Compatibility role service needs to be installed.

Can I turn off detail logging?

Yes, this will reduce the need to receive a daily email on what happened on that particular machine.  This is only recommended if you want IISLogs to run and not be notified about what is happening on the machine.

Will IISLogs run if I *JUST* xcopy the IISLogs directory to another server without running setup.exe?

You can xcopy the IISLogs directory to another server without running the setup.exe as long as a few things are done.  IISLogs is designed to be very easy to distribute and setup on many computers without installing on every machine.  The xcopy option would be mainly used with IISLogsEXE, which is a .NET based console application. 

For IISLogsSVC, you would need to install the service, then xcopy the IISLogsSVC.exe.config configuration file to each server.  After the xcopy for IISLogsSVC, I would recommend testing if service needs to be restarted.   Here are a few additional items to keep in mind.

1) The server getting the files copied to is setup setup the same or similar as the original server.  The biggest thing is where logfiles are stored.  From experience, companies with a lot of web servers typically store log files in a central directory (such as D:Logfiles or D:wwwlogs). 

2) Below the InstallDirOfIISLogslogsPolicyAgreements directory is copied too.  This is a security mechanism built into IISLogs to insure the administrator has reviewed and tested their configuration before deploying to a production environment.  IISLogs won’t ZIP or Delete files without these files being present.

3) The IISLogsEXE.exe.config or IISLogsSVC.exe.config has the appropriate log file paths on the target server.  

If you have further questions how to automate distribution of IISLogs without having to manually install on every machine, please contact [email protected]

Can I edit IISLogs configuration files using a text editor? (IISLogsEXE.exe.config, IISLogsSVC.exe.config, IISLogsPerDirectory.xml, (IISLogs40) and SampleZipPerDirectory.xml (IISLogs 2.0))?

Yes, except for the MailUID and and MailPWD values which ONLY can be done through IISLogsGUI.  These values are stored in an encrypted format. 

How do I unzip or un-compress several zip files so I can re-run my web stats program?

You can use the built-in Windows ability to highlight and un-compress all ZIP files residing in the log file directories.

I wanted to know if IIS Logs causes any system issues when installed on a Terminal Server.

There should be no issue running IISLogs on machined configured as Terminal Services or Remote Desktop Service.  If you prefer, you can xcopy IISLogsEXE and schedule with task scheduler, no installation is required, unless you are looking to run IISLogs Windows Service version.  The assumption if you xcopy, just install on a separate machine.

The instructions say to copy the full version lic.xml file to the license folder

After you purchase IISLogs, a welcome aboard message will be sent which includes a file called ‘lic.xml’.  You’ll copy the file to IISLogsInstallPathLogsLicense. 

What is ‘ZipFilePath’ and ‘Monitor ZipFilePath Directory checkbox’ do exactly?

The ZipFilePath tells IISLogs where to store log files. The default is “local”, which keeps files in the same folder where original logs were created. You have IISLogs configured to store on a remote system. IISLogs was designed to allow many servers write to a remote server into separate folders. It appends the computer name and original folder path. 

For example, if you servers named Web1, Web2 and have logs configured to store locally.  You install IISLogs on each system and configure to store files a remote system. You’ll see the original folder path below a folders named Web1, Web2. This allows for a web-farm to write to a central SAN or NAS. Since the IIS site id is the same across a web-farm, trying to have multiple servers write to a single location would be tricky. The way IISLogs is designed, it helps with this situation.

The Monitor ZipFilePath checkbox will monitor the remote location to compress and delete files where files are centrally stored.

I need to deploy IISLogs to a farm of web servers. Is there a way possible to deploy IISLogs as a silent installation with a pre-configured config file so that they all have the same configuration?

IISLogs uses MSI based installer which provides a /passive switch.  For example, you can run IISLogsSVC.msi /passive and it installed the service with the default configuration.  As far as a pre-configured file, you could be able to send out a pre-configured file setup on a "gold machine".  One of the design goals of IISLogs is to provide xcopy and truly install, configure and forget.

Our web servers tend to have varied folder structures. Within C:Windowssystem32logfiles, the W3SVC folders can be numbered normally (1, 2, 3. etc), but I have seen folders with non-standard names (e.g. C:Windowssystem32logfilesW3SVC987654321). Is there any way to use the Per Directory feature to *only* target W3SVC folders?

We’d recommend using the PerDirectory feature or look at using the Auto-Add feature. The one requirement to use the Auto-Add feature on Windows Server 2008 is the IIS 6.0 metabase compatibility role service needs to be installed. Every time IISLogs executes, it’ll determine if a new site needs processing, if new sites are added, it reads from the metabase to get the log directory. The Per Directory feature is a very powerful and flexible option. I’d check out this article on Per Directory.

Per Directory Article

Check out the FAQ, there is some descriptions of how Per Directory works.

Auto-Add options

IISLogs is deployed to all the web servers in our environment. If I needed to make a global configuration change, what steps would this entail? Would I have to create a batch file that 1) Copy the config file to all servers and 2) restarts the IISLog service? Am I missing anything in this process?

There shouldn’t a need to restart the service, just copy the new config file with a batch file. IISLogs service is designed to look for changes every time it runs. If you copy a new configuration file, the changes won’t be picked up until the configuration file is reviewed by the service.

What is the expected behavior if I have both "Enable ZIP Feature" and "Enable Delete Feature" selected? I was expecting the application to first zip the log files to the UNC path I specified and then it would delete the files based on the "Delete Files Older Than" parameter (which I set for an hour after "Zip Files Older Than"). But it appears to be deleting the files before doing any archiving and transport of the files to the remote location. Is this correct?

The logic IISLogs performs if you have both ZIP and DELETE options enabled, IISLogs will determine if a file needs to be ZIPPED OR DELETED based on the configured settings. If the DELETED option is determined to happen, IISLogs just deletes the file. In our testing, we set the ZIP option to 48 hours, 49 hours to delete. The test files were several months old. IISLogs assumes to remove the file, which is the same as your configuration. When a person is initially implementing IISLogs and log files are older than their preferred settings, it’ll take some time to have everything come into line. I can understand your assumptions. You’ve helped us realize articles, documentation need to explain the logic in a more clear fashion.

What we would recommend would be to configure ‘ZIP’ only and not the delete portion until later on.

I get an error when trying to add a directory to Per Directory feature. Here is the error “Per Directory, Column ZipFilePath contains an invalid path, please correct and try again”.

The error is occurring because IISLogsGUI validates the folder path. The folder mentioned is not created most likely. You can create the folder path ahead of time so IISLogsGUI will work.

I was playing around changing different config settings to see how they would work and configured the ‘PerDirectory’ settings. Now when I got to remove those settings to use the ‘Specific Directories’ or ‘Advanced Dir Config’ settings, it will not let me clear out the ‘per directory’ settings. I get validation errors and it complains about there not being a path after I remove it.

Here is an explanation of how “SpecificDirectories” and “AdvancedDirConfig” work compared to “PerDirectory”. When IISLogs 1.0 was designed, we only offered “SpecificDirectories” and “AdvancedDirConfig”. When settings were applied for compressing or deleting files, all folders inherited the same settings and was stored in IISLogsSVC.exe.config (Windows service version), IISLogsEXE.exe.config (IISLogs Stand-Alone EXE).

In IISLogs 2.0, we added Per Directory to allow more flexibility. The configuration for Per directory is stored in SampleZipPerDirectory.xml within the IISLogs install folder. The “SpecificDirectories” and “AdvancedDirConfig” configuration is stored in IISLogsSVC.exe.config or IISLogsEXE.exe.config.

Is there a way to run the service monthly, like on the 1st of every month, and perhaps zip all the IIS logs for the month into one zip file? So far I see that it runs daily (or multiple times a day), which may be just fine if that’s our only choice.

Introduced in IISLogs 4.0, we support three options (Daily, Weekly, Monthly).  Please visit our help section for more information.

Regarding running IISLogs service on a monthly basis, IISLogs Service edition was designed to run on a daily basis. One workaround you could do is set IISLogs configuration to compress files older than 30 days. IISLogs would execute every day, no files would be impacted.

If you prefer to only execute once a month, we recommend using IISLogsEXE (stand-alone exe) and an external task scheduler (windows task scheduler for example). We offer clients the ability to mix and match which versions of IISLogs they use and you don’t have to use one or the other.

The ‘PerDirectory’ option is nice because it allows choosing an archive directory for each individual IIS folder. The issue I found inside the archive folder where it places the zip file, it also includes the whole path where the original log file was located. So if it was under E:logsW3SVC, and I choose to drop the zip file in the archive folder under that at E:logsW3SVCarchive, it then drops the file in the following path: E:logsW3SVCarchivelogsW3SVC.

IISLogs “preserves” the original folder path when writing to either locally to an alternate location or a remote file system. One of the design principals was to allow web-farms to write to a single remote location. When working in web-farms, the site ids are the same so we designed IISLogs to help multiple machines to write to a single location. One thing you’ll notice is the ‘machine name’ is included in the alternative folder path. In the PerDirectory option, you can turn this off, but the original folder path is preserved.

In IISLogs 1.0 and 2.0, there is no way to ‘remove’ the ‘original’ folder path when moving the zip to an alternative location (either local on disk or remote system). 

Introduced in IISLogs 4.0, we have enabled within the PerDirectory feature to disable folder paths being preserved.  Please see our help section for a more detailed explanation.

I wanted to know if I can add other directories that are non-IIS based. An example is I have other products that write many log files in * .txt format I would like to zip up and then delete. Can IISLogs work this way?

IISLogs handles files based on file extension. We have an extra configuration for .txt based files. When you configure the directory, or sets of directories containing .txt extensions, you would enable the .txt file extension. In IISLogsGUI, you would see .txt available per the link below.

I also would like to delete SharePoint server logs.  Can IISLogs handle this?

IISLogs can also handle SharePoint logs. You would need to configure the directories where SharePoint is storing logs.

How do I configure IISLogs Windows Service version to ignore today’s log file and proceed with the rotation of yesterday’s log file?

IISLogs uses the "LastWriteTime" property to determine when a file will be processed. I would recommend is zip files that are older than 25 hours. Using 25 hours, it’ll leave the current active log along, zip previous files that are approximately one day old. IISLogs is designed to zip files one hour older. IIS has a setting to roll logs on a per hour basis, although the default is 24 hours (1 day).

We want to relocate our log files as well as archive them. We have a web farm and multiple application servers. We want to configure the application to copy the log files to one (for statistical analysis), zip said log file and move it to another server (archival), then delete the log file from its current location (house-keeping). Is this possible with IIS Log? If so, what are the settings?

IISLogs out of the box will not ‘move’ files without zipping to a remote location. I had a similar requirement to what you described. I wrote a utility to ‘move’ files based on IISLogs technology. What you could do is use this utility to move files to a remote location. There is no extra cost for this utility. Then you could use IISLogs to process files on the ‘statistical analysis’ server, and then move to your ‘archival’ server.

IISLogs 4.0 offers two options to move files to a remote location.

1) You can use our per directory feature. Here is an article for more information.

2) The second option is described in an article how-to setup on a remote server.

Both options you’ll have to define the local directories and remote location using a UNC format. The PerDirectory option allows for moving to multiple locations. The second option only allows files / folders to a single remote location. The account running the service will need appropriate permissions on the ‘number crunching’ and ‘archiving server’. Let us know if you have any further questions.

Does IISLogs support UNC paths? We essentially want to pull the logs back to a central server and archive them.  

IISLogs can archive files on a remote server. Here is an article I wrote that explains how IISLogs moves files to a remote share.

Does IISLogs support using FTP of zip files to remote locations

IISLogs uses traditional windows file and print sharing to copy to remote machines.

Will IISLogs zip a log file to a remote location that is not an IIS Log file? I believe the idea is to possibly use the tool on a webmail/exchange server. What are your thoughts on using the tool for this purpose? I can see in the help files this appears to be supported. I’m not sure how permissions would work. I did not see where I can provide a domain user and pw for remote copying. If this is the case then I guess an open share is the only other option?

IISLogs can process a file and folder on a remote location. IISLogs will first zip the file locally, and then copy the file remotely. If there is an error copying remotely, the file stays locally on the source server. I put a link to an article how to zip to a remote share. We do not store credentials in IISLogs. IISLogs relies on the operating system. For example, if you are running IISLogsEXE and a scheduled task, the user of the scheduled task needs permissions remotely. If you are using the Windows Service, the user IISLogsSVC runs as needs permissions remotely, which usually a domain account. IISLogs will first zip the file locally and then move the file remotely. If there is an error moving remotely, the file stays locally on the source server. IISLogs does not ‘copy’, it ‘moves’ the file.

IISLogs is really an all-purpose log processing tool; the architecture is based on file extension. We have customers using IISLogs for mail server software, sql server backups and other non-IIS related products.

One of our security checks is to not process standard file system extensions. We have a feature called ‘process unknown’ extensions, this allows for processing files that don’t have an extension, something that stamps a standard date time (filename.20090916) for example.

The extensions from the exchange box are .txt and .log files.  Just enable the .txt extension. .Log is already being processed.

Does the service have to be installed on every server I want to manage the logs?

The design of IISLogs is to run on every server. In theory, you could run IISLogs on a single machine and process logs remotely. I would suggest you test this type of implementation before proceeding with production. If the remote machine has permissions on the remote server, it should be able to compress and / or delete files. In the file path, you would put an UNC location vs. a local file path.

I have a question for you concerning the naming conventions. The files are zipped and are copied to for example \servernamelogfilesw3svc### Is there any way to rename the destination directory to any text other than w3svc### for example the DNS name so that the tool will continue to function as designed. So our customers can browse to their log files to retrieve them without the support staff having to correspond the WebID to the customer web site logs.

IISLogs does not have the flexibility to name the remote folder to a custom name. One workaround would be to create a ‘friendly’ virtual folder name in the customers website pointed to the folder with the name. This would provide a way to lower your administrative costs and provide a friendly name to your customer.

Can you tell me more about the custom naming convention?

Here is a link to the help file.

Click on File Naming Convention configuration options. This allows you to change the format of the file.

Does IISLogs write to the registry?

Kind of sort of, when you are using IISLogsGUI, when you click the open dialog folder, it stores IISLogs 4.0 configuration settings to

When I specify the directory to put the zipped log files, I specified c:websitelogs It placed the zip in the following location:

Is there any way it can be set to simply put the file here:
or even or something?

You are referring to ZipFilePath Directory path variable.  This variable is designed to centralize all logs on a UNC path. It can be used to centralize logs locally on the same computer also. Regarding the \ This is done by design for companies that want to have multiple machines writing their logs to a central location. The file location will be automatically appended including the computer name. The PerDirectory feature in IISLogs 4.0 allows you to decide if you want the computer name and original folder path included on the remote file / folder names.

Every time I run IISLogsGUI, it requires me to select the config file. Is there a way to create a shortcut and specify where the config file is as command line parameter?

This is the default behavior of IISLogsGUI. You’ll be asked for the configuration file every time you open IISLogGUI. There is no command line parameter or registry entry to have IISLogsGUI remembers the last config file.

Is there an easy way to automate IISLogs via the scheduler or command line?

The service version has a built-in timer feature that would automate scheduled tasked. IISLogs Stand-Alone EXE needs to use a 3rd party scheduler program, such as Windows Task schedule.

Here is a sample command line to create a scheduled task on Windows Server 2008 and greater

%SystemRoot%System32schtasks.exe /create /RU MachineNameUserName /RP "*******" /SC Daily /TN "Zip Logs Daily" /TR "D:UtilsIISLogsEXE4IISLogsEXE.exe" /ST 03:00 /SD 01/03/2023

Is there a way to do recursive searches for logs within folders?

We support deleting / compressing files using a recursive feature. We don’t have the ability to perform just searches recursively.

Can I get a utility to restore all folders? We started doing this manually but with over 100’s of websites with years of history this is impossible. I just need to restore everything long enough to run "snap-shots" or otherwise analyze the traffic from time to time..

We don’t have any method of using IISLogs to ‘unzip’ logs in several directories.  I would recommend a VBS script potentially with the WinZip command line utility.

Does IISLogs support zipping each days log file individually and moving them to a secondary folder then deleting the original file?

IISLogs 4.0 introduced an architecture change how files working with zip files written to alternative locations  In previous IISLogs versions, IISLogs would compress the file locally, then move to an alternative location. 

In IISLogs 4.0, to support ZipFile Storage preferences (Daily, Weekly, Monthly), the file is directly zipped to either the local or alternative location, then the original file is removed if the option to “delete original log file” is selected.

Can IISLogs safely run on a 64bit machines?

IISLogs 2.0, 4.0 are supported on all platforms the .NET 2.0 and .NET 4.0 frameworks will run on, either 32 or 64 bit.  IISLogs 2.0 and 4.0 are currently compiled as 32 bit.

Can you explain ZipRetentionPeriod and DeleteRetentionPeriods?

The logic internally to IISLogs compares the ZipRetentionPeriod and DeleteRetentionPeriod values. If the DeleteRetentionPeriod value is less than ZipRetentionPeriod, the file won’t be processed. This is a safety feature. We made a design decision to never allow the DeleteRetentionPeriod value to be less than ZipRetenionPeriod. The thinking behind this was an administrator would want to zip and retain a file, then delete later. IISLogs is a flexible product. Sometimes things like this happen because we were careful in making sure a file was processed in a certain order.

We’re getting messages in the application log files, can this be turned off?

You can disable messages from being written to the Event log. Here are the steps.

1) Go to the Install folder of IISLogs
2) Open IISLogsEXe.exe.config or IISLogsSVC.exe.config using a text editor such as Notepad.
3) Change the True value to False in this location
<!–Begin EVENTLOG configuration –>
<!–This writes an informational message to the local computers Application eventlog–>
<add key="UseEventLog" value="True" />
<!–End EVENTLOG configuration entries–>
4) Save the file.

After perform this procedure, IISLogs system messages will not be written to the event log.