IIS Home @ it-notebook.org

Incorrect date and time stamp for IIS log file entries

(Kristofer Gafvert, January 1, 2005)

If the selected log file format is W3C Extended Log File Format[1], the date and time stamp in the IIS log files is in GMT. GMT can be several hours ahead or behind when you compare to the local time (depending on where you are), thus the time in the log files can seem to be incorrect. According to W3C Working Draft WD-logfile-960323 (Extended Log File Format)[2] the date and time should be specified in GMT, and IIS conforms to this.

A decent log file analyzer should be able to change the date and time to local time during the analyzing. The ConvLog utility can also be used to convert the date and time to the local time. ConvLog is located in the %systemRoot%\System32\ folder. A sample is:

convlog -ie ex050130.log -t ncsa:+0100

This will convert the file ex050130.log to the NCSA Log File format[3] and add an offset of one (1) hour. The resulting log file line will look like:

192.168.10.67 - - [30/Jan/2005:09:17:00 +0100] "GET /Default.htm HTTP/1.0" 200 -

Yet another way is to change the logging format to Microsoft IIS Log File Format[4]. To change the logging format, follow these steps:

  • Open IIS Manager
  • Right click the website, and click Properties
  • Click on the "Web Site" tab, if not already selected
  • In the "Active log format" drop-down list, change to another log file format.

Applies to [?]

IIS 6.0

Resources

[1] W3C Extended Log File Format (IIS 6.0)
[2] W3C Working Draft WD-logfile-960323
[3] NCSA Common Log File Format (IIS 6.0)
[4] IIS Log File Format (IIS 6.0)
Command-Line Tools included in IIS
KB271196: IIS Log File Entries Have the Incorrect Date and Time Stamp