IIS logs location in Windows Server 2003 to 2019(IIS 6 to 10)

Every time a user opens a web page, IIS records user's IP, visited web address, access time, and access status. This information is stored in the IIS log file, which is convenient for website administrators to grasp the web page accessed and iis server operation. If a webpage is maliciously accessed(such as injected into a database), there will be a corresponding record in the log file, and you can see what code the injector uses to inject it, which is convenient for analyzing website vulnerabilities.

IIS logs location are there? Windows system has a special folder to save IIS logs. If it has not been modified, the IIS logs will be saved in this folder; if it has been modified, such as modifying the operating system or modifying in IIS, it is in the new folder. There are two ways to view the IIS logs location(find the IIS log file path), one is to directly go to the folder that save IIS logs by default in Windows to view, and the other is to check the IIS log path in the IIS server, and then open the folder in which save log file according to the path.

I. Method one of viewing IIS logs location: Windows default folder

Since different Windows versions have different IIS log file paths, they are introduced as follows:

Windows Server 2003, IIS 6 log file location: C:\Windows\System32\LogFiles

Windows Server 2008 R2, IIS7 log file location: C:\inetpub\logs\LogFiles

Windows Server 2012, 2016, 2019(IIS8,IIS9 and IIS10), log file location: C:\inetpub\logs\LogFiles

C drive is the system drive. Since IIS will automatically generate a folder to save logs for each site, so the specific IIS logs location is in a subfolder in the LogFiles folder, for example: C:\Windows\System32\LogFiles\W3SVC2 and C:\inetpub\logs\LogFiles\W3SVC1.

II. Method two of viewing IIS logs location: View in IIS server

1. Select the "Start" menu → Administrative Tools(or Windows Administrative Tools) → Internet Information Services (IIS) Manager, open the IIS server window, expand the website that you want to view logs, as shown in Figure 1:

Figure 1

Windows Server 2008 R2, 2012, 2016, 2019: Double-click the "Logging" icon; 

Windows Server 2003: Right-click the website for which you want to view the logs → Properties → "Web Site" tab → Properties → "General" tab.

2. Open the "Logging" dialog box, as shown in Figure 2:

Figure 2

3. The %SystemDrive%\inetpub\logs\LogFiles under "Directory" is the IIS log file path, the path is C:\inetpub\logs\LogFiles in Windows Server 2008 R2, 2012, 2016, 2019; it is C:\Windows\System32\LogFiles in Windows server 2003.

Hint: Press the Windows logo key(four squares) + R to open the "Run" dialog box, copy %SystemDrive%\inetpub\logs\LogFiles to the input box, and press Enter on your keyboard to open the folder where the logs are located.

4. If the website administrator has changed it, it will be a specific path, such as D:\logs.

5. Open this path, you can find the iis log files of the website, double-click a log file to open it with Notepad.