NCSA Common Log File Format
Applies To: Windows Server 2003, Windows Server 2003 with SP1
The NCSA Common log file format is a fixed ASCII text-based format, so you cannot customize it. The NCSA Common log file format is available for Web sites and for SMTP and NNTP services, but it is not available for FTP sites. Because HTTP.sys handles the NCSA Common log file format, this format records HTTP.sys kernel-mode cache hits.
The NCSA Common log file format records the following data:
Remote host address
Remote log name (This value is always a hyphen.)
Date, time, and Greenwich mean time (GMT) offset
Request and protocol version
Service status code (A value of 200 indicates that the request was fulfilled successfully.)
Not all fields will contain information. For fields for which there is no information, a hyphen (-) appears as a placeholder. If a field contains a nonprintable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format. This typically occurs with virus attacks, when, for example, a malicious user sends carriage returns and line feeds that, if not replaced with the plus sign (+), would break the log file format.
Fields are separated by spaces, and time is recorded as local time with the GMT offset.