Where Are IIS Logs Stored? IIS Log File Location Explained (Windows)

IIS website access logs are stored by default in C:\inetpub\logs\LogFiles\W3SVC<siteID>\, where <siteID> is the site's numeric ID (the Default Web Site is W3SVC1). Files are W3C-format text named like u_ex260601.log (date-stamped). Low-level connection and HTTP.sys errors are logged separately to C:\Windows\System32\LogFiles\HTTPERR\httperr*.log. Per-request diagnostic traces (Failed Request Tracing) go to C:\inetpub\logs\FailedReqLogFiles\W3SVC<siteID>\.

Quick Reference: IIS Log File Paths

The log filename encodes the date and the rollover period: u_ex = W3C UTC daily, u_ex260601.log = the log for 2026-06-01. Hourly rollover produces u_exYYMMDDHH.log.

How to Find the Exact Path for a Site

Because the path is configurable, confirm it rather than assuming:

IIS Manager: select the site (or the server node) → double-click Logging → the Directory field shows the base path; combine it with W3SVC<siteID>.

PowerShell:

# List sites and their numeric IDs
Get-Website | Select-Object Name, Id, State

# Show the configured log directory for a site
Import-Module WebAdministration
(Get-ItemProperty 'IIS:\Sites\Default Web Site' -Name logFile).directory

The directory value often contains %SystemDrive%\inetpub\logs\LogFiles; the actual folder is that path plus \W3SVC<Id>.

How to View and Tail IIS Logs

W3C logs are space-delimited text. Tail the current file with PowerShell:

# Follow the newest log for the Default Web Site
Get-Content 'C:\inetpub\logs\LogFiles\W3SVC1\u_ex260601.log' -Tail 50 -Wait

# Automatically grab the most recent log file in the folder
Get-ChildItem 'C:\inetpub\logs\LogFiles\W3SVC1' -Filter *.log |
  Sort-Object LastWriteTime -Descending |
  Select-Object -First 1 |
  Get-Content -Tail 50 -Wait

# Find all 500-series responses
Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log' -Pattern ' 50[0-9] '

The header lines tell you the column order:

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken

Key fields: cs-uri-stem (path requested), sc-status (HTTP status), sc-substatus (IIS sub-status, e.g. 404.0 vs 404.4), sc-win32-status (Windows error code), and time-taken (ms). Times are in UTC by default.

Configuring IIS Logging

In IIS Manager → Logging (per site or server-wide) you control:

• Format — W3C (default, customizable fields), IIS, NCSA, or Custom.
• Directory — base log path.
• Fields (W3C only) — click Select Fields to add columns like time-taken, cs(Host), cs-username.
• Log file rollover — Schedule (Hourly/Daily/Weekly/Monthly), by Maximum file size, or Do not create new log files.
• Log target — file, ETW event, or both (Windows Server 2012+).

All of this is persisted in applicationHost.config under the site's <logFile> element. Edit it with PowerShell instead of the GUI:

Set-ItemProperty 'IIS:\Sites\Default Web Site' -Name logFile.directory -Value 'D:\IISLogs'
Set-ItemProperty 'IIS:\Sites\Default Web Site' -Name logFile.period -Value 'Hourly'

Log Rotation

IIS doesn't "rotate" in the logrotate sense — it rolls over to a new file based on the schedule or size limit you set:

• Daily (default): a new u_exYYMMDD.log each day at midnight UTC.
• Hourly: a new u_exYYMMDDHH.log each hour.
• Maximum file size: a new sequential file once the current one hits the byte limit.

IIS never deletes old logs automatically, so C:\inetpub\logs\LogFiles grows forever. Clean it up with a scheduled task:

# Delete IIS logs older than 30 days
Get-ChildItem 'C:\inetpub\logs\LogFiles' -Recurse -Filter *.log |
  Where-Object LastWriteTime -lt (Get-Date).AddDays(-30) |
  Remove-Item -Force

If logs use UTC but you operate in local time, check the Use local time for file naming and rollover option in the Logging dialog so file dates line up with your day boundary.

Common Errors You'll Find in IIS Logs

• sc-status 404, sc-substatus 0 — file not found; the substatus distinguishes 404.4 (no handler) from 404.13 (request too large), etc.
• sc-status 401, sc-substatus 2 / 1 — authentication failure; 401.1 = bad credentials, 401.2 = config disallows the auth method, 401.3 = NTFS ACL denies access.
• sc-status 500, sc-substatus 19 — configuration data is invalid in web.config; the app failed to load, not a code crash.
• sc-status 502, sc-substatus 5 — the FastCGI/PHP or out-of-process handler crashed or timed out.
• sc-status 503 with nothing useful in the site log — the application pool is stopped or in rapid-fail protection; the real reason is in HTTPERR\httperr*.log (look for AppPoolUnavailable or Disabled).
• HTTPERR Timer_ConnectionIdle / Timer_MinBytesPerSecond — the client connection was dropped by HTTP.sys for being idle or too slow, not an application error.

Troubleshooting: Logs Missing or Empty

• W3SVC folder is empty or absent — Logging may be disabled for the site, or no requests have hit it yet. Check IIS Manager → Logging is enabled, and confirm the site ID matches the folder.
• Site logs show nothing but users get errors — The failure happens in HTTP.sys before reaching the worker process. Check C:\Windows\System32\LogFiles\HTTPERR\ for 503s and connection drops.
• Times don't match your clock — IIS logs in UTC by default. Convert, or enable local-time file naming/rollover in the Logging dialog.
• Can't open the log folder — C:\inetpub\logs and the Windows LogFiles directory require administrator rights; run your shell or editor elevated.
• Status code is logged but the cause is unclear — Enable Failed Request Tracing: add a rule under the site's Failed Request Tracing Rules for the status code, and read the XML traces in C:\inetpub\logs\FailedReqLogFiles\W3SVC<siteID>\.
• Application-level errors not in IIS logs — ASP.NET exceptions and stack traces are written to the Windows Event Viewer (Application log), not the W3C access logs.