Incorrect date and time stamp for IIS log file entries

ID: 62
Created: 2005-01-01
Updated: 2005-06-19

If the selected log file format is W3C Extended Log File Format[1], the date and time stamp in the IIS log files is in GMT. GMT can be several hours ahead or behind when you compare to the local time (depending on where you are), thus the time in the log files can seem to be incorrect. According to W3C Working Draft WD-logfile-960323 (Extended Log File Format)[2] the date and time should be specified in GMT, and IIS conforms to this.

A decent log file analyzer should be able to change the date and time to local time during the analyzing. The ConvLog utility can also be used to convert the date and time to the local time. ConvLog is located in the %systemRoot%\System32\ folder. A sample is:

convlog -ie ex050130.log -t ncsa:+0100

This will convert the file ex050130.log to the NCSA Log File format[3] and add an offset of one (1) hour. The resulting log file line will look like:

192.168.10.67 - - [30/Jan/2005:09:17:00 +0100] "GET /Default.htm HTTP/1.0" 200 -

Yet another way is to change the logging format to Microsoft IIS Log File Format[4]. To change the logging format, follow these steps:

Open IIS Manager
Right click the website, and click Properties
Click on the "Web Site" tab, if not already selected
In the "Active log format" drop-down list, change to another log file format.

Incorrect date and time stamp for IIS log file entries

Link(s)