Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. inetpub
  3. logs\LogFiles
  4. W3SVC1
  5. u_ex*.log
LogRisk: Safe

u_ex*.log C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log

u_ex*.log: IIS request logs in W3C extended format, one u_exYYMMDD.log file per day; times are in UTC and the columns are described by #Fields.

Updated on By AltF4 Formation

What it’s for

Every request handled by the site produces a line in u_ex<yymmdd>.log: the * in the path stands for the date, as in u_ex260312.log for 12 March 2026. It is the source for finding who requested what and what IIS answered, measuring response times, or spotting scans and 5xx errors. The “u_ex” prefix marks the W3C extended format, with fields chosen by the administrator, as opposed to the IIS or NCSA formats.

Format

W3C extended text file. Header lines start with #: #Software, #Version, #Date and above all #Fields, which gives the column order. Values are separated by a space. The default fields include date, time, s-ip, cs-method, cs-uri-stem, cs-uri-query, s-port, cs-username, c-ip, cs(User-Agent), cs(Referer), sc-status, sc-substatus, sc-win32-status and time-taken (in milliseconds). Time is in UTC.

Rotation and archiving

Daily rotation by default, adjustable (hourly, maximum size, or no rotation) in the site’s Logging settings. IIS never deletes old files: schedule cleanup or archiving.

Risks and best practices

  • IIS locks today’s file; delete or compress only previous days.
  • Add the fields you need (X-Forwarded-For behind a reverse proxy, otherwise c-ip shows the proxy) in Logging, Select Fields.
  • The #Fields header changes if you modify fields during the day: a new header then appears in the same file.

Useful commands

Fenêtre de terminal
# Last lines of the most recent file
$f = Get-ChildItem C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log | Sort-Object LastWriteTime | Select-Object -Last 1
Get-Content $f.FullName -Tail 20


# 5xx requests, with columns named after #Fields
$hdr = ((Select-String -Path $f.FullName -Pattern '^#Fields:' | Select-Object -First 1).Line -replace '^#Fields: ','') -split ' '
Get-Content $f.FullName | Where-Object { $_ -notmatch '^#' } | ConvertFrom-Csv -Delimiter ' ' -Header $hdr | Where-Object { [int]$_.'sc-status' -ge 500 } | Select-Object -First 20 date, time, 'cs-uri-stem', 'sc-status', 'time-taken'

How to read it

Start with the #Fields line to know the columns. sc-status is the HTTP code, sc-substatus the IIS sub-status (404.7, for example), sc-win32-status the related Windows error code (0 when all is well). A high time-taken points at a slow application. Convert UTC to local time before cross-checking with other logs.

Report a mistake