Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. inetpub
  3. logs\LogFiles
FolderRisk: Caution

logs\LogFiles C:\inetpub\logs\LogFiles

Default location of IIS access logs (one subfolder per site, dated .log files); purge or archive them regularly.

Updated on By AltF4 Formation

What it’s for

IIS writes its request logs here: %SystemDrive%\inetpub\logs\LogFiles is the default logging directory. It appears as soon as IIS is installed, on Windows Server as well as on a client machine where the feature is turned on.

What it contains

  • One subfolder per site: W3SVC<site ID> (for example W3SVC1), and FTPSVC<ID> for FTP sites.
  • .log files in W3C extended format (u_ex<yymmdd>.log), split by the rollover period you chose: hourly, daily, weekly or monthly.
  • For each request: date, time, client address, method, URI, status code, duration. W3C timestamps are in UTC, so expect an offset from the server’s local time.
  • Not the HTTP.sys errors (HTTPERR), which are in C:\Windows\System32\LogFiles.

Risks and best practices

  • IIS never purges these logs, so on a busy server the system volume eventually fills up. Schedule deletion beyond a given age (Microsoft documents a script for it), keeping whatever retention your security policy or regulations require.
  • Move the directory to another volume from IIS (site > Logging > Directory) rather than replacing the folder.
  • Do not delete today’s file: the service holds it open.
  • For large volumes, analyze with Log Parser or a monitoring tool rather than Notepad.

Useful commands

Fenêtre de terminal
# Site IDs and names, so you know which W3SVC<id> folder is which
& "$env:windir\system32\inetsrv\appcmd.exe" list site


# Log volume per site folder
Get-ChildItem "$env:SystemDrive\inetpub\logs\LogFiles" -Directory | ForEach-Object {
    [pscustomobject]@{ Site = $_.Name; MB = [math]::Round((Get-ChildItem $_.FullName -Recurse -File | Measure-Object Length -Sum).Sum / 1MB, 1) } }


# Last lines of a site's log
Get-ChildItem "$env:SystemDrive\inetpub\logs\LogFiles\W3SVC1" -Filter *.log |
  Sort-Object LastWriteTime | Select-Object -Last 1 | Get-Content -Tail 20


# Delete logs older than 30 days (as administrator; remove -WhatIf to run)
Get-ChildItem "$env:SystemDrive\inetpub\logs\LogFiles" -Recurse -Filter *.log |
  Where-Object LastWriteTime -lt (Get-Date).AddDays(-30) | Remove-Item -WhatIf

Folder contents

Folders 1

Report a mistake