Understanding IIS 7 log files

Take a look at the top of your log file and you'll see something like this:

#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-04-13 19:02:34
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken

The #Fields row will tell you what each value represents. In your case, and presuming you're running with the default log settings, the values would be:

sc-status  sc-substatus   sc-win32status  time-taken
====================================================
405        0              0               218

• sc-status - is the major part of the HTTP status code
• sc-substatus - is the sub status e.g. for a 503.19 HTTP status it would be the 19 part
• sc-win32status - is a Windows system error code
• time-taken - is the time taken to send the response in milliseconds

If you're getting non-zero values for sc-win32status you can use:

NET HELPMSG <sc-win32status value>

...to find out that that status code maps to.

If a field doesn't have a value in the log file then the missing value is shown as a hyphen -.