Inconsistent IIS log configuration

Question

We've got two different sites in IIS, both seemingly set up to log the same default W3C fields (according to the IIS UI). Yet, one is logging all the default fields, and one of them is including additional fields.

Standard: #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken

Extended: #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken

The server-level logging definition is configured to log the extended W3C fields. Per the applicationHost.config:

<logFile logExtFileFlags="Date, Time, ClientIP, UserName, SiteName, ComputerName, ServerIP, Method, UriStem, UriQuery, HttpStatus, Win32Status, BytesSent, BytesRecv, TimeTaken, ServerPort, UserAgent, Referer, ProtocolVersion, Host, HttpSubStatus" logFormat="W3C" directory="%SystemDrive%\\inetpub\\logs\\LogFiles" />

So I guess my question is, how does IIS determine exactly what the format is going to be and why is does it differ in this case? Also, is there an authoritative source of the site-level log format when it differs from the default server-level log config, other than the UI (eg in a file on disk somewhere). It would be really handy to programmatically determine which site logs deviate from the norm.

Answer 1

After looking at this more, it seems like the "Extended" logs are quite a bit newer than "Standard" logs, so it might just be that the server-level log configuration was updated and the older log files never cleaned up. I suspect someone updated the server-level configuration by hand at some point.