Web log is a chronological recording of all the activities achieved through Web server. The Web Server softwares are capable of generating these logs. In a log file, data like - number of requests made, number of requests by type of file, such as HTML page views, distinct IP addresses served and the number of requests each made, number of requests for specific files or directories, totals and averages by specific time periods (hours, days, weeks, months, years), URLs from which user came to the site (referring pages), Etc. are available.

Microsoft Internet Information Server log format includes the following fields: Client IP address, User name, Date, Time, Service and instance, Server name, Server IP Address, Time taken, Client bytes sent, Server byte sent, Status code, Windows status code, Request type, Required resource, Parameter.
Ex:
66.249.65.77, -, 2005-09-05, 9:18:50, W3SVC186, NURIWEB31, 211.39.149.31, 141, 254, 0, 200, 0, GET, /inner_products/product01_043.asp, -,

The fields are separated by comma(,) in this log format.

This is the standard log format used by several web servers like Apache web server. We can categorize these logs based on the information it captures as: Access log, Referrer log, Agent and Error log. Access log records about general site visit and grasps website visiting hours and visit path etc. NCSA Common and NCSA Combined log formats hold Access log information. An access log is a list of all the requests for individual files that people have requested from a Web site. These files will include the HTML files and their embedded graphic images and any other associated files that get transmitted. The access log (sometimes referred to as the "raw data") can be analyzed and summarized by another program. In general, an access log can be analyzed to tell you:

• The number of visitors (unique first-time requests) to a home page
• The origin of the visitors in terms of their associated server's domain name (for example, visitors from .edu, .com, and .gov sites and from the online services)
• How many requests for each page at the site, which can be presented with the pages with most requests listed first
• Usage patterns in terms of time of day, day of week, and seasonally

The NCSA Common log contains the following fields:
host, RFC 931, username, date:time, request, statuscode, bytes
Ex:
192.168.1.200 - - [18/Nov/2005:12:02:33 +0900] "GET /m/view_page.php?page_number=2 HTTP/1.1" 200 43891

NCSA Combined log contains the fields of The NCSA Common log format in addition to the fields – referrer, user_agent and cookie.
Ex:
192.168.1.200 - - [19/May/2005:00:00:00 +0900] "GET /css/style.css HTTP/1.1" 200 4290 "http://logcenter.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "VIEW_ALL_COOKIE=130; UserID=4; UserName=logcenter"

Referrer log gives the information about URL or keyword used to enter the site from an external site. Agent log offers clue about visitor's web browser type and version, OS's type, screen resolution, application program used etc. used to connect to site. Error log includes information about unfulfilled requests from client or any malfunction.

This is a customizable log format used by Microsoft Internet Information Servers (IIS). It contains the following fields: Date, Time, Client-IP, Server name, Server-IP, Server port, Method, URI stem, URI Query, HTTP Status, Win32 Status, Byte sent, Time taken, Protocol version, User agent, Cookie, and Reference page.

Ex:
 #Software: Microsoft Internet Information Server 4.0
 #Version: 1.0
 #Date: 1998-11-19 22:48:39
 #Fields: date time c-ip cs-username s-ip cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes time- taken cs-version cs(User-Agent) cs(Cookie) cs(Referrer)

1998-11-19 22:48:39 206.175.82.5 - 208.201.133.173 GET /global/images/
navlineboards.gif - 200 540 324