I chekc the IIS log on the FE, but some files let me feel confused as followed: s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port sc-status sc-substatus sc-win32-status Please help!

Hi, These are the field name which tell you detail, like s-ip is source IP, s-port server port. YOu can use log parser tool to produce meaninfull report for these logs. See below Details: http://www.loganalyzer.net/log-analyzer/w3c-extended.html Date date The date that the activity occurred. Time time The time that the activity occurred. Client IP Address c-ip The IP address of the client that accessed your server. User Name cs-username The name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-). Service Name s-sitename The Internet service and instance number that was accessed by a client. Server Name s-computername The name of the server on which the log entry was generated. Server IP Address s-ip The IP address of the server on which the log entry was generated. Server Port s-port The port number the client is connected to. Method cs-method The action the client was trying to perform (for example, a GET method). URI Stem cs-uri-stem The resource accessed; for example, Default.htm. URI Query cs-uri-query The query, if any, the client was trying to perform. Protocol Status sc-status The status of the action, in HTTP or FTP terms. Win32® Status sc-win32-status The status of the action, in terms used by Microsoft Windows®. Bytes Sent sc-bytes The number of bytes sent by the server. Bytes Received cs-bytes The number of bytes received by the server. Time Taken time-taken The duration of time, in milliseconds, that the action consumed. Protocol Version cs-version The protocol (HTTP, FTP) version used by the client. For HTTP this will be either HTTP 1.0 or HTTP 1.1. Host cs-host Displays the content of the host header. User Agent cs(User-Agent) The browser used on the client. Cookie cs(Cookie) The content of the cookie sent or received, if any. Referrer cs(Referer) The previous site visited by the user. This site provided a link to the current site Anil MCC 2011,ITIL V3,MCSA 2003,MCTS 2010, My Blog : http://messagingschool.wordpress.com

Do you have a list to explain what the code number means? sc-status sc-substatus sc-win32-status 401 1 1326

401.1 usually just means that the server is asking for authentication before allowing access to a resource (i.e. something that isn't configured for anonymous access in IE). They are usually followed by success codes (e.g. 200, 301, 302) once the browser has resent the request but this time including the users credentials. Repeated 401.1 (in spite of correct credentials being supplied) can indicate a problem: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/8feeaa51-c634-4de3-bfdc-e922d195a45e.mspx Outlook Web Access For PDA , OWA For WAP www.owa-pda.com email a@t leederbyshire d.0.t c.0.m

I suggest you look here and then check the code values on MSDN. http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/bea506fd-38bc-4850-a4fb-e3a0379d321f.mspx?mfr=trueSukh