[This is preliminary documentation and subject to change]

# Converting Log Files to NCSA Format

You can use the convlog utility to convert your Web server's log files to NCSA Common log file format. The converter can also replace IP addresses with DNS names during conversion of Microsoft IIS and Extended format log files to NCSA format, or it can be used to replace IP addresses with DNS names inside an NCSA log file. Time offsets can also be converted using this utility.

Note Using this utility with W3C Extended log files that contain process accounting log information results in the loss of any Process Accounting information.

###### To convert log files to other formats

In a command prompt window, type convlog and one of more of the following switches.

- -i ( i, n , e ) Specifies the format type of the input file.
  - i Microsoft IIS log file format
  - n NCSA Common log file format
  - e W3C Extended log file format
- filename.log Specifies the input file name.
- -t (ncsa:GMTOffset) Specifies the output type default as NCSA Common log file format.
  - GMTOffset Offset in hours from Greenwich Mean Time (GMT). The offset is a four-digit number preceded by a plus or minus sign, depending on your local time difference from GMT. An empty space following the GMT offset enables replacement of IP address by DNS name, for Microsoft IIS log file format only.
- -l ( 0 , 1 , 2 ) Specifies the date format used in a IIS log input file. The utility accepts whatever format you specify, so you must determine what format was used in the input file.
  - 0 - MM/DD/YY default (U.S. date format)
  - 1 - YY/MM/DD (Japanese date format)
  - 2 - DD.MM.YY (German date format)
- -o output directory Specifies the output directory. The default is the current directory (that is, %WINNT%\System32).
- -x Saves non-HTTP transaction entries to a .dmp file.
- -d Enables DNS replacement of user IP address during the conversion process.

Examples:

The command convlog -ii inetsv1.log -d -t ncsa:-0700 converts the Inetsv1.log file to an NCSA Common log file format with DNS names, corrected for a seven-hour GMT offset.

The command convlog -ii inetsv1.log -l1 -t ncsa:+0900 -o \Logfiles\Japan\ converts the Inetsv1.log file from an IIS log file format to an NCSA Common log file format, corrected for a nine-hour GMT offset (that is, Tokyo time), sets its date to the Japanese date format, and sends it to the folder named Japan in the folder named Logfiles on the current drive.

The command convlog -ie extend1.log -o D:\Temp\NCSALogs converts the Extend1.log file from W3C Extended log file format to an NCSA Common log file format and outputs it to the NCSALogs folder in the D:\Temp directory. The IP addresses are not replaced by DNS names.

The command convlog -in ncsa1.log -o -d \\REMOTE_MACHINE\REMOTE_SHARE\NCSALogs outputs the Ncsa1.log file in NCSA Common log file format to the NCSALogs folder in the shared directory of a remote drive. The IP addresses are replaced by DNS names and there is no file format conversion.

The file names produced by the DNS conversion process use the following convention:

- Log files converted to NCSA Common without DNS conversion retain the original file name and have an .ncsa extension.
- Log files with IP addresses converted to DNS names retain the original file names with an an .ncsa.dns extension.

For example, if Inetsv1.log is a log file using the Microsoft IIS log file format, without DNS conversion, the resulting output log file is Inetsv1.log.ncsa. However, if you enable the DNS conversion feature, the resulting output log file is Inetsv1.log.ncsa.dns.

Related Topics

- For descriptions of the available log file formats, see About Logging Site Activity.
- For information on setting W3C Extended logging fields, see Customizing W3C Extended Logging.
- For information on logging frequency and log size, see Saving Log Files.
- For a reference list of logging properties, see Logging Properties Reference.

© 1997-2001 Microsoft Corporation. All rights reserved.