I chekc the IIS log on the FE, but some files let me feel confused as followed: s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port sc-status sc-substatus sc-win32-status Please help!

Hi, These are the field name which tell you detail, like s-ip is source IP, s-port server port. YOu can use log parser tool to produce meaninfull report for these logs. See below Details: http://www.loganalyzer.net/log-analyzer/w3c-extended.html Date date The date that the activity occurred. Time time The time that the activity occurred. Client IP Address c-ip The IP address of the client that accessed your server. User Name cs-username The name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-). Service Name s-sitename The Internet service and instance number that was accessed by a client. Server Name s-computername The name of the server on which the log entry was generated. Server IP Address s-ip The IP address of the server on which the log entry was generated. Server Port s-port The port number the client is connected to. Method cs-method The action the client was trying to perform (for example, a GET method). URI Stem cs-uri-stem The resource accessed; for example, Default.htm. URI Query cs-uri-query The query, if any, the client was trying to perform. Protocol Status sc-status The status of the action, in HTTP or FTP terms. Win32® Status sc-win32-status The status of the action, in terms used by Microsoft Windows®. Bytes Sent sc-bytes The number of bytes sent by the server. Bytes Received cs-bytes The number of bytes received by the server. Time Taken time-taken The duration of time, in milliseconds, that the action consumed. Protocol Version cs-version The protocol (HTTP, FTP) version used by the client. For HTTP this will be either HTTP 1.0 or HTTP 1.1. Host cs-host Displays the content of the host header. User Agent cs(User-Agent) The browser used on the client. Cookie cs(Cookie) The content of the cookie sent or received, if any. Referrer cs(Referer) The previous site visited by the user. This site provided a link to the current site Anil MCC 2011,ITIL V3,MCSA 2003,MCTS 2010, My Blog : http://messagingschool.wordpress.com

Do you have a list to explain what the code number means? sc-status sc-substatus sc-win32-status 401 1 1326

I suggest you look here and then check the code values on MSDN. http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/bea506fd-38bc-4850-a4fb-e3a0379d321f.mspx?mfr=trueSukh