W3C_EXTENDED2DLF.IN(1)

📦 version 2.1.1, in arch rolling

💅 W3C_EXTENDED2DLF.IN(1) 💅

okay so this is a page from LogReport's Lire Documentation, and bestie, if you've ever stared at a Microsoft IIS log going "what am I even looking at" — this is your moment. it's the w3c_extended2dlf manual, section 1. let's go 🫶

✨ NAME ✨

w3c_extended2dlf — the little icon that converts a W3C Extended Log file (you know, the kind MS IIS spits out) into DLF. literally its whole personality. 💖

🌸 SYNOPSIS 🌸

w3c_extended2dlf file

🦋 DESCRIPTION 🦋

so w3c_extended2dlf converts web server log files in the W3C Extended Log Format over to the www DLF. that log format is defined right here, no cap: http://www.w3.org/TR/WD-logfile.html

it's used by IIS 4.0 and IIS 5.0. and it's a customizable format — which is the fancy way of saying it starts with a header that tells you which info is actually present in the log. the way that header just declares its own schema? iconic. 👑

there's some documenation on these log file formats in the section on "Analyzing Log Files (IIS 6.0)" inside the "IIS 6.0 Documentation" at the "Microsoft Windows Server 2003 TechCenter", here: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/610b7d2c-90d6-4e40-be79-aaf88a283f03.mspx?mfr=true . the newer IIS 7.0 product is documented at http://www.iis.net/. 🧚

🎀 the fields we stan

to get the maximum info in your reports, we suggest you log these fields:

date, time, c-ip, c-dns, cs-uri, cs-method, sc-bytes, sc-status,
cs(User-Agent), cs(Referer) and cs-username

we also support the cs-uri-stem field. 💜

other fields will be ignored. 🙈

💀 LIMITATIONS 💀 (read this bestie, fr fr)

  • the converter doesn't handle aggregation (that's a record with a count field) and it will flat-out refuse to process those logs. not me getting rejected 😭
  • also it doesn't support changing the fields in the middle of the log file. it will ignore records that don't have the same schema as the first one defined. so like, pick a schema and commit, periodt.

🔥 EXAMPLES 🔥

to process a log as produced in the W3C Extended Log Format:

$ w3c_extended2dlf < extended.log

ngl, w3c_extended2dlf will rarely be used on its own — it's more likely called by lr_log2report, like this:

$ lr_log2report w3c_extended < /var/log/httpd/extended.log

👑 AUTHORS 👑

Francis J. Lacoste <flacoste@logreport.org> — thank you king 🫶

⭐ VERSION ⭐

$Id: w3c_extended2dlf.in,v 1.17 2009/03/15 08:10:55 vanbaal Exp $

Copyright (C) 2001, 2002 Stichting LogReport Foundation LogReport@LogReport.org

this program is part of Lire.

Lire is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. 💅

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License for more details.

you should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html. 🍓

ok that's the whole thing! no details skipped, we ate and left no crumbs 💅✨

and that's the sign-off bestie: this was Lire 2.1.1, dated 2025-09-28, manual page W3C_EXTENDED2DLF.IN(1) — slay, go convert some logs 💖🎀🦋

📦 where this page comes from