1. Open IIS Manager, expand Sites and select the intended website.
2. Open Logging. Confirm logging is enabled and choose the required format. W3C provides selectable fields.
3. Review the log directory and available storage. Keep logs outside public content paths and restrict access to staff who need them.
4. For W3C, choose Select Fields. Include the fields needed for the investigation, such as date, time, method, URI stem, status, substatus, Win32 status and time taken.
5. Choose the file rollover schedule or size policy appropriate to the workload. Record the retention and cleanup process separately.
6. Apply the settings and make a harmless test request. Locate the entry after the log buffer is written and confirm it belongs to the intended site.

Use the #Fields header rather than assuming columns always have the same order. W3C timestamps use UTC, and time-taken is recorded in milliseconds. Compare a request's status, substatus and Windows error with the matching application or Event Viewer evidence.

If a request never reaches the IIS site, it may be absent from its log. Review a proxy or load balancer and the HTTPERR log for earlier rejections. The client's address may also reflect an intermediary unless you deliberately collect a trustworthy forwarded-address field.

URLs and query strings can contain personal information or tokens. Select fields deliberately, restrict diagnostic exports and remove unnecessary sensitive values from shared examples. Log rollover creates new files; it should not be treated as proof that old files are being deleted.

• Diagnosing an IIS HTTP 500 error
• Diagnosing IIS HTTP 503 Service Unavailable
• Investigating a Windows service failure with Event Viewer
• Keep a useful timeline during a hosting incident

• Microsoft: IIS site log files
• Microsoft: troubleshoot IIS HTTP errors