Thursday, March 28, 2013

Converting IIS logs time from UTC to local time

If you notice that the time logged in IIS logs does not match your server's local time, this is because IIS logs time in UTC (GMT) to conform with the W3C log format so if you are in a different time zone for example UTC -3 you will find the time 3 hours ahead in the logs.

To change that, you can choose a different log format from the IIS manager or you can convert the log file using Log Parser.

Download and install Log Parser then run the following command

LogParser.exe "SELECT DATE,TO_LOCALTIME(time) AS time,s-ip,cs-method,cs-uri-stem,cs-uri-query,s-port,cs-username,c-ip,cs(User-Agent),sc-status,sc-substatus,sc-win32-status,time-taken INTO c:\ayman\output.log FROM c:\ayman\input.log" -i:IISW3C -o:W3C

 

3 comments:

  1. Thank you for that, worked for me!

    ReplyDelete
  2. This is very helpful but I encountered an issue: although the time correctly converts, the date would not change when crossing midnight (GMT) into the next date.

    To fix this, replace the DATE parameter with the following:

    TO_DATE(TO_LOCALTIME(TO_TIMESTAMP(date,time))) AS date

    ReplyDelete