Converting Log Files to Other Formats

You can use the convlog utility to convert your Web server's log files to NCSA Common Log File format. The converter can also replace IP addresses with DNS names during conversion of Microsoft IIS and Extended format log files to NCSA format, or it can be used to replace IP addresses with DNS names inside an NCSA log file.

To convert log files to other formats

In a Command Prompt window, type convlog plus one of more of the following switches.

-i ( i , n , e ) Specifies the format type of the input file.

i Microsoft IIS Log Format
n NCSA Common Log File Format
e W3C Extended Log File Format

filename.log Specifies the input file name.
-t ( ncsa:GMTOffset ) Specifies the output type default as NCSA Common Log File Format.

GMTOffset Offset in hours from Greenwich Mean Time (GMT). The offset is a four-digit number preceded by a plus or minus sign, depending on your local time difference from GMT. An empty space following the GMT offset enables replacement of IP address by DNS name, for Microsoft IIS Log format only.

-l ( 0 , 1 , 2 ) Specifies the date format used in a Microsoft IIS Log input file. The utility will accept whatever format you specify, so you must determine what format was used in the input file.

0 - MM/DD/YY default (US date format)
1 - YY/MM/DD (Japanese date format)
2 - DD.MM.YY (German date format)

-o output directory Specifies the output directory. The default is the current directory (that is, %WINNT%\System32).
-x Saves non-HTTP transaction entries to a .dmp file.
-d Enables DNS replacement of user IP address during the conversion process.

Examples:

The command convlog -ii inetsv1.log -d -t ncsa:-0700 converts the Inetsv1.log file to an NCSA Common Log File Format with DNS names, corrected for a seven-hour GMT offset.

The command convlog -ii inetsv1.log -l1 -t ncsa:+0900 -o \Logfiles\Japan\ converts the Inetsv1.log file from a Microsoft IIS Log Format to an NCSA Common Log File Format, corrected for a nine-hour GMT offset (that is, Tokyo time), sets its date to Japanese format, and sends it to the Japan folder in the Logfiles folder of the current drive.

The command convlog -ie inetsv1.log -o D:\Temp\NCSALogs converts the Inetsv1.log file from W3C Extended Log Format to an NCSA Common Log File Format and outputs it to the NCSALogs folder in the D:\Temp directory. The IP addresses are not replaced by DNS names.

The command convlog -in inetsv1.log -o \\REMOTE_MACHINE\REMOTE_SHARE\NCSALogs outputs the Inetsv1.log file in NCSA Common Log File Format to the NCSALogs folder in the shared directory of a remote drive. The IP addresses are not replaced by DNS names and there is no file format conversion.

Output File Naming Convention for DNS Conversion

The file names generated by the DNS conversion process follow the following convention:

Log files converted to NCSA Common without DNS conversion will retain the original file name and have an .ncsa extension.
Log files with IP addresses converted to DNS names will retain the original file name with an an .ncsa.dns extension.

Example:

If Inetsv1.log is a log file using the Microsoft IIS Log Format, without DNS conversion, the resulting output log file is Inetsv1.log.ncsa. However, when you enable the DNS conversion feature, the resulting output log file is Inetsv1.log.ncsa.dns.