The Microsoft® Internet Information Server (IIS) logging interface provides you with a flexible method for generating server activity logs without interfering with other server processes. Using this architecture, you can move most of the maintenance of event logs from virtual servers to logging modules. A logging module is a COM component that exposes methods to IIS. When a log event occurs, IIS calls the appropriate log module's LogInformation method and provides it with a pointer to an IInetLoginformation interface. The logging module then uses the interface to record the log information. IIS determines which IINetLogInformation methods to expose to the logging module as specified by the MD_LOGEXT_FIELD_MASK identifier in the metabase.
IIS contains four built-in logging modules; however, if these do not meet your needs you can create custom logging modules. To do this, you should create a COM object that exposes the methods specified in ILogPlugin Interface.
The logging architecture is new with this version of IIS. Previously, you could create custom logging capabilities through ISAPI filters that registered interest in particular server events. The new architecture makes use of COM to facilitate the development of customized logging. In this architecture, logging modules are added by registering a COM object that supports the methods required by IIS. The registered object can then be established as the logging module for a virtual directory by setting the MS_LOG_PLUGIN_ORDER property with a script, or by selecting the module through the administrative user interface.
The new logging architecture relies on two interfaces that are defined in the ilogobj.h file. The IINetLogInformation and ILogPlugin interfaces expose methods through the IUnknown interface.
ILogPlugin interface also provides methods IIS uses to manage a logging module. IIS calls these methods to initialize, shut down and configure the logging module.