DOCUMENT:Q199117  23-JAN-1999  [iis]
TITLE   :SP4 Causes Extra Delimiter to Appear in NCSA Common Log Format
PRODUCT :Internet Information Server
PROD/VER:winnt:4.0
OPER/SYS:
KEYWORDS:

======================================================================
-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Internet Information Server 4.0 
-------------------------------------------------------------------------------

SYMPTOMS
========

After you apply SP4 on an IIS 4.0 computer configured to use the NCSA Common Log
format, the IIS NCSA Common Logs contain an extra delimiter (") near the HTTP
Protocol version identifier. This can cause applications designed to analyze
NCSA Common logs to fail.

The following is an entry from a log file that exhibits the problem:

   127.0.0.1 - - [24/Nov/1998:16:37:35 -0500] "GET /samples/images/space.gif
   "HTTP/1.1" 304 141

The quotation marks ( " ) in front of HTTP/1.1 should not be present. The correct
entry should be similar to the following:

   127.0.0.1 - - [24/Nov/1998:16:37:35 -0500] "GET /samples/images/space.gif
   HTTP/1.1" 304 141

WORKAROUND
==========

To work around this problem, do the following:

1. Obtain version 4.02.0622 of the following file: system
   drive:\winnt\System32\Inetsrv\Iislog.dll

2. To check the files version, right-click on the file using Windows Explorer
   and select Properties. On the Version tab, check the File Version field for
   the appropriate version. This file may be extracted from IIS4_01.cab from the
   Windows NT Option pack installation using the latest version of Winzip or the
   Cab Viewer from the Microsoft Power Toy's utility suite.

3. Stop the IIS Admin service in Control Panel Services. You will be informed
   that it will stop the WWW Publishing services and possibly other dependant
   services.

4. Overwrite the SP4 version of IISLog.dll (4.02.0667.05) with the Windows NT
   Option pack build (4.02.0622).

5. Open a command prompt and switch to the system drive:\winnt\System32\Inetsrv
   directory.

6. Type the following command line:

   REGSVR32 iislog.dll

   (Note, that it is SVR, not SRV).

7. Restart the IIS Admin service and the World Wide Web Publishing services.

8. Verify that the NCSA Common Logs are now being created properly.

Additional query words:

======================================================================
Keywords          :  
Technology        : kbiisSearch kbiis400
Version           : winnt:4.0
Issue type        : kbprb

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 1999.