Here are some typical logfile format :

- W3C logfile include in the first few lines description of the logformat used. So format is extracted from this line.
I recommend using W3C logformat instead of IIS logformat.
- NECLF stand for New Extended Logfile Format, it add support for virtualhost.
All your servers log can be put together in the same logfile. The %virtualhost field allow to know from which server the request came from.
- ECLFIO is the new Apache logfile format which include input and output bandwith.

CLF %host %null %login %date %hourshift %method %page %protocol %status %requetesize
www.lyot.obspm.fr - - [01/Jan/97:23:12:24 +0000] "GET /index.html HTTP/1.0" 200 1220
ECLF %host %null %login %date %hourshift %method %page %protocol %status %requetesize %referer %agent
www.lyot.obspm.fr - - [01/Jan/97:23:12:24 +0000] "GET /index.html HTTP/1.0" 200 1220 "http://www.w3perl.com/" "Mozilla/4.01 (X11; I; SunOS 5.3 sun4m)"
ECLFIO %host %null %login %date %hourshift %method %page %protocol %status %requetesize %referer %agent %I %O
www.lyot.obspm.fr - - [01/Jan/97:23:12:24 +0000] "GET /index.html HTTP/1.0" 200 1220 "http://www.w3perl.com/softs/" "Mozilla/4.01 (X11; I; SunOS 5.3 sun4m)" 234 556
NECLF %host %null %login %date %hourshift %virtualhost %method %page %protocol %status %requetesize %referer %agent
www.lyot.obspm.fr - - [01/Jan/97:23:12:24 +0000] (www.obspm.fr) "GET /index.html HTTP/1.0" 200 1220 "http://www.w3perl.com/softs/" "Mozilla/4.01 (X11; I; SunOS 5.3 sun4m)"
IIS %host %login %date %hour %null %null %null %null %null %requetesize %status %null %method %page %query
129.142.90.150, -, 5/5/97, 14:33:27, W3SVC, RHINO, 194.182.141.6, 2601, 207, 1272, 200, 0, GET, /frabout.htm, -,
W3C %date %hour %host %method %page %status %query %status %agent %referer
1998-01-06 19:05:37 193.149.100.108 GET /images/ap.gif - 304 Mozilla/4.0+(compatible;+MSIE+4.0;+Windows+95) http://www.defle.montaigne.u-bordeaux.fr/
FTP %date %transfert_time %host %requetesize %page %null %null %direction %null %login %method %null %null %status
Tue May 7 15:28:51 2002 920 mix.iap.fr 668499968 /ftp1/linux/redhat-7.3/valhalla-i386-disc1.iso b _ o a guest@unknown ftp 0 * c
RealServer %host %null %login %date %hourshift %method %page %protocol %status %requetesize %agent
62.123.125.30 - - [09/Apr/2003:16:32:10 +0200] "GET xblib.js HTTP/1.0" 200 0 [Mozilla/5.0 (X11;U;Linux i686) Gecko/20021212] [] [UNKNOWN] 0 0 0 0 0 398
Squid native %date %elapsed %host %codestatus %requetesize %method %page %null %peerstatus %mimetype
1042153466.411 120 4.1.200.248 TCP_REFRESH_HIT/304 258 GET http://www.voyages-sncf.com/img/seldate.gif - DEFAULT_PARENT/127.0.0.1 - ALLOW
Squid common %host %null %login %date %hourshift %method %page %protocol %status %requetesize %codestatus
www.lyot.obspm.fr - - [01/Jan/97:23:12:24 +0000] "GET http:www.yahoo.com/index.html HTTP/1.1" 200 1220 TCP_MISS:DIRECT