Log Management · Topic 4 of 5

Web Server, Database and Email Logs

Learn IIS W3C and Apache log formats, HTTP status codes, database audit and error logs, and mail server logs and headers for SOC analysis on CSA 312-39.

  • 5 min
In a nutshell
  • IIS uses W3C Extended format in UTC. Apache and Nginx use Common or Combined format.
  • Combined Log Format adds Referer and User-Agent to the Common Log Format.
  • 401 bursts suggest brute force, 404 bursts suggest scanning, 500 errors suggest injection.

What it is

Web server logs record each HTTP request: who asked, for what, and how the server answered. Database logs record logins, errors and, when auditing is on, the queries and changes made to data. Email logs record each message's path through mail servers and gateways.

These are the application layer logs. They show attacks that network logs cannot see, such as SQL injection inside an allowed HTTPS session.

Web serveraccess and error logsDatabaseerror and audit logsMail servermail and message logsSIEMcorrelate

How it works

Web server log formats

ServerDefault locationFormat
Microsoft IIS%SystemDrive%\inetpub\logs\LogFiles\W3SVC<site ID>\W3C Extended Log File Format, times in UTC
Apache (Debian, Ubuntu)/var/log/apache2/access.log and error.logCommon Log Format or Combined Log Format
Apache (Red Hat family)/var/log/httpd/access_log and error_logCommon or Combined
Nginx/var/log/nginx/access.log and error.logCombined by default

The Common Log Format has seven fields: client IP, identity, user name, time stamp, request line, status code and bytes sent. The Combined Log Format adds the Referer and User-Agent. An example Common Log Format line:

192.0.2.10 - - [12/Oct/2026:14:02:11 +0000] "GET /login.php HTTP/1.1" 200 2326

IIS W3C logs start with a #Fields: line that names each column, such as date time s-ip cs-method cs-uri-stem cs-uri-query s-port c-ip cs(User-Agent) sc-status time-taken. In W3C names, c is the client, s the server, and cs or sc the direction of the data.

HTTP status codes

CodeMeaningWhat a pattern can mean
200OKA large 200 after attack attempts may mean success
301 and 302RedirectNormal, but watch redirects to external sites
400Bad RequestMalformed probes
401UnauthorizedBursts suggest brute force against authentication
403ForbiddenAttempts to reach restricted paths
404Not FoundBursts suggest scanning or forced browsing for hidden files
500Internal Server ErrorInjection attempts that break the application
503Service UnavailableOverload, possibly DoS

Signs of attack in web logs: SQL keywords or quotes in the query string, <script> tags, ../ sequences, scanner user agents such as sqlmap or Nikto, requests to new script files in upload folders, and one IP producing many 404s in a short time.

Database logs

DatabaseLogs to know
Microsoft SQL ServerSQL Server error log (records failed logins as error 18456), SQL Server Audit
MySQLError log, general query log, slow query log, binary log
Oracle DatabaseAlert log, audit trail (unified auditing)

Query level logging is often off by default because of its performance cost, so audit settings must be planned for sensitive tables.

Suspicious database activity:

  • Many failed logins, especially for administrative accounts such as sa or root
  • Logins from application servers at unusual times or from user workstations
  • Large SELECT results from tables of personal or card data
  • Schema changes such as DROP TABLE, new users or GRANT statements outside change windows
  • Dangerous features enabled, such as xp_cmdshell in SQL Server, which runs operating system commands

Email logs

SourceWhat it records
Postfix or SendmailEach message's queue ID, sender, recipient, relay and status, in /var/log/maillog (Red Hat) or /var/log/mail.log (Debian)
Microsoft Exchange ServerMessage tracking logs, protocol logs
Microsoft 365Message trace and the unified audit log, including mailbox rule changes
Secure email gatewaySpam and malware verdicts, URL clicks, blocked attachments

The email header is a log in itself. Read Received lines from bottom to top to trace the path, compare From, Reply-To and Return-Path, and check Authentication-Results for SPF, DKIM and DMARC results.

Signs of attack: SPF or DMARC failure for an internal looking sender, a burst of outbound mail from one account, new forwarding rules to external addresses, and many users receiving the same attachment hash.

Web logSQL payload, 500 errorsDatabase loglarge SELECTMail logoutbound to new addressIncident

A worked example

The Apache access log shows one IP requesting /search.php with UNION SELECT in the query string, with several 500 responses and then a 200 response of 480 KB where normal responses are about 5 KB. The MySQL general query log at the same minute shows a SELECT returning every row of the customers table.

The web log shows the attempt, and the database log confirms the data was read. The analyst raises a confirmed SQL injection with data exposure and escalates for containment.

How the exam asks about this

  • "Which log format does IIS use by default?" → W3C Extended Log File Format.
  • "A web log shows hundreds of 404 responses to one IP in a minute. What is most likely happening?" → Scanning or forced browsing for hidden content.
  • "Which SQL Server error number records a failed login?" → 18456.

What to remember for the exam

  • IIS uses W3C Extended format in UTC. Apache and Nginx use Common or Combined format.
  • Combined Log Format adds Referer and User-Agent to the Common Log Format.
  • 401 bursts suggest brute force, 404 bursts suggest scanning, 500 errors suggest injection.
  • Database query logging is often off by default and must be enabled for sensitive data.
  • Read email Received headers from bottom to top, and check SPF, DKIM and DMARC results.
Watch out

IIS logs use UTC, while many other systems log local time. Convert times before you correlate, or the timeline will be wrong by hours.

Common mistakes

Assuming HTTPS hides attacks from logs. Encryption protects the wire, but the server logs the decrypted request line, including the query string.

Treating every 200 as normal. A 200 with an unusually large size after a run of errors can mean the attack worked.

Reading Received headers top down. The top line was added last, by your own server. The origin is at the bottom.

Check yourself

  • What two fields does the Combined Log Format add to the Common Log Format?

    The Referer and the User-Agent.

  • Why should xp_cmdshell being enabled worry an analyst?

    It lets SQL Server run operating system commands, which attackers use to move from the database to the host.

  • Which header field shows SPF, DKIM and DMARC results?

    Authentication-Results, added by the receiving mail server.

Topic 4 of 5 in Log Management

Test yourself on Log Management

The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.