WEBSITE

IIS 7.0 : Application Logging

5/24/2011 4:14:53 PM
Besides the standard IIS type logs, other items can be logged. Many of these options can be set with the IIS Manager or by using Appcmd.

Process Recycling Logging

In IIS 7.0, events are logged to the Windows event log when an application pool recycles. You can control eight configuration settings with each option listed in Table 1.

Table 1. Recycling Options Under Generate Recycle Event Log Entry
OptionDescriptionDefault Setting
Application Pool Configuration ChangedEvent is logged when the application pool recycles due to a change in its configurationNo
ISAPI Report UnhealthyEvent is logged because an ISAPI extension has reported itself as unhealthyNo
Manual RecycleEvent is logged when the application pool has been manually recycledNo
Private Memory Limit ExceededEvent is logged when the application pool recycles after exceeding its private memory limitYes
Regular Time IntervalEvent is logged when the application pool recycles on its scheduled intervalYes
Request Limit ExceededEvent is logged when the application pool recycles after exceeding its request limitNo
Specific TimeEvent is logged when the application pool recycles at a scheduled timeNo
Virtual Memory Limit ExceededEvent is logged when the application pool recycles after exceeding its virtual memory limitsYes

ASP

Classic ASP (Active Server Pages) is alive and well in IIS 7.0, and you can configure options for logging ASP errors under the ASP section in the IIS Manager. Use the following options to discover issues when migrating your Classic ASP applications to IIS 7.0.

  • Enable Log Error Requests Controls whether the Web server writes ASP errors to the application event log

  • Log Errors To The NT Log Specifies that ASP errors are recorded in the Windows event log

These options are available in IIS 6.0, but you have to use ADSUtil.vbs to enable them in the metabase. Now, in IIS 7.0, you can use the IIS Manager to enable these options.

ASP.NET

All ASP.NET 2.0 unhandled exceptions are written to the Application Event log. Along with application pool recycle events or other errors in the event logs, this can be very helpful in troubleshooting application errors. You can turn off ASP.NET logging by following the instructions in the Knowledge Base article at http://support.microsoft.com/kb/911816.

IIS Events

Other processes related to IIS also log to the Windows Event log. This includes the HTTP, IISAdmin, FTP Publishing Service, and W3SVC services. For a complete list of events, go to http://technet.microsoft.com and search for “IIS events reference.”

Folder Compression Option

Log files are necessary to keep track of Web site statistics and trends, and Web developers and business people use them to ensure their Web sites continue to grow. One of the biggest challenges administrators face is how to retain and manage log files. By default, IIS rolls over log files once a day. Your log files can become quite large even if you use the default log file rollover setting.

Windows Server 2008 allows for folder compression to help save space. You can enable this option by using Windows Explorer. Figure 1 shows a folder with compression enabled. In this example, the size of the folder is 166 megabytes (MB), but the actual space the folder uses on the disk is only 43.1 MB. If your uncompressed log files take up several gigabytes (GB), you could save yourself a lot of disk space by using folder compression.

Figure 1. Folder compression enabled on the WWWLogs folder.


Because HTTP.sys buffers information written to the IIS log files, there will not be a performance hit if your log files are in a folder for which compression is enabled. Some people use third-party log compression products or free tools such as Gzip along with scripts to compress their log files. Unless you have a tool that searches inside zip files, this is an acceptable method only if you rarely need to unzip and search your archived log files. If you have compression enabled, however, you can leave your files in their original, easily searchable state. At most, you’ll need to implement some type of archival and deletion script by using your favorite script or third-party program.

Using the built-in compression feature provided by Windows Server 2008 can save you disk space and simplify how you retain your log files.

Logging Analysis Using Log Parser

You can download Log Parser at http://www.iis.net/go/1287.

Note

Members of the Microsoft.com team are big fans of Log Parser. Take a look at this Web site for an article that discusses how they use Log Parser: http://blogs.technet.com/mscom/archive/2005/10/19/412745.aspx.


Here are three examples of using Log Parser to extract common information from your IIS logs:

1.
List the top 25 (most frequent) WebRequests:

LogParser -i:iisw3c "SELECT TOP 25 cs-uri-stem,
COUNT(*) AS HitCount INTO Results.csv FROM LOGFILENAME.LOG
GROUP BY cs-uri-stem ORDER BY HitCount DESC" -o:csv

2.
Show the 25 requests that take the longest to execute:

//Change the date to fit your needs
SELECT
TOP 25
CS-URI-STEM,
TIME-TAKEN
FROM LOGFILENAME.LOG
WHERE DATE > '2007-03-26'
ORDER BY TIME-TAKEN DESC

3.
Select information between two dates and pipe results to a text file named Output.txt:

SELECT
DATE,
TIME,
CS-URI-STEM,
SC-STATUS,
COUNT(*) AS MaxTime
INTO Output.txt
FROM LOGFILENAME.LOG
WHERE TO_TIME(time)
BETWEEN
TIMESTAMP('01/01 13:50:00', 'MM/dd hh:mm:ss') AND
TIMESTAMP('01/01 18:30:00', 'MM/dd hh:mm:ss') AND SC-STATUS = 500
GROUP BY
CS-URI-STEM,
DATE,
TIME,
SC-STATUS
ORDER BY MaxTime DESC

If you are responsible for maintaining an IIS environment, take a look at Log Parser. You’ll want to make it one of your main tools when troubleshooting all kinds of issues. (For more information about Log Parser, visit the community forums at http://forums.iis.net/default.aspx?GroupID=51.)

Other  
 
Most View
Buying Guide: Ultra-Quiet Upgrades (Part 1)
Build A Water-Cooled Mini-ITX Monster (Part 3)
Some Of The Biggest Brands In The World Had Their Products (Part 7) - Pioneer HTZ-828BD, Sharp BD-AMS10A, Samsung NX1000
ASP.NET 4.0 : Data Source Components (part 4) - The ObjectDataSource Control - Using Parameters, Caching Data and Object Instances
Adobe Fireworks CS5 : Selecting with the lasso tools
Bluetooth Headset Mods
How To Buy…SSD Drives (Part 3)
Multifunction Printer Group Test (Part1) : Canon Pixma MG2250, Canon Pixma MX895
Windows 7 : The Zune PC Software (part 3) - Using Zune - Rating Content, Working with Playlists
Sharepoint 2013 : Understanding project sites (part 2) - Managing tasks
Top 10
Microsoft Exchange Server 2007 : Components of a Secure Messaging Environment (part 5) - Using Email Disclaimers
Microsoft Exchange Server 2007 : Components of a Secure Messaging Environment (part 4) - Establishing a Corporate Email Policy, Securing Groups
Microsoft Exchange Server 2007 : Components of a Secure Messaging Environment (part 3) - Hardening Windows Server 2003 - Running SCW
Microsoft Exchange Server 2007 : Components of a Secure Messaging Environment (part 2) - Hardening Windows Server 2003 - Using the Microsoft Baseline Security Analyzer
Microsoft Exchange Server 2007 : Components of a Secure Messaging Environment (part 1) - Hardening Windows Server 2003 - Auditing Policies
Microsoft Exchange Server 2007 : Server and Transport-Level Security - Considering the Importance of Security in an Exchange Server 2007 Environment
Sharepoint 2013 : List and library essentials - Organizing items by using folders
Sharepoint 2013 : List and library essentials - Sorting or filtering a list view
Sharepoint 2013 : List and library essentials - Creating and selecting a list view
Windows Server 2012 : Managing and Troubleshooting Hardware (part 11) - Resolving resource conflicts