Besides the standard IIS type logs, other items can
be logged. Many of these options can be set with the IIS Manager or by
using Appcmd.
Process Recycling Logging
In IIS 7.0, events are
logged to the Windows event log when an application pool recycles. You
can control eight configuration settings with each option listed in Table 1.
Table 1. Recycling Options Under Generate Recycle Event Log Entry
| Option | Description | Default Setting |
|---|
| Application Pool Configuration Changed | Event is logged when the application pool recycles due to a change in its configuration | No |
| ISAPI Report Unhealthy | Event is logged because an ISAPI extension has reported itself as unhealthy | No |
| Manual Recycle | Event is logged when the application pool has been manually recycled | No |
| Private Memory Limit Exceeded | Event is logged when the application pool recycles after exceeding its private memory limit | Yes |
| Regular Time Interval | Event is logged when the application pool recycles on its scheduled interval | Yes |
| Request Limit Exceeded | Event is logged when the application pool recycles after exceeding its request limit | No |
| Specific Time | Event is logged when the application pool recycles at a scheduled time | No |
| Virtual Memory Limit Exceeded | Event is logged when the application pool recycles after exceeding its virtual memory limits | Yes |
ASP
Classic
ASP (Active Server Pages) is alive and well in IIS 7.0, and you can
configure options for logging ASP errors under the ASP section in the
IIS Manager. Use the following options to discover issues when migrating
your Classic ASP applications to IIS 7.0.
These options are available
in IIS 6.0, but you have to use ADSUtil.vbs to enable them in the
metabase. Now, in IIS 7.0, you can use the IIS Manager to enable these
options.
ASP.NET
All ASP.NET 2.0 unhandled
exceptions are written to the Application Event log. Along with
application pool recycle events or other errors in the event logs, this
can be very helpful in troubleshooting application errors. You can turn
off ASP.NET logging by following the instructions in the Knowledge Base
article at http://support.microsoft.com/kb/911816.
IIS Events
Other processes
related to IIS also log to the Windows Event log. This includes the
HTTP, IISAdmin, FTP Publishing Service, and W3SVC services. For a
complete list of events, go to http://technet.microsoft.com and search for “IIS events reference.”
Folder Compression Option
Log files are necessary
to keep track of Web site statistics and trends, and Web developers and
business people use them to ensure their Web sites continue to grow. One
of the biggest challenges administrators face is how to retain and
manage log files. By default, IIS rolls over log files once a day. Your
log files can become quite large even if you use the default log file
rollover setting.
Windows Server 2008 allows for folder compression to help save space. You can enable this option by using Windows Explorer. Figure 1
shows a folder with compression enabled. In this example, the size of
the folder is 166 megabytes (MB), but the actual space the folder uses
on the disk is only 43.1 MB. If your uncompressed log files take up
several gigabytes (GB), you could save yourself a lot of disk space by
using folder compression.
Because
HTTP.sys buffers information written to the IIS log files, there will
not be a performance hit if your log files are in a folder for which
compression is enabled. Some people use third-party log compression
products or free tools such as Gzip along with scripts to compress their
log files. Unless you have a tool that searches inside zip files, this
is an acceptable method only if you rarely need to unzip and search your
archived log files. If you have compression enabled, however, you can
leave your files in their original, easily searchable state. At most,
you’ll need to implement some type of archival and deletion script by
using your favorite script or third-party program.
Using the built-in
compression feature provided by Windows Server 2008 can save you disk
space and simplify how you retain your log files.
Logging Analysis Using Log Parser
You can download Log Parser at http://www.iis.net/go/1287.
Here are three examples of using Log Parser to extract common information from your IIS logs:
1. | List the top 25 (most frequent) WebRequests:
LogParser -i:iisw3c "SELECT TOP 25 cs-uri-stem,
COUNT(*) AS HitCount INTO Results.csv FROM LOGFILENAME.LOG
GROUP BY cs-uri-stem ORDER BY HitCount DESC" -o:csv
|
2. | Show the 25 requests that take the longest to execute:
//Change the date to fit your needs
SELECT
TOP 25
CS-URI-STEM,
TIME-TAKEN
FROM LOGFILENAME.LOG
WHERE DATE > '2007-03-26'
ORDER BY TIME-TAKEN DESC
|
3. | Select information between two dates and pipe results to a text file named Output.txt:
SELECT
DATE,
TIME,
CS-URI-STEM,
SC-STATUS,
COUNT(*) AS MaxTime
INTO Output.txt
FROM LOGFILENAME.LOG
WHERE TO_TIME(time)
BETWEEN
TIMESTAMP('01/01 13:50:00', 'MM/dd hh:mm:ss') AND
TIMESTAMP('01/01 18:30:00', 'MM/dd hh:mm:ss') AND SC-STATUS = 500
GROUP BY
CS-URI-STEM,
DATE,
TIME,
SC-STATUS
ORDER BY MaxTime DESC
|
If you are
responsible for maintaining an IIS environment, take a look at Log
Parser. You’ll want to make it one of your main tools when
troubleshooting all kinds of issues. (For more information about Log
Parser, visit the community forums at http://forums.iis.net/default.aspx?GroupID=51.)
