Despairing for IIS error logs

This has been bugging me for many months, essentially every time I need to troubleshoot a deployment issue related to IIS.
Where are the damn error logs!?!?

It just drives me nuts that IIS6.0 returns a 404 when an ISAPI extension wasn't correctly enabled (new IIS6.0 security feature) without any information to direct you to the actual source of the problem. There is no event log either.
Same thing with ATL when an unknown handler tag is found or there is a typo that breaks the syntax: you need to recompile with some extra debug flags, to get more info that the default "500".

Apache comparison:
Apache provides a very useful and descriptive error log. Below is a simplified sample of what Apache traces.

[Thu May 20 09:42:05 2004] [error] [client x.x.x.x] File does not exist: /home/y
[Thu May 20 09:42:05 2004] [error] (2)No such file or directory: Incorrect permissions on webroot "/home/y" and webroot's _vti_pvt directory in FrontPageAlias().
[Mon May 17 23:56:10 2004] [error] [client x.x.x.x] Directory index forbidden by rule: /home/y

Errors in dynamic content (CGI, perl, ...) usually show up in there as well, by default, which makes it so much easier to troubleshoot, while staying secure.

These logs can be monitored interactively with utilities like tail with the "-f" option.

Posted by Julien on May 20, 2004. Permalink
Comments
comments powered by Disqus

Yes!! Doesn't that suck!?? I am not sure if they don't exist yet... but how about this: Search for "error log" in the IIS manager help, and you get... NO TOPICS! And the troubleshooting tips don't even mention looking at the error log... the most BASIC and ESSENTIAL thing in Apace!

Posted by: Chris at August 19, 2004 12:03 PM

There are some IIS logs at C:\WINNT\system32\LogFiles\W3SVC1

Posted by: bill at February 7, 2005 12:34 AM

Bill, these are regular access logs. When you run into a problem (say a 401, 500,...) they only contain the error code, some IP addresses, the querystring, cookies, ...
But the Apache error logs are much, much more useful for troubleshooting. They give you a textual description of the error (couldn't find file x, couldn't get read permission to file x, script blah couldn't load include script foo,...) that are much more informative than the simple HTTP codes.

Posted by: Julien at February 7, 2005 09:00 AM

system32\LogFiles\HTTPERR

Posted by: kevlay at February 14, 2005 12:37 AM

Kev, httperr logs in IIS6 are for requests that are rejected by http.sys.
They don't provide any level of application- or configuration-specific information.

Posted by: Julien Couvreur at February 15, 2005 04:27 PM

This URL may help you find some information about worker status.

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/87892589-4eda-4003-b4ac-3879eac4bf48.mspx

Posted by: Gabe Brown at June 28, 2005 04:35 PM

Gabe, the logs that I'm looking for are general error logs, not specifically for worker process events.
An example is when IIS returns a 404 because an extension was not enabled (new security feature in IIS6.0). It's actually super hard to figure out what is going on.

Posted by: Julien at June 28, 2005 04:49 PM

Actually if you look at the sub-status field in that IIS log, you should have a pretty good idea why the 404 is happening. I believe Log Parser (http://www.logparser.com) has an example of how to pull these out.

Posted by: jeff at June 28, 2005 05:42 PM

oh lord - why oh why can't MS keep things simple.
I mean -"Worker Process Recycling Events"? - as a developer you need a error log - it's that simple.


I believe that Sagat (funk dat) would 'rap' about it something like this.

QUOTE:
"everytime I try to develop with IIS and I theres an error, the online help tells me to look for 'Worker Process Recycling Event' - comon man - FUNK DAT!"
- could've been Sagat

Posted by: JL at September 21, 2005 02:24 AM

I feel your pain. I've also been trying to track down the error logs and poking through the multiple IIS configuration screens, desperately trying to find the location of the error log file. Then I found an error message saying that the details could be found in the application log, aha! Control Panel->Administrative tools->Computer Management->Event Viewer->Application. Simple :-P I know that it's crashing because of a bad configuration file (I broke it myself, now looking for specific errors) it gives me this:

"aspnet_wp.exe could not be started. The error code for the failure is 80004005. This error can be caused when the worker process account has insufficient rights to read the .NET Framework files. Please ensure that the .NET Framework is correctly installed and that the ACLs on the installation directory allow access to the configured account."

Oh man, give me nice Apache error logs any day. I've just wasted hours on this

Posted by: Dave at December 12, 2005 09:25 AM
Trackbacks