Techie BabajiLearn to Code. Build Real Skills.
IIS (Internet Information Services) · Operations

Failed Request Tracing

When logs say “500” but not why, Failed Request Tracing shows every step IIS took for that request.

Advanced 5 min Lesson 28 of 33Covers IIS 10 on Windows Server 2019/2022/2025 and Windows 10/11.
Before you start:Logging
0/33 in IIS
On this page · 5 min · Advanced

On this page

  1. In simple words
  2. Learning objectives
  3. Explanation
  4. Code example
  5. Step by step
  6. Real-world use
  7. Common mistakes
  8. Best practices
  9. Remember this
  10. Practice exercise
  11. Mini quiz
  12. Related topics
  13. My notes
Reading time
5 min
Difficulty
Advanced
Updated
Oct 30, 2026

Related tutorials

Interview questions

In simple words#

Normal logs are the gate register (“visitor came, left angry”). Failed Request Tracing is CCTV inside the building for selected visitors — you see every room they entered and exactly where things went wrong.

FREB
Failed Request Event Buffering — detailed per-request trace.
Trace rule
Which requests to capture (status codes, time).
Module
The pipeline component that handled or failed the request.

Learning objectives#

  • Install and enable Failed Request Tracing
  • Create trace rules
  • Read a trace file
  • Find slow or failing modules

Explanation#

Install the Tracing role service (Web-Http-Tracing), then enable tracing for the site.

Add rules: e.g. status codes 500-599, or time taken over 5 seconds, for specific paths.

Traces are saved as XML in %SystemDrive%\inetpub\logs\FailedReqLogFiles\W3SVC<id> and open in a browser with a readable stylesheet.

Turn tracing off after diagnosing — it adds overhead.

Code example: Trace slow or failing requests#

PowerShellTrace slow or failing requests Illustrative
Install-WindowsFeature Web-Http-Tracing
Import-Module WebAdministration


Set-WebConfigurationProperty -PSPath IIS:\ -Filter "system.applicationHost/sites/site[@name='Shop']/traceFailedRequestsLogging" `
  -Name enabled -Value $true


Add-WebConfigurationProperty -PSPath "IIS:\Sites\Shop" -Filter "system.webServer/tracing/traceFailedRequests" -Name "." -Value @{
  path = '*'
  failureDefinitions = @{ statusCodes = '500-599'; timeTaken = '00:00:05' }
}
Add-WebConfigurationProperty -PSPath "IIS:\Sites\Shop" `
  -Filter "system.webServer/tracing/traceFailedRequests/add[@path='*']/traceAreas" -Name "." `
  -Value @{ provider = 'WWW Server'; areas = 'Authentication,Security,Filter,StaticFile,Compression,Cache,RequestNotifications,Module,Rewrite'; verbosity = 'Verbose' }


Get-ChildItem C:\inetpub\logs\FailedReqLogFiles\W3SVC1 | Select-Object -Last 3 Name, LastWriteTime
Expected output
Name          LastWriteTime
----          -------------
fr000012.xml  30-10-2026 10:42:11
fr000013.xml  30-10-2026 10:44:56
(open in a browser → "Request Summary" shows the failing module, e.g. RewriteModule, and the time spent in each step)

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. The tracing role service is installed.
  2. Tracing is enabled for the Shop site.
  3. A rule captures 5xx responses and requests over 5 seconds.
  4. Trace XML files appear per failed request.

Real-world use case#

A random 500 error is traced to a URL Rewrite rule looping on one path — something the normal log could never show.

Common mistakes#

Leaving tracing on permanently

It costs CPU and disk. Enable while diagnosing, then disable.

Too broad rules

Tracing every request produces thousands of files. Target status codes and paths.

Best practices#

  • Narrow rules by status and path
  • Disable after use
  • Read the Request Summary first
  • Combine with stdout and app logs

Remember this#

FREB = step-by-step trace of a request.

Rules: status codes or time taken.

Files: inetpub\logs\FailedReqLogFiles.

Practice exercise#

Your task: Disable failed request tracing for the Shop site.

Show solution
PowerShell Illustrative
Set-WebConfigurationProperty -PSPath IIS:\ -Filter "system.applicationHost/sites/site[@name='Shop']/traceFailedRequestsLogging" -Name enabled -Value $false

Mini quiz#

Failed Request Tracing quizMultiple choice Question 1 of 1

What does Failed Request Tracing show that normal logs do not?

Score so far: 0/0

Want more? Practise all IIS MCQs · IIS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.