Logging

In simple words#

Learning objectives#

• Find and read IIS logs
• Choose useful fields
• Log the real client IP behind proxies
• Analyse logs with PowerShell

Explanation#

Default location: %SystemDrive%\inetpub\logs\LogFiles\W3SVC<siteId>\u_exYYMMDD.log, one file per day.

Add useful fields: time-taken, cs-host, sc-substatus, sc-win32-status, cs(User-Agent), cs(Referer).

Behind a load balancer, add a custom field for X-Forwarded-For to capture the real client IP.

Logs are written with a short delay (buffered). Rotate and archive them; they can fill disks.

Code example: Find slow and failing requests#

1$log = Get-ChildItem "C:\inetpub\logs\LogFiles\W3SVC1\*.log" | Sort-Object LastWriteTime | Select-Object -Last 1
2$fields = (Get-Content $log.FullName -TotalCount 5 | Where-Object { $_ -like '#Fields:*' }) -replace '#Fields: ' -split ' '
3

4$rows = Get-Content $log.FullName | Where-Object { $_ -notlike '#*' } | ConvertFrom-Csv -Delimiter ' ' -Header $fields
5

6$rows | Where-Object { [int]$_.'sc-status' -ge 500 } | Group-Object 'cs-uri-stem' | Sort-Object Count -Desc | Select-Object -First 5 Count, Name
7$rows | Sort-Object { [int]$_.'time-taken' } -Descending | Select-Object -First 5 'cs-uri-stem', 'time-taken', 'sc-status'
8

9# Add X-Forwarded-For as a custom field (site level)
10# Add-WebConfigurationProperty -PSPath IIS:\ -Filter "system.applicationHost/sites/site[@name='Shop']/logFile/customFields" -Name "." `
11#   -Value @{ logFieldName='X-Forwarded-For'; sourceName='X-Forwarded-For'; sourceType='RequestHeader' }

Count Name
----- ----
   42 /api/orders
    3 /checkout

cs-uri-stem      time-taken sc-status
-----------      ---------- ---------
/api/reports         8734       200
/api/orders          5120       500

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

1. The latest log file for site 1 is read.
2. The #Fields header provides column names.
3. Errors are grouped by URL; slow requests are sorted by time-taken.
4. A custom field can log the real client IP.

Real-world use case#

Common mistakes#

Best practices#

• Add time-taken and sub-status fields
• Log the real client IP
• Rotate and archive logs
• Ship logs to a central tool

Remember this#

Practice exercise#

1Set-ItemProperty "IIS:\Sites\Shop" -Name logFile.directory -Value "D:\iislogs"

Mini quiz#

Want more? Practise all IIS MCQs · IIS interview questions

Related topics#

My notes#

Saved in this browser.