Questions
What is IISLogs?
A program to help
administrators and developers easily manage log files created by Internet
Information Server 5.0, 6.0, 7.x and 3rd party programs. IISLogs provides
configurable options compressing files using ZIP format, and/or just deleting
files after a configurable setting. Another benefit you don’t have to
write or maintain custom scripts. This goes with our motto of
Install, Configure, Forget!
How do I get a copy of
the IISLogs?
Visit IISLogs evaluation webpage
http://www.iislogs.com/eval.aspx
What platforms will IISLogs run on?
Windows XP SP3, Windows 2003
SP2, Windows 2008 and greater, Windows Vista, Windows 7.
What version of .NET
Framework needed to run?
.Net Framework 4.0
What are the main
*features* of IISLogs?
There are many
options to configure IISLogs, each option provides their own configurable
settings to provide flexibility. The first option will allow for
monitoring one or more specific directories (c:wwwLogsw3svc1mySite).
An additional option will monitor entire directory structures.
Either option will compress
and/or delete files based on configured settings. IISLogs can be setup to
just compress files and/or delete files in the same directory structure.
What we mean by directory structures?
This is simple, by default,
Internet Information Server puts web log files in %SystemRoot%System32Logfiles
or %SystemDrive%InetpubLogsLogfiles directory with several sub-directories
below. There could be sub-directories for FTP, SMTP and WWW services; they might
be named such as (MSFTPSVC1, SMTPSVC1, W3SVC1, W3SVC2 etc.). This option
provides to monitor all of these sub-directories. If your running many
websites on the same server, you might have configured IIS to store these log
files in a different directory IE D:wwwlogs). IISLogs can monitor
custom directory structures also.
The second feature
is to monitor the directories associated with the Microsoft SMTP Service.
If your web applications use this functionality, these directories fill up with
un-needed files. This feature is simple; it deletes files after a certain
configurable date. This SMTP feature
is effective in helping keep
those directories free of 1000’s of bad emails and old files.
The
third feature is similar to the SMTP option; it will monitor specific
directories and delete files based on its own configured setting. Why does
IISLogs have this option when it can be setup in the first option?
First of all, this option monitors just single directories not entire directory
structures like the first option does. There are occasions where certain
directories need to have different retention periods that other directory
structures. This option provides for this very situation. File Naming
Options allows for someone to control what the ZIP file is named. This is
available in both the Stand-Alone and Windows Service version. Introduced
in IISLogs 2.0, IISLogs offers an option to have Per Directory settings using
the PerDirectory feature. The PerDirectory feature allows on a per folder basis
to have its own set of settings.
Starting in IISLogs 2.0, we
introduced a feature called PerDirectory. The PerDirectory option
provides the ability to control compressing and deleting files on a per folder
basis. Within the PerDirectory option, we added an option to process files
with no extension or ‘unknown’ extensions. This can be useful when 3rd
party products have their own naming convention. Additional in IISLogs,
we added functionality to run IISLogs in IISLogsGUI. Another requested
feature was an ‘Auto-Add’ option. If configured, every time IISLogs
executes, the ‘Auto-Add’ feature queries the local metabase for new sites, if
found IISLogs will process the new folders and add them to the configuration
file.
Starting with IISLogs 4.0,
another feature called ZipFile Storage preference. There are three
options (Daily, Weekly, Monthly). This has been a very popular request
among clients. The ZipFile Storage
preference is available both IISLogs Classic (SpecificDirectories,
Advanced Dir Config and PerDirectory feature. Another option is
when IISLogs compresses a file stored in an alternative location, either a
different directory on the same machine or UNC path. By default, IISLogs
preserves the original folder path when writing to disk. For example, if
store your IISLogs on c:inetpublogslogfilesw3svc1,
when a file is stored, keeps the original log path. When you disable
PreserveDirPath, IISLogs will not retain the original folder path and write
to the root of the alternative folder path.
For more information on
IISLogs 4.0 features, check out.
http://www.iislogs.com/help/iislogs40/Advanced_topics/advanced_topics.htm
Will IISLogs monitor
multiple directories?
It can monitor multiple directories or a single
directory, the preference is yours. The
SpecificDirectories monitors a specific folder.
The AdvancedDirConfig monitors an entire folder structure.
The PerDirectory offers the same option, either an individual folder or
and be recursive.
How much will IISLogs cost?
Visit our
purchase page,
http://www.iislogs.com/purchase.htm
Will IISLogs run as a Windows
Service or a stand-alone EXE?
There are two versions (IISLogs
Stand-alone EXE (.NET console application) and IISLogs Windows Service).
Will IISLogs require running as an Administrator credentials?
This has to be worked out with your configuration, the default architecture is
not to require running as an Administrator when using IISLogsEXE or IISLogsSVC.
If you are using IISLogsEXE, it will require permissions to the directories
where log files are configured. IISLogsSVC is set to run as SYSTEM.
IISLogsSVC can run as a non-Administrator if the account the service is running
as needs permissions to files and folders where log files are stored.
Does IISLogs read the IIS Metabase to get any IIS settings?
Yes,
using the IISLogsGUI, part of the IISLogs suite has a feature called
EasyConfig that will read the metabase and automatically configure the
required specific Directories. To use this feature on Windows Server 2008
and above, the IIS 6 Metabase Compatibility role service needs to be installed.
Can I turn off detail logging?
Yes, this will reduce the need
to receive a daily email on what happened on that particular machine. This
is only recommended if you want IISLogs to run and not be notified about what is
happening on the machine.
Will IISLogs run if I *JUST* xcopy the
IISLogs directory to another server without running setup.exe?
You
can xcopy the IISLogs directory to another server without running the setup.exe
as long as a few things are done. IISLogs is designed to be very easy to
distribute and setup on many computers without installing on every machine.
The xcopy option would be mainly used with IISLogsEXE, which is a .NET based
console application.
For IISLogsSVC, you would
need to install the service, then xcopy the IISLogsSVC.exe.config configuration
file to each server. After the xcopy for IISLogsSVC, I would recommend
testing if service needs to be restarted. Here are a few additional
items to keep in mind.
1) The server getting the files copied to is setup
setup the same or similar as the original server. The biggest thing is
where logfiles are stored. From experience, companies with a lot of web
servers typically store log files in a central directory (such as D:Logfiles or
D:wwwlogs).
2) Below the InstallDirOfIISLogslogsPolicyAgreements
directory is copied too. This is a security mechanism built into IISLogs
to insure the administrator has reviewed and tested their configuration before
deploying to a production environment. IISLogs won’t ZIP or Delete files
without these files being present.
3) The IISLogsEXE.exe.config or
IISLogsSVC.exe.config has the appropriate log file paths on the target server.
If you have further questions how to automate distribution of IISLogs
without having to manually install on every machine, please contact
[email protected]
Can I edit
IISLogs configuration files using a text editor? (IISLogsEXE.exe.config,
IISLogsSVC.exe.config, IISLogsPerDirectory.xml, (IISLogs40) and
SampleZipPerDirectory.xml (IISLogs 2.0))?
Yes, except for the MailUID
and and MailPWD values which ONLY can be done through IISLogsGUI. These
values are stored in an encrypted format.
How do I unzip or
un-compress several zip files so I can re-run my web stats program?
You can use the built-in Windows ability to highlight and un-compress all ZIP
files residing in the log file directories.
I wanted to know if IIS
Logs causes any system issues when installed on a Terminal Server.
There should be no
issue running IISLogs on machined configured as Terminal Services or Remote
Desktop Service. If you prefer, you can xcopy IISLogsEXE and schedule with
task scheduler, no installation is required, unless you are looking to run
IISLogs Windows Service version. The assumption if you xcopy, just install
on a separate machine.
The instructions say to copy the full version
lic.xml file to the license folder
After you purchase IISLogs,
a welcome aboard message will be sent which includes a file called ‘lic.xml’.
You’ll copy the file to IISLogsInstallPathLogsLicense.
What is ‘ZipFilePath’ and
‘Monitor ZipFilePath Directory checkbox’ do exactly?
The
ZipFilePath tells IISLogs where to
store log files. The default is “local”, which keeps files in the same folder
where original logs were created. You have IISLogs configured to store on a
remote system. IISLogs was designed to allow many servers write to a remote
server into separate folders. It appends the computer name and original folder
path.
For example, if you servers named Web1, Web2 and have logs configured to store locally. You install IISLogs on each system and configure to store files a remote system. You’ll see the original folder path below a folders named Web1, Web2. This allows for a web-farm to write to a central SAN or NAS. Since the IIS site id is the same across a web-farm, trying to have multiple servers write to a single location would be tricky. The way IISLogs is designed, it helps with this situation.
The Monitor ZipFilePath
checkbox will monitor the remote location to compress and delete files where
files are centrally stored.
I need to deploy IISLogs to a farm of web
servers. Is there a way possible to deploy IISLogs as a silent installation with
a pre-configured config file so that they all have the same configuration?
IISLogs uses MSI based installer which provides a /passive switch.
For example, you can run IISLogsSVC.msi /passive and it installed the
service with the default configuration.
As far as a pre-configured file, you could be able to send out a
pre-configured file setup on a "gold machine". One of the design goals of
IISLogs is to provide xcopy and truly install, configure and forget.
Our web servers tend to have varied folder structures. Within
C:Windowssystem32logfiles, the W3SVC folders can be numbered normally (1, 2,
3. etc), but I have seen folders with non-standard names (e.g.
C:Windowssystem32logfilesW3SVC987654321). Is there any way to use the Per
Directory feature to *only* target W3SVC folders?
We’d recommend
using the PerDirectory feature or
look at using the Auto-Add feature. The one requirement to use the Auto-Add
feature on Windows Server 2008 is the IIS 6.0 metabase compatibility role
service needs to be installed. Every time IISLogs executes, it’ll determine if a
new site needs processing, if new sites are added, it reads from the metabase to
get the log directory. The Per Directory feature is a very powerful and flexible
option. I’d check out this article on Per Directory.
Per Directory
Article
http://www.iislogs.com/perdirectory4.aspx
Check out the FAQ, there is
some descriptions of how Per Directory works.
http://www.iislogs.com/faq.aspx
Auto-Add options
http://www.iislogs.com/help/IISLogs40/Getting_Started/WindowsService/configure_autoadd.htm
IISLogs is deployed to all
the web servers in our environment. If I needed to make a global configuration
change, what steps would this entail? Would I have to create a batch file that
1) Copy the config file to all servers and 2) restarts the IISLog service? Am I
missing anything in this process?
There shouldn’t a need
to restart the service, just copy the new config file with a batch file. IISLogs
service is designed to look for changes every time it runs. If you copy a new
configuration file, the changes won’t be picked up until the configuration file
is reviewed by the service.
What is the expected behavior if I have
both "Enable ZIP Feature" and "Enable Delete Feature" selected? I was expecting
the application to first zip the log files to the UNC path I specified and then
it would delete the files based on the "Delete Files Older Than" parameter
(which I set for an hour after "Zip Files Older Than"). But it appears to be
deleting the files before doing any archiving and transport of the files to the
remote location. Is this correct?
The logic IISLogs performs if you
have both ZIP and DELETE options enabled, IISLogs will determine if a file needs
to be ZIPPED OR DELETED based on the configured settings. If the DELETED option
is determined to happen, IISLogs just deletes the file. In our testing, we set
the ZIP option to 48 hours, 49 hours to delete. The test files were several
months old. IISLogs assumes to remove the file, which is the same as your
configuration. When a person is initially implementing IISLogs and log files are
older than their preferred settings, it’ll take some time to have everything
come into line. I can understand your assumptions. You’ve helped us realize
articles, documentation need to explain the logic in a more clear fashion.
What we would recommend would be to configure ‘ZIP’ only and not the delete
portion until later on.
I get an error when trying to add a directory
to Per Directory feature. Here is the error “Per Directory, Column ZipFilePath
contains an invalid path, please correct and try again”.
The error is
occurring because IISLogsGUI validates the folder path. The folder mentioned is
not created most likely. You can create the folder path ahead of time so
IISLogsGUI will work.
I was playing around changing different config
settings to see how they would work and configured the ‘PerDirectory’ settings.
Now when I got to remove those settings to use the ‘Specific Directories’ or
‘Advanced Dir Config’ settings, it will not let me clear out the ‘per directory’
settings. I get validation errors and it complains about there not being a path
after I remove it.
Here is an explanation of how “SpecificDirectories”
and “AdvancedDirConfig” work compared to “PerDirectory”. When IISLogs 1.0 was
designed, we only offered “SpecificDirectories” and “AdvancedDirConfig”. When
settings were applied for compressing or deleting files, all folders inherited
the same settings and was stored in IISLogsSVC.exe.config (Windows service
version), IISLogsEXE.exe.config (IISLogs Stand-Alone EXE).
In IISLogs
2.0, we added Per Directory to allow more flexibility. The configuration for Per
directory is stored in SampleZipPerDirectory.xml within the IISLogs install
folder. The “SpecificDirectories” and “AdvancedDirConfig” configuration is
stored in IISLogsSVC.exe.config or IISLogsEXE.exe.config.
Is there a
way to run the service monthly, like on the 1st of every month, and perhaps zip
all the IIS logs for the month into one zip file? So far I see that it runs
daily (or multiple times a day), which may be just fine if that’s our only
choice.
Introduced in IISLogs 4.0, we support three options (Daily,
Weekly, Monthly). Please visit our
help section for more information.
http://www.iislogs.com/help/iislogs40/Advanced_topics/advanced_topics.htm
Regarding running IISLogs
service on a monthly basis, IISLogs Service edition was designed to run on a
daily basis. One workaround you could do is set IISLogs configuration to
compress files older than 30 days. IISLogs would execute every day, no files
would be impacted.
If you prefer to only execute once a month, we
recommend using IISLogsEXE (stand-alone exe) and an external task scheduler
(windows task scheduler for example). We offer clients the ability to mix and
match which versions of IISLogs they use and you don’t have to use one or the
other.
The ‘PerDirectory’ option is nice because it allows choosing
an archive directory for each individual IIS folder. The issue I found inside
the archive folder where it places the zip file, it also includes the whole path
where the original log file was located. So if it was under E:logsW3SVC, and I
choose to drop the zip file in the archive folder under that at
E:logsW3SVCarchive, it then drops the file in the following path:
E:logsW3SVCarchivelogsW3SVC.
IISLogs “preserves” the original
folder path when writing to either locally to an alternate location or a remote
file system. One of the design principals was to allow web-farms to write to a
single remote location. When working in web-farms, the site ids are the same so
we designed IISLogs to help multiple machines to write to a single location. One
thing you’ll notice is the ‘machine name’ is included in the alternative folder
path. In the PerDirectory option, you can turn this off, but the original folder
path is preserved.
In IISLogs 1.0 and 2.0, there is no way to ‘remove’
the ‘original’ folder path when moving the zip to an alternative location
(either local on disk or remote system).
Introduced in IISLogs 4.0,
we have enabled within the PerDirectory feature to disable folder paths being
preserved. Please see our help section for a more detailed explanation.
http://www.iislogs.com/help/IISLogs40/Advanced_topics/advanced_topics.htm
I wanted to know if I can
add other directories that are non-IIS based. An example is I have other
products that write many log files in * .txt format I would like to zip up and
then delete. Can IISLogs work this way?
IISLogs handles files
based on file extension. We have an extra configuration for .txt based files.
When you configure the directory, or sets of directories containing .txt
extensions, you would enable the .txt file extension. In IISLogsGUI, you would
see .txt available per the link below.
http://www.iislogs.com/help/IISLogs20/Getting_Started/WindowsService/configure_autoadd.htm
I also would like to delete
SharePoint server logs. Can IISLogs handle this?
IISLogs can also handle
SharePoint logs. You would need to configure the directories where SharePoint is
storing logs.
How do I configure IISLogs Windows Service version to
ignore today’s log file and proceed with the rotation of yesterday’s log file?
IISLogs uses the "LastWriteTime" property to determine when a file
will be processed. I would recommend is zip files that are older than 25 hours.
Using 25 hours, it’ll leave the current active log along, zip previous files
that are approximately one day old. IISLogs is designed to zip files one hour
older. IIS has a setting to roll logs on a per hour basis, although the default
is 24 hours (1 day).
We want to relocate our log files as well as
archive them. We have a web farm and multiple application servers. We want to
configure the application to copy the log files to one (for statistical
analysis), zip said log file and move it to another server (archival), then
delete the log file from its current location (house-keeping). Is this possible
with IIS Log? If so, what are the settings?
IISLogs out of the box
will not ‘move’ files without zipping to a remote location. I had a similar
requirement to what you described. I wrote a utility to ‘move’ files based on
IISLogs technology. What you could do is use this utility to move files to a
remote location. There is no extra cost for this utility. Then you could use
IISLogs to process files on the ‘statistical analysis’ server, and then move to
your ‘archival’ server.
IISLogs 4.0 offers two options to move files to
a remote location.
1) You can use our per directory feature. Here is an
article for more information.
http://www.iislogs.com/perdirectory4.aspx
2) The second option is
described in an article how-to setup on a remote server.
http://www.iislogs.com/help/iislogs40/how_to_setup_iislogs_to_save_zip_to_remote_server.htm
Both options you’ll have to
define the local directories and remote location using a UNC format. The
PerDirectory option allows for moving to multiple locations. The second option
only allows files / folders to a single remote location. The account running the
service will need appropriate permissions on the ‘number crunching’ and
‘archiving server’. Let us know if you have any further questions.
Does IISLogs support UNC paths? We essentially want to pull the logs back to a
central server and archive them.
IISLogs can archive files on a remote server. Here is an article I wrote that
explains how IISLogs moves files to a remote share.
http://www.iislogs.com/help/iislogs40/how_to_setup_iislogs_to_save_zip_to_remote_server.htm
Does IISLogs support using
FTP of zip files to remote locations
IISLogs uses traditional windows file and print sharing to copy to remote
machines.
Will IISLogs zip a log file to a remote location that is not
an IIS Log file? I believe the idea is to possibly use the tool on a
webmail/exchange server. What are your thoughts on using the tool for this
purpose? I can see in the help files this appears to be supported. I’m not sure
how permissions would work. I did not see where I can provide a domain user and
pw for remote copying. If this is the case then I guess an open share is the
only other option?
IISLogs can process a file and folder on a remote
location. IISLogs will first zip the file locally, and then copy the file
remotely. If there is an error copying remotely, the file stays locally on the
source server. I put a link to an article how to zip to a remote share. We do
not store credentials in IISLogs. IISLogs relies on the operating system. For
example, if you are running IISLogsEXE and a scheduled task, the user of the
scheduled task needs permissions remotely. If you are using the Windows Service,
the user IISLogsSVC runs as needs permissions remotely, which usually a domain
account. IISLogs will first zip the file locally and then move the file
remotely. If there is an error moving remotely, the file stays locally on the
source server. IISLogs does not ‘copy’, it ‘moves’ the file.
IISLogs is
really an all-purpose log processing tool; the architecture is based on file
extension. We have customers using IISLogs for mail server software, sql server
backups and other non-IIS related products.
One of our security checks
is to not process standard file system extensions. We have a feature called
‘process unknown’ extensions, this allows for processing files that don’t have
an extension, something that stamps a standard date time (filename.20090916) for
example.
http://www.iislogs.com/help/iislogs40/how_to_setup_iislogs_to_save_zip_to_remote_server.htm
The extensions from the
exchange box are .txt and .log files.
Just enable the .txt extension. .Log is already being processed.
Does the service have to be installed on every server I want to manage the
logs?
The design of IISLogs is to run on every server. In theory,
you could run IISLogs on a single machine and process logs remotely. I would
suggest you test this type of implementation before proceeding with production.
If the remote machine has permissions on the remote server, it should be able to
compress and / or delete files. In the file path, you would put an UNC location
vs. a local file path.
I have a question for you concerning the
naming conventions. The files are zipped and are copied to for example
\servernamelogfilesw3svc### Is there any way to rename the destination
directory to any text other than w3svc### for example the DNS name so that the
tool will continue to function as designed. So our customers can browse to their
log files to retrieve them without the support staff having to correspond the
WebID to the customer web site logs.
IISLogs does not have the
flexibility to name the remote folder to a custom name. One workaround would be
to create a ‘friendly’ virtual folder name in the customers website pointed to
the folder with the name. This would provide a way to lower your administrative
costs and provide a friendly name to your customer.
Can you tell me
more about the custom naming convention?
Here is a link to the help
file.
Click on File Naming
Convention configuration options. This allows you to change the format of the
file.
Does IISLogs write to the registry?
Kind of sort of, when you are using IISLogsGUI, when you
click the open dialog folder, it stores
IISLogs 4.0
configuration settings to
HKEY_CURRENT_USERSoftwareVB and VBA Program SettingsIISLOGSGUIMain
When I specify the directory to put the
zipped log files, I specified c:websitelogs It placed the zip in the following
location:
c:websitelogsWEB1windowssystem32logfilesw3svc1823620402ex12345.log.zip
Is there any way it can be set to simply put the file here:
c:websitelogsWEB1w3svc1823620402ex12345.log.zip
or even
c:websitelogsWEB1ex12345.log.zip or something?
You are referring
to ZipFilePath Directory path
variable. This variable is designed
to centralize all logs on a UNC path. It can be used to centralize logs locally
on the same computer also. Regarding the
\WEB1windowssystem32logfilesw3svc1823620402ex12345.log.zip. This is done
by design for companies that want to have multiple machines writing their logs
to a central location. The file location will be automatically appended
including the computer name. The
PerDirectory feature in IISLogs 4.0 allows you to decide if you want the
computer name and original folder path included on the remote file / folder
names.
Every time I run IISLogsGUI, it requires me to select the
config file. Is there a way to create a shortcut and specify where the config
file is as command line parameter?
This is the default behavior of
IISLogsGUI. You’ll be asked for the configuration file every time you open
IISLogGUI. There is no command line parameter or registry entry to have
IISLogsGUI remembers the last config file.
Is there an easy way to
automate IISLogs via the scheduler or command line?
The service
version has a built-in timer feature that would automate scheduled tasked.
IISLogs Stand-Alone EXE needs to use a 3rd party scheduler program, such as
Windows Task schedule.
Here is a sample command line to create a
scheduled task on Windows Server 2008 and greater
%SystemRoot%System32schtasks.exe /create /RU MachineNameUserName /RP "*******" /SC Daily /TN "Zip Logs Daily" /TR "D:UtilsIISLogsEXE4IISLogsEXE.exe" /ST 03:00 /SD 01/03/2023
Is there a way to do recursive searches for
logs within folders?
We support deleting / compressing files using a
recursive feature. We don’t have the ability to perform just searches
recursively.
Can I get a utility to restore all folders? We started
doing this manually but with over 100’s of websites with years of history this
is impossible. I just need to restore everything long enough to run "snap-shots"
or otherwise analyze the traffic from time to time..
We don’t have
any method of using IISLogs to ‘unzip’ logs in several directories. I would recommend a VBS script potentially with the WinZip command
line utility.
Does IISLogs support zipping each days log file
individually and moving them to a secondary folder then deleting the original
file?
IISLogs 4.0 introduced an architecture change how files working
with zip files written to alternative locations
In previous IISLogs versions, IISLogs would compress the file locally,
then move to an alternative location.
In IISLogs 4.0, to support
ZipFile Storage preferences (Daily, Weekly, Monthly), the file is directly
zipped to either the local or alternative location, then the original file is
removed if the option to “delete original log file” is selected.
Can IISLogs safely run on a
64bit machines?
IISLogs 2.0, 4.0 are
supported on all platforms the .NET 2.0 and .NET 4.0 frameworks will run on,
either 32 or 64 bit. IISLogs 2.0 and 4.0 are currently compiled as 32 bit.
Can you explain ZipRetentionPeriod and DeleteRetentionPeriods?
The logic internally to IISLogs compares the ZipRetentionPeriod and
DeleteRetentionPeriod values. If the DeleteRetentionPeriod value is less than
ZipRetentionPeriod, the file won’t be processed. This is a safety feature. We
made a design decision to never allow the DeleteRetentionPeriod value to be less
than ZipRetenionPeriod. The thinking behind this was an administrator would want
to zip and retain a file, then delete later. IISLogs is a flexible product.
Sometimes things like this happen because we were careful in making sure a file
was processed in a certain order.
We’re getting messages in the
application log files, can this be turned off?
You can disable
messages from being written to the Event log. Here are the steps.
1) Go
to the Install folder of IISLogs
2) Open IISLogsEXe.exe.config or
IISLogsSVC.exe.config using a text editor such as Notepad.
3) Change the
True
value to False in this location
<!–Begin EVENTLOG configuration –>
<!–This writes an informational message to the local computers Application
eventlog–>
<add key="UseEventLog" value="True" />
<!–End EVENTLOG
configuration entries–>
4) Save the file.
After perform this
procedure, IISLogs system messages will not be written to the event log.