Archive for the Category IIS


Help with IIS7 Log Files

You guys and your log files…

Everytime there’s a headache in SharePoint or IIS the first response is always “Check the log files” and I’m sitting here saying… well never mind what I say but obviously there’s some gaps in our understanding of how our log files can contribute to a smooth operation.

Lucky for us, our new best friend Chris helps get us started here.

Being new to IIS7, I’m still struggling to find the new way to do the things I already knew how to do. The problem I was having was that my homepage.html had not been included in the list of default documents. Consequently, the browser was landing on the root folder and attempting to browse the directory, which, by default in IIS7, is disabled. So I’m getting a 403 Forbidden error. That was not much help so I set about trying to figure out what permissions I had to set where to allow my web user see my hopepage.

Now, I found the log files all by myself in c:\inetpub\logs where there’s a \FailedReqLogFiles folder and a \logs folder. Since the former was empty, I looked in the latter and was able to sort by modified date and figure out my log entries we getting written to:

\W3SVC5\u_ex100506.log file

I’m thinking the 5 is a serial number for the fifth web site on the server. I also like the 100506 number at the end of the file name. This is the create date in YYMMDD format. I love this format since it keeps dates in alphabetical order and dispenses with the 20.. verbosity allowing us to regain the efficiencies that we all lost in fear of the Y2K bug.

Just as Chris described, in that log file I found something that looked like this:

#Software: Microsoft Internet Information Services 5.1
#Version: 1.0
#Date: 2005-08-26 18:19:49
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes
2005-08-26 18:33:30 W3SVC68783193 SBS2003 GET /images/ – 80 – HTTP/1.1 403 14 5 412 433

Okay, this is the best Microsoft can do trying to help us but it alot better than it could be. Software, Version and Date are no brainers. #Fields is a space-delimited list of the names of the fields that follow in the subsequent list. You can match the values in the following lines with the names in the #Fields line and you’ve got a real set of name-value pairs. (You know how robots love NVPs!)

Reading from the end, right to left, you can ignore the  sc-win32-status sc-bytes cs-bytes and have a look at my sc-status sc-substatus values: 403 & 14.

Well, Chris is nice enough to tell us that the sc-substatus value 14 means directory browsing is disallowed and I was able to drill into the IIS7 console and enable it. My host header dropped me on my site root directory pretty as punch which left me trying to figure out why my homepage.html wasn’t loading and so I looked at the Default Documents “feature” in IIS7 and, of course, found it missing. After all, what headbone names the homepage homepage.html when they know that IIS wants it to be called default.htm?

I added my homepage.html to my list of default document, restarted the website just for fun and site works fine, thank you very much, Chris. And, yes, I went back and disabled directory browsing.

So, like a guy that really gets the “V” in “MVP” Chris goes on to list a good number of the sc-status codes and sc-substatus codes you might encounter in your IIS log files.

All in all, less painful than a root canal and a whole lot better than a “check the log files” slap which, to be honest is less kind than a good page slap. At least, now, we know where the log files live.