How to collect IIS Logs for a SharePoint Web Application


Hello All,

When working with Microsoft Support for some cases the support engineers ( like me ) may request IIS Logs for investigation.
So in this article i am going to tell how you can collect IIS Logs correctly.

1) You have to detect your IIS Web site on IIS Console because your site url and your web application name can be different.
First connect your Central Administration and click “Managed Web Application”‘s link .

but my Web Application Name is SharePoint – 8080

2) Open your IIS Manager and find and click your webapplication name

3) Click the “Advanced Settings” in Action pane.

4) Please not your IISsite ID for this example is 1442344892

5) Click “Logging” icon

6) Detect where the IIS logs are kept in which folder

7) Open this folder in Windows Explorer and find your related folder in it according your IISSite ID. In this scenario the folder is W3SVC1442344892
You can open windows explorer by “Start” -> “Run” and copy paste highlighted path on above screenshot and press enter.

8) Open that folder and order by “Modified Date” as descending order

9) Collect your files according to occurrance time of your problem or issue. If you have a workspace opened by Microsoft and your file size are big , you can compress the files with a compression program.

Notes: IIS buffers the logs in memory for a while before write to the log file (until log buffer chuck size has reached its max size). If you want to catch latest records you may need to do an iisreset or open a command prompt and type  “netsh http flush logbuffer” (this command will provide http.sys to flush logs.)
to force iis write cached log chunk to log file. If you are searching for old records that “Modifed Date” earlier than last log date you dont need this operation.

Have a nice log hunting 🙂

Advertisements

About bpostaci
Sr. Support Escalation Engineer in Microsoft.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: