Logging seems to stop and start quite often

I've had reason lately to closely monitor the logs for one of our web
sites (one created using host headers) (IIS 6, win 2003 sp2). Logs for
the site is set to rotate monthly.

The log file contains a great deal of this:

#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2008-01-18 18:23:03
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port
cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus
sc-win32-status sc-bytes cs-bytes

with 1 to maybe 15 log lines separating these headers. I associate
these headers with something stopping or starting, and so the frequency
of these headers in the log file worries me.

For today, for example:

#Date: 2008-01-17 23:12:19
#Date: 2008-01-18 00:32:29
#Date: 2008-01-18 01:44:21
#Date: 2008-01-18 02:24:29
#Date: 2008-01-18 03:41:25
#Date: 2008-01-18 08:03:07
#Date: 2008-01-18 08:39:05
#Date: 2008-01-18 10:51:10
#Date: 2008-01-18 11:19:23
#Date: 2008-01-18 11:39:48
#Date: 2008-01-18 12:03:03
#Date: 2008-01-18 13:06:32
#Date: 2008-01-18 14:10:23
#Date: 2008-01-18 14:57:49
#Date: 2008-01-18 16:23:47
#Date: 2008-01-18 16:42:11
#Date: 2008-01-18 17:11:46
#Date: 2008-01-18 17:49:16
#Date: 2008-01-18 18:23:03

Does anyone think this is something to worry about?

Re: Logging seems to stop and start quite often

Hi Frank,

This is normally nothing to worry about, it is normal.

"Multiple header fields written in each log file"
http://www.gafvert.info/notes/MultipleHeadersInLog.htm

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


"Frank Burleigh" skrev i meddelandet
news:eWQ$kJgWIHA.5396@TK2MSFTNGP02.phx.gbl...
> I've had reason lately to closely monitor the logs for one of our web
> sites (one created using host headers) (IIS 6, win 2003 sp2). Logs for
> the site is set to rotate monthly.
>
> The log file contains a great deal of this:
>
> #Software: Microsoft Internet Information Services 6.0
> #Version: 1.0
> #Date: 2008-01-18 18:23:03
> #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port
> cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus
> sc-win32-status sc-bytes cs-bytes
>
> with 1 to maybe 15 log lines separating these headers. I associate these
> headers with something stopping or starting, and so the frequency of these
> headers in the log file worries me.
>
> For today, for example:
>
> #Date: 2008-01-17 23:12:19
> #Date: 2008-01-18 00:32:29
> #Date: 2008-01-18 01:44:21
> #Date: 2008-01-18 02:24:29
> #Date: 2008-01-18 03:41:25
> #Date: 2008-01-18 08:03:07
> #Date: 2008-01-18 08:39:05
> #Date: 2008-01-18 10:51:10
> #Date: 2008-01-18 11:19:23
> #Date: 2008-01-18 11:39:48
> #Date: 2008-01-18 12:03:03
> #Date: 2008-01-18 13:06:32
> #Date: 2008-01-18 14:10:23
> #Date: 2008-01-18 14:57:49
> #Date: 2008-01-18 16:23:47
> #Date: 2008-01-18 16:42:11
> #Date: 2008-01-18 17:11:46
> #Date: 2008-01-18 17:49:16
> #Date: 2008-01-18 18:23:03
>
> Does anyone think this is something to worry about?

Re: Logging seems to stop and start quite often

On Jan 18, 10:46=A0am, Frank Burleigh wrote:
> I've had reason lately to closely monitor the logs for one of our web
> sites (one created using host headers) (IIS 6, win 2003 sp2). =A0Logs for
> the site is set to rotate monthly.
>
> The log file contains a great deal of this:
>
> #Software: Microsoft Internet Information Services 6.0
> #Version: 1.0
> #Date: 2008-01-18 18:23:03
> #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port
> cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus
> sc-win32-status sc-bytes cs-bytes
>
> with 1 to maybe 15 log lines separating these headers. =A0I associate
> these headers with something stopping or starting, and so the frequency
> of these headers in the log file worries me.
>
> For today, for example:
>
> #Date: 2008-01-17 23:12:19
> #Date: 2008-01-18 00:32:29
> #Date: 2008-01-18 01:44:21
> #Date: 2008-01-18 02:24:29
> #Date: 2008-01-18 03:41:25
> #Date: 2008-01-18 08:03:07
> #Date: 2008-01-18 08:39:05
> #Date: 2008-01-18 10:51:10
> #Date: 2008-01-18 11:19:23
> #Date: 2008-01-18 11:39:48
> #Date: 2008-01-18 12:03:03
> #Date: 2008-01-18 13:06:32
> #Date: 2008-01-18 14:10:23
> #Date: 2008-01-18 14:57:49
> #Date: 2008-01-18 16:23:47
> #Date: 2008-01-18 16:42:11
> #Date: 2008-01-18 17:11:46
> #Date: 2008-01-18 17:49:16
> #Date: 2008-01-18 18:23:03
>
> Does anyone think this is something to worry about?


Depends on your Application Pool settings.

But if you still have the default idle timeout setting of 20 minutes,
then this is quite normal and nothing to worry about.

What you need to worry about is if the Event Log contains entries
about application pool crashing -- that would also cause the logging
to stop/restart.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Re: Logging seems to stop and start quite often

David Wang wrote:
> On Jan 18, 10:46 am, Frank Burleigh wrote:
>> I've had reason lately to closely monitor the logs for one of our web
>> sites (one created using host headers) (IIS 6, win 2003 sp2). Logs for
>> the site is set to rotate monthly.

[details snipped]

> Depends on your Application Pool settings.
>
> But if you still have the default idle timeout setting of 20 minutes,
> then this is quite normal and nothing to worry about.
>
> What you need to worry about is if the Event Log contains entries
> about application pool crashing -- that would also cause the logging
> to stop/restart.
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //

Thanks Kris and David.

I have a web form process that occasionally fails to insert data to a
database. Understanding the failures -- which I can't reproduce -- has
been very frustrating, so I'm looking for about anything that would
identify systemic troubles.

As you both say, the timeout for the app pool is the default 20 minutes.
The event log for the machine contains event 1074 about once a day,
sometimes every other day. The time of failed form submissions (that I
know about) with this event doesn't really line up, so I don't know that
there's much too this. But if there were a way to know *what* failed or
took time, perhaps the event log could be even cleaner. ;-)

Thanks for any further suggestions.

Event Type: Information
Event Source: W3SVC
Event Category: None
Event ID: 1074
Date: 1/13/2008
Time: 1:30:48 AM
User: N/A
Computer:
Description:
A worker process with process id of '3388' serving application pool
'DefaultAppPool' has requested a recycle because the worker process
reached its allowed processing time limit.