Investing in W3C Centralized Logging in Service Pack 1
As I continue my series of discussions around what is new in Service Pack 1
for IIS users, I want to touch on a pretty cool feature that many large
installations of IIS 6.0 can take advantage almost immediately. HTTP.sys, the
kernel driver responsible for logging in IIS 6.0 (except ODBC), added this
functionality as a hybrid to the RTM version called “Centralized Binary
Logging.”
Centralized Binary Logging had 2 major limitations:
- CBL had no clear mechanism to review the log files without writing code as it was written in binary
- CBL could not log extended properties similar to W3C such as Cookies, etc.
For those who don’t know, IIS 6.0 typically ships with logging enabled and the default logging mechanism which is W3C Extended Logging. This log type includes both the base properties but extensions as I mentioned above. The problem is that logging is done on a per-site basis which for many IIS 6.0 installations simply doesn’t scale well when you are talking hundreds of sites. For example, 100 sites would equal the following by default on installations for the file\directory structure that you would need to manage -
%windir%\system32\LogFiles\w3svc# (where # is the site number like 1)
– LogFile1
– LogFile2
etc. and this is based on the fact that IIS 6.0 keeps the last 10 log files and rotation is done per day. This is a lot of scrubbing when you take this structure (1 directory, 10 files) and you multiply it by 100. Math = (A Lot)
In short, IIS 6.0 with Service Pack 1 relieves many from this incredible burden of where to locate these files or worse how to navigate through them. We did this with HTTP.sys now including 100 percent compatible W3C Extended Logging but now with the ability to centralize this to one single file. This equals a more robust capability to logging because you have out of the box a total of 1 directory (W3SVC) and 10 files. These 10 files can be easily located in a single directory or better yet on a remote UNC share. It also makes parsing log files much easier —
This is a server log type, not site based. If this feature sounds useful then I would recommend you review the following documentation on the feature and then run with it -
To enable it, do the following (not supported in the IIS Manager (UI)):
cscript adsutil.vbs set w3svc/CentralW3CLoggingEnabled 1
For a bit more on this feature, see this article I wrote on IIS Insiders this month -
http://www.microsoft.com/technet/community/columns/insider/default.mspx#EBAAA
Lastly, if you would like to view a webcast on the topic to understand it (as well as contrast against Centralized Binary Logging), then feel free to view Centralizing Logging in IIS 6.0: Service Pack 1 Centralized W3C Logging
I hope that many folks take a slight peak at this feature as it might be very helpful for those testing the waters of “shared” hosting in IIS 6.0.
~Chris