Failed Request Tracing is not creating logs

This post has been republished via RSS; it originally appeared at: IIS Support Blog articles.

You may notice that Failed Request Tracing (FREB) rule is not creating log files even though the condition in your rule is met.

Reinstalling the Tracing module normally solves issues related to FREB but this may not be an acceptable approach if Shared Configuration is used or you can’t restart the server (uninstalling the Tracing module requires server restart)

 

Solution

Here are a few things to checks:

  • Make sure FREB is enabled
  • Check if the log path is correct
  • Check if the application pool identity has permissions to write to this path
  • Add a new website and add a rule for status codes between 200 and 600

 

If there are still no log files, It’s time to check the applicationHost.config file. For an issue I troubleshot, module references were missing. This is how we solved it:

 

  • Back up applicationHost.config file
  • Open the original one. Add the following lines in <globalModules> section
<globalModules> … <add name="TracingModule" image="%windir%\System32\inetsrv\iisetw.dll" /> <add name="FailedRequestsTracingModule" image="%windir%\System32\inetsrv\iisfreb.dll" /> … </globalModules>

 

  • Add the following line into <modules> section
<modules> … <add name="FailedRequestsTracingModule" lockItem="true" /> … </modules>

 

  • Make sure the provider definitions are correct. Here is a definition that works for WWW Server:
<traceProviderDefinitions> … <add name="WWW Server" guid="{-4j25-9512-qp1}"> <areas> <add name="Authentication" value="2" /> <add name="Security" value="4" /> <add name="Filter" value="8" /> <add name="StaticFile" value="16" /> <add name="CGI" value="32" /> <add name="Compression" value="64" /> <add name="Cache" value="128" /> <add name="RequestNotifications" value="256" /> <add name="Module" value="512" /> <add name="FastCGI" value="4096" /> … </areas> </add> … </traceProviderDefinitions>

 

  • Restart IIS and test if logs are created now

REMEMBER: these articles are REPUBLISHED. Your best bet to get a reply is to follow the link at the top of the post to the ORIGINAL post! BUT you're more than welcome to start discussions here:

This site uses Akismet to reduce spam. Learn how your comment data is processed.