Troubleshooting Failed Requests Using Tracing in IIS 8.5

Posted 2020-10-17 Chuck Lu

https://docs.microsoft.com/en-us/iis/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

https://docs.microsoft.com/en-us/iis/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis-85

Make a Backup

You must make a backup of the configuration before doing the following tasks.

以管理员权限打开命令工具

C:\\Windows\\system32>%windir%\\system32\\inetsrv\\appcmd add backup cleanInstall
BACKUP object "cleanInstall" added

 

Disable ASP

ASP must be disabled for this task. ASP is disabled only as an example and for the purposes of the tasks in this article.

这个设置，是在IIS的根目录上设置的

1. Open IIS Manager and select the server.

双击ISAPI and CGI Restrictions.

1. In the ISAPI and CGI Restrictions pane, select Active Server Pages. In the Actions pane, click Deny to disable ASP . Active Server Pages will show as "Not Allowed".

 

 

Enable Failed-Request Tracing

Step 1: Enable Failed-Request Tracing for the Site and Configure the Log File Directory

首先需要配置https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/site/tracefailedrequestslogging

 

After you enable failed-request tracing, you need to configure where the log files will reside.

In this task, you will enable failed-request tracing for the Default Web Site and specify where to put the log files.

You will then configure the failure for which to generate failure logs.

 选择目标website，然后在右侧的面板找到 Failed Request Tracing

Enable这个功能，可以设置日志文件的路径。默认路径是%SystemDrive%\\inetpub\\logs\\FailedReqLogFiles

 Failed-request tracing logging is now enabled for the Default Web Site.

Check the %windir%\\system32\\inetsrv\\config\\applicationHost.config file to confirm that the configuration looks as follows:

<site name="Lisa" id="4" serverAutoStart="true">
<traceFailedRequestsLogging enabled="true" />
</site>

 

Step 2 : Configure Your Failure Definitions

In this step, you will configure the failure definitions for your URL, including what areas to trace.

You will troubleshoot a 404.2 that is returned by IIS for any requests to extensions that have not yet been enabled.

This will help you determine which particular extensions you will need to enable.

For more information, see The HTTP status code in IIS 7.0, IIS 7.5, and IIS 8.0.

1. In the Connections pane, expand the machine name, expand Sites, and then click Default Web Site.

2. Double-click Failed Request Tracing Rules.

具体的操作，还是去原文链接看

 

选择trace providers的时候，发现缺少了一部分provider  (可以先restore回来，修改之后重新backup)

https://blogs.msdn.microsoft.com/benjaminperkins/2012/01/02/enable-and-activate-failed-request-tracing-rules/

https://stackoverflow.com/questions/37607987/iis-failed-request-tracing-trace-providers

For some reason it seems your traceProviderDefinitions got cleared or something. to fix that you can:

1. Make a backup of c:\\Windows\\System32\\Inetsrv\\Config\\ApplicationHost.config just in case anything goes wrong with your XML editing.
2. Open c:\\Windows\\System32\\Inetsrv\\Config\\ApplicationHost.config in notepad.

3. Look for: , in my machine I have the following:

 

  <traceProviderDefinitions>
        <add name="WWW Server" guid="{3a2a4e84-4c21-4981-ae10-3fda0d9b0f83}">
            <areas>
                <clear />
                <add name="Authentication" value="2" />
                <add name="Security" value="4" />
                <add name="Filter" value="8" />
                <add name="StaticFile" value="16" />
                <add name="CGI" value="32" />
                <add name="Compression" value="64" />
                <add name="Cache" value="128" />
                <add name="RequestNotifications" value="256" />
                <add name="Module" value="512" />
                <add name="Rewrite" value="1024" />
                <add name="FastCGI" value="4096" />
                <add name="WebSocket" value="16384" />
            </areas>
        </add>
        <add name="ASP" guid="{06b94d9a-b15e-456e-a4ef-37c984a2cb4b}">
            <areas>
                <clear />
            </areas>
        </add>
        <add name="ISAPI Extension" guid="{a1c2040e-8840-4c31-ba11-9871031a19ea}">
            <areas>
                <clear />
            </areas>
        </add>
        <add name="ASPNET" guid="{AFF081FE-0247-4275-9C4E-021F3DC1DA35}">
            <areas>
                <add name="Infrastructure" value="1" />
                <add name="Module" value="2" />
                <add name="Page" value="4" />
                <add name="AppServices" value="8" />
            </areas>
        </add>
    </traceProviderDefinitions>

 可以设置追踪的错误200-999

 

 

 

Test and View the Failure Request Log File

In this task, you will generate a failed request and view the resulting trace log.

You already configured IIS to capture trace logs for http://localhost/*.asp requests that fail with an HTTP response code of 404.2. Now verify that it works.

打开%systemdrive%\\inetpub\\logs\\FailedReqLogFiles\\W3SVC1.

 

Notice a few things here: When IIS writes the failed request log file, it writes one file per failed request.

A freb.xsl style sheet is also written, one per directory.

This helps when you view the resulting failure request log files (such as fr000001.xml above).

 需要注意的是，生成结果的xml，只能用ie浏览器打开:C:\\inetpub\\logs\\FailedReqLogFiles\\W3SVC4\\fr000007.xml

 在Request Details界面，注意看verbose列中错误的信息

 

 

Restore Your Backup

Now that you have completed the tasks in this article, you can restore the backup of the configuration.

Run the following command with administrator user rights:

console

%windir%\\system32\\inetsrv\\appcmd restore backup cleanInstall

 

注意事项

appcmd

https://www.cnblogs.com/chucklu/p/10319171.html   

appcmd的使用，建议每次都用不同的backup名字。最好是用完之后删掉。千万不要还原了一个旧版本的，否则会把你IIS下配置的ApplicationPool还有Application覆盖掉。一些在上一次备份的时候创建的Application pool和Application会丢失。

 如果已经删除了DefaultWebSite的话，访问http://localhost/test.asp会提示404错误

 目前的localhost是指向另外一个自定义的网站的，比如网站名为Lisa

那么只需要将test.asp文件复制到Lisa站点的根目录下即可，然后会遇到404.2的错误

HTTP Error 404.2 - Not Found

The page you are requesting cannot be served because of the ISAPI and CGI Restriction list settings on the Web server.

 

 在C:\\inetpub\\logs\\FailedReqLogFiles目录下找不到log

https://forums.iis.net/t/1183055.aspx?Failed+Request+Trace+logs+not+creating

If the FREB logs are not being created in general, it usually has to do with permissions problems - you will most likely find matching events in the Event Viewer logs stating it cannot create the file or folder for the log.

Have you made adjustments to the site\'s application pool user identity that it runs under, or the location of the log files?

 发现如下错误

IISMANAGER_ERROR_LOADING_PROVIDER_TYPE

IIS Manager could not load type \'Microsoft.Web.Management.Features.SharedConfig.SharedConfigModuleProvider, Microsoft.Web.Management, Version=7.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\' for module provider \'SharedConfig\' that is declared in %windir%\\system32\\inetsrv\\config\\administration.config. Verify that the type is correct, and that the assembly that contains the module provider is in the Global Assembly Cache (GAC).

Exception:System.TypeLoadException: Could not load type \'Microsoft.Web.Management.Features.SharedConfig.SharedConfigModuleProvider\' from assembly \'Microsoft.Web.Management, Version=7.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\'.
at System.RuntimeTypeHandle.GetTypeByName(String name, Boolean throwOnError, Boolean ignoreCase, Boolean reflectionOnly, StackCrawlMarkHandle stackMark, IntPtr pPrivHostBinder, Boolean loadTypeFromPartialName, ObjectHandleOnStack type)
at System.RuntimeTypeHandle.GetTypeByName(String name, Boolean throwOnError, Boolean ignoreCase, Boolean reflectionOnly, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean loadTypeFromPartialName)
at System.Type.GetType(String typeName, Boolean throwOnError)
at Microsoft.Web.Management.Server.AdministrationModuleProvider.GetModuleProvider(String userName, String connectionName)

Process:InetMgr
Connection:username here

路径是:C:\\Windows\\System32\\inetsrv\\Config\\administration.config

我目前使用的IIS版本是10.0，然后和我同事的文件进行对比，发现我的文件里有一行是

<add name="SharedConfig" type="Microsoft.Web.Management.Features.SharedConfig.SharedConfigModuleProvider, Microsoft.Web.Management, Version=7.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />

但是，我同事那边是        <add name="SharedConfig" type="Microsoft.Web.Management.Features.SharedConfig.SharedConfigModuleProvider, Microsoft.Web.Management.Extensions, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />

 log找不到的第二个原因

 需要重新安装tracing

有了log之后发现缺少freb.xml

https://serverfault.com/questions/397339/failed-request-tracing-xml-fails-to-display-in-internet-explorer-iis-7-5

If the freb.xsl file is missing from the directory that contains the log files, then the nice interface won\'t show. Rather than trying to find a website with the latest freb.xsl, I found on this page:

http://blogs.iis.net/davcox/archive/2007/10/05/recovering-freb-xsl-after-deleting-it.aspx

that if you just delete the directory that the xml files are being written to (likely something like C:\\inetpub\\logs\\FailedReqLogFiles\\W3SVC1), then IIS will automatically recreate the directory and write the freb.xsl file when it next creates the next log file.

可以从这里下载http://www.iis.net/media/7433929/freb.zip