IIS6 Log Files Not Rolling

Hi - We're having an issue with IIS6 web logs. I'm not precisely sure how it started happening but it's in the last month or so. For some reason, IIS6 log files are not properly rolling. They just get bigger and bigger each day. If I go in and change from daily to hourly or turn local time on or off, it will create a new log file at that point and then just keep filling that one up.

Any ideas? :)
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Sam PanwarSr. Server AdministratorCommented:

which log format you have selected and the path which you provide for log file have the Iuser permission or not.

Have you enabled localtime for rollover the file in the log properties.
kcmurphy1Author Commented:
W3c Extended Log File Format, the path had access for administrators and system, nothing else... we've been able to write to it before for over a year now, but we were using it by "when file size reaches 50MB" which wasn't the best setting for managing our reporting. I added iusr for the moment, I'll see if it rolls at the next hour mark.

I've tried it with localtime for rollover enabled and disabled both, neither seems to work.
kcmurphy1Author Commented:
Giving iusr access did not fix the issue. The files are writing there, they're just not closing off one file and opening a new one properly.
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

kcmurphy1Author Commented:
I just looked in the metabase... I'm wondering if LogFileTruncateSize might not be the problem.. we changed to do it periodically but the truncatesize remains in the metabase. Here's the metabase entry for one of the sites in question:

<IIsWebServer	Location ="/LM/W3SVC/619796104"
		LogExtFileFlags="LogExtFileDate | LogExtFileHost | LogExtFileTime | LogExtFileClientIp | LogExtFileUserName | LogExtFileSiteName | LogExtFileComputerName | LogExtFileServerIp | LogExtFileMethod | LogExtFileUriStem | LogExtFileUriQuery | LogExtFileHttpStatus | LogExtFileWin32Status | LogExtFileBytesSent | LogExtFileBytesRecv | LogExtFileTimeTaken | LogExtFileServerPort | LogExtFileUserAgent | LogExtFileCookie | LogExtFileReferer | LogExtFileProtocolVersion | LogExtFileHttpSubStatus"

Open in new window

kcmurphy1Author Commented:
Hmm.. the overall setting for IIS was set to 50 meg rollover still. I changed that to hourly as well, we'll see if that fixes it at 1. :)
kcmurphy1Author Commented:
Looks like the following tasks combined improved the situation:

1) Set logging settings for "web sites" to hourly + local time
2) give IWAM user higher permission level (what specifically it apparently needs I'm not sure, still tweaking that)
3) Restart IIS

This clearly worked on one of the two boxes in the cluster; the second one I left out the "Restart IIS" step, so confirmation of that is pending the next hour mark.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft IIS Web Server

From novice to tech pro — start learning today.