IIS 10 with Advanced LoggingRSS

15 replies

Last post Feb 08, 2020 03:35 PM by ShakAZ

  • IIS 10 with Advanced Logging

    Nov 15, 2016 03:15 PM|jbruns2011|LINK

    So, a trip down memory lane is in order.

    Starting (for us) with IIS7, we installed the IIS Advanced Logging add-in, which gave us the ability to add new fields and direct that data to a different location versus the default logging location.

    This has worked well for us up to and including IIS 8.5.

    Introduce IIS 10

    Advanced Logging MSI will not install on Windows 2016, you get a pop-up saying that IIS version 7.0 is required to use IIS AL 1.0

    I know that custom logging was added to IIS 8.5 but we continued to use the AL 1.0 since our install script was still working and we didn't want to spend the time changing the script to work with the built-in feature.

    In my Powershell script to install IIS and IIS AL, I have a function for adding or setting web configurations like below:

    ###############################################################################################

    Function Update-WebConfiguration ($Action, $Filter, $Name, $Value){

    Try{
    If ($Action -eq "Set"){
    $Command = "Set-WebConfigurationProperty -Filter $Filter -Name $Name -Value $Value"
    $Result = Invoke-Expression -Command $Command -ErrorAction SilentlyContinue -ErrorVariable errVariable -WarningAction SilentlyContinue -WarningVariable wrnVariable
    }
    ElseIf ($Action -eq "Add"){
    $Command = "Add-WebConfigurationProperty -Filter $Filter -Name $Name -Value $Value"
    $Result = Invoke-Expression -Command $Command
    }
    }
    Catch{
    Return $false
    }
    Return $true
    }

    ###############################################################################################

    We changed the location of the advanced log files so as to not interrupt any current process that was using the base logging location or files with this code:

    ###############################################################################################

    Write-Host "[$Now] Setting Advanced Logging Default Log Location..." -ForegroundColor Green -NoNewline

    If (!(Update-WebConfiguration -Action 'Set' -Filter '/system.applicationHost/advancedLogging/serverLogs' -Name 'directory' -Value "$strIISAdvLogFolder")){
    Write-Host "FAILURE" -ForegroundColor Red
    }
    Else{
    Write-Host "SUCCESS" -ForegroundColor Green
    }

    ###############################################################################################

    Then we added advanced logging fields using code  like this:

    ###############################################################################################

    Write-Host "[$Now] Add Logging For REMOTEADDRESS Property..." -ForegroundColor Green -NoNewline

    If (!(Update-WebConfiguration -Action 'Add' -Filter '/system.webServer/advancedLogging/server' -Name 'fields' -Value '@{id="REMOTEADDRESS";sourceName="REMOTEADDRESS";sourceType="RequestHeader";logHeaderName="";category="Default";description="";defaultValue="";loggingDataType="TypeLPCSTR"}')){
    Write-Host "FAILURE" -ForegroundColor Red
    }
    Else{
    Write-Host "SUCCESS" -ForegroundColor Green
    }

    ###############################################################################################

    This all flies out the window with IIS 10.

    Anyone have ideas on how to get this to work with IIS 10?

    I need to be able to set advanced logging fields BEFORE any sites are created.  If done after, the installer will never know its needed and business partners would just ignore the requirement and then later on when we need the log data, we will discover they never added the fields after they stood up the site(s) that their application has.

  • Re: IIS 10 with Advanced Logging

    Nov 20, 2016 08:33 PM|szmulder|LINK

    +1

    I also want to using the Advanced Logging on IIS 10

  • Re: IIS 10 with Advanced Logging

    Nov 20, 2016 08:51 PM|milope|LINK

    Advanced Logging has only been written to work for up to IIS 8.0 (https://www.iis.net/downloads/microsoft/advanced-logging). I would recommend using Enhanced Logging, which is now built into IIS starting on IIS 8.5: https://www.iis.net/learn/get-started/whats-new-in-iis-85/enhanced-logging-for-iis85
  • Re: IIS 10 with Advanced Logging

    Nov 20, 2016 09:38 PM|jbruns2011|LINK

    We use the advanced logging add-in for REMOTEADDRESS and X-Forwarded-For as sent in by our load balancer.  Now the MSI dies when you try to run it on 2016.

    I got it to produce the columns in the base log files by using:

    Import-Module WebAdministration

    Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/siteDefaults/logFile/customFields" -name "." -value @{logFieldName="X-Forwarded-For";sourceName="X-Forwarded-For";sourceType="RequestHeader"}
    Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/siteDefaults/logFile/customFields" -name "." -value @{logFieldName="REMOTEADDRESS";sourceName="REMOTEADDRESS";sourceType="RequestHeader"}

    I have to test using a test site with our load balancer to make sure the log data contains the values.

    I have a question into MS to ask if the log file can be separated from the base logs like you could with the advanced logging add-in .

    I also want to know what the author meant with 3rd paragraph 2nd sentence (64k limit per record, per file or what?) of this link,
    https://www.iis.net/configreference/system.applicationhost/sites/site/logfile/customfields/add

    That is the link I got the Powershell code from at bottom.  I was able to add the config item as I did it above to the siteDefaults element instead of a specific site, like the https://www.iis.net/configreference/system.applicationhost/sites/site/logfile/customfields/add shows.

    I need all sites added from IIS install onward to have those additional fields.

    Hope this helps.

  • Re: IIS 10 with Advanced Logging

    Nov 21, 2016 06:23 AM|milope|LINK

    To my knowledge, these are just a beefed up IIS log. Haven't heard of 2 files per site, though I can be wrong. Though the article doesn't specify, I'd interpret the 65K limit of custom data per row.
  • Re: IIS 10 with Advanced Logging

    Dec 05, 2016 02:33 PM|ojmagg|LINK

    We need advanced logging for IIS 10...

  • Re: IIS 10 with Advanced Logging

    Dec 05, 2016 02:36 PM|jbruns2011|LINK

    You don't need it.  It is built in now to IIS 10.

    Only 1 log file is used instead of the ability in the past with advanced logging to direct to a new set of files.

    The 64k limit I was asking about above is per row.

  • Re: IIS 10 with Advanced Logging

    Feb 13, 2018 04:12 PM|iamphi|LINK

    I want Advanced Logging or equivalent features for IIS 10. The features that IIS 10 Enhance Logging doesn't have are

    • Fields re-ordering: For example, moving the 'Host' field from end towards the front
    • Conditional logging options: I have logs saved to 2 locations with different columns based on UriStem value. I am using it to hide UriQuery for UriStem that has potentially sensitive data.
  • Re: IIS 10 with Advanced Logging

    Sep 25, 2018 04:44 PM|CV-Frank|LINK

    jbruns2011

    You don't need it.  It is built in now to IIS 10.

    Only 1 log file is used instead of the ability in the past with advanced logging to direct to a new set of files.

    The 64k limit I was asking about above is per row.

    Then how do we migrate a website using the WebDeploy?

    We have AL on our IIS7 server and can export the package fine, but when we try to import we get an error saying we can't add child object AdvancedLogging to Default because the provider doesn't support it -

    Child object 'advancedLogging' cannot be added to object 'siteDefaults'. The 'siteDefaults' provider may not support this deployment.

  • Re: IIS 10 with Advanced Logging

    Feb 27, 2019 07:28 PM|EXTOL7|LINK

    Hello CV-Frank,

    We are planning to use Web-Deploy to migrate from IIS 7.5 with Advanced Logging to IIS 10.0.  How did you resolve this issue?

  • Re: IIS 10 with Advanced Logging

    Jul 19, 2019 06:48 PM|Kyle74|LINK

    Yeah darn...My boss wants me to find a way to move the XFF field closer to Client IP or better yet merge them together...doesn't look like it's possible though.

    We're going from 7 to 10 IIS.

  • Re: IIS 10 with Advanced Logging

    Nov 25, 2019 09:59 PM|carehart|LINK

    Some folks here keep suggesting that the IIS 10 "enhanced logging" (EL) feature provides what the IIS 7/8 "advanced logging" (AL) feature offered. That's not quite true.

    EL does indeed add one of the four broad features that AL offered, the ability to add a custom field to IIS logs.  That's good to see, of course, and it may well have been the most common AL feature that people used in IIS 7/8, causing MS to add it into IIS 10.

    But how about the log filtering feature (or those couple other features that AL had added)? Does anyone know if any IIS-native feature (or ms-provided add-on) offers that? 

    I realize this is an old thread, but a) it is by far the most-viewed post created in the last 2 years in this AL forum and b) it is being pointed to from yet other threads so seems the authoritative discussion on "the topic of AL in IIS 7/8 being replaced with EL in IIS 10". So it seems as good a place as any to have this discussion.

    /charlie
  • Re: IIS 10 with Advanced Logging

    Jan 24, 2020 06:29 PM|swimthrough|LINK

    I just need to deploy into IIS 10 but is failing due to this pesky issue Child object 'advancedLogging' cannot be added to object 'site'.

    Any ideas on how to remove this child from Web Deploy instead?

    What solutions have you come up with in order to complete this deployment successfully?

    <div style="padding-left: 30px;"></div>
  • Re: IIS 10 with Advanced Logging

    Jan 25, 2020 02:51 PM|carehart|LINK

    So, first, let's cknowledge that it fails because the package tries to implement support in the imported site for advanced logging, which (per the discussion in this thread) is no longer an option in iis 10.

    So you need to remove that option from the package.

    Are you open to rebuilding the package, choosing to remove the element? You can do that with the remove action in the transform process discussed here (https://visualstudiomagazine.com/articles/2010/09/30/webconfig-to-production-in-aspnet4.aspx?m=1) and elsewhere.

    Or if you were adventurous, you could try editing the web.config by unzipping the package zip, editing it, and redeploying, though some have reported problems doing it. I tried to find any blog that might walk through that, but found none readily (and am replying on my phone, or I'd try it for you). I figured I'd leave this in case you might (and if I might lose track). If you or anyone else tries it, let us know how it goes.
    /charlie
  • Re: IIS 10 with Advanced Logging

    Feb 08, 2020 03:35 PM|carehart|LINK

    swimthrough, any thoughts on my last post?
    /charlie
  • Re: IIS 10 with Advanced Logging

    Jun 02, 2020 06:58 PM|ShakAZ|LINK

    This is really old post, but I just had this issue and resolved it by skipping the advancedlogging using: -skip:objectname=advancedlogging

    So it looked like this: msdeploy -verb:sync -source:package=c:\site.zip,encryptPassword=xxxxxx -dest:metakey=lm/w3svc/10 -skip:objectname=advancedlogging -verbose > msdeploysync-verbose.log