We are excited to announce that the IIS.NET Forums are moving to the new Microsoft Q&A experience. Learn more >

View Complete Thread
  • Re: IIS atack every day

    Feb 09, 2007 09:57 PM|thomad|LINK

    Why don't you try the following:

    Maybe some requests just take much longer and therefore they accumulate. Here is a logparser query that lists all requests that take longer than 10 seconds. Note that you have to add the time-taken field to the log fields that get logged. IIS doesn't add this field by default.

    logparser "SELECT TOP 10 cs-uri-stem, COUNT(*) FROM *.log
    WHERE time-taken > 10000 GROUP BY cs-uri-stem ORDER BY COUNT(*) DESC" –i:IISW3C

    Another idea is to run your query only against your asp pages. Here is an example how to restrict the query to only asp pages:

    logparser -i:IISW3C "SELECT TOP 20 cs-uri-stem, count(*) AS uricount FROM *.log WHERE EXTRACT_TOKEN (cs-uri-stem, -1, '.' ) = 'asp' GROUP BY cs-uri-stem ORDER BY uricount DESC"

    Hope this helps.

    Thomas Deml
    Group Program Manager
    Internet Information Services
    Microsoft Corp.