Logging capabilities on Server2008 / iis7?

Question

Hello there

I am suddenly resposible for debugging/finding out what is wrong with an asp.net application that crashed its ApplicationPool some days ago. The 5 errors within 5 minutes failsafe we had set took it down. The problem is that it was still served pages and thus returned a 503 for just some visitors. We have inadequate logging in the application sadly and it happens rarely and just to one of the servers in the farm, so it is tricky to figure out whats wrong.

Now for the questions. I'm not an administrator and new to both IIS7 and Server2008 so I'm just fishing for what possibilities I have. What I know and have:

• httperr log file.
• Some site specific logs in wc3 format that is saved in another disk, looks like access logs?
• the event viewer

There is also the possibility to set up the trace failed requests, I understand this might grab some performance though?

Am I missing anything that is logged or can be logged? Any general tips on how I can keep a check on my servers that the applications are behaving as they should?

I will learn LogParser as that seems like something I should, any tips there?

EDIT: I'm also interested in logs of the machine status. Like cpu-load, memory etc. Any possibilities there?

Answer 1

In our web app I catch all unhandled exceptions through the HttpApplication error event, and log those to the database, with all the auxilliary data that I need. If that logging fails, then I resort to windows EventLog. Then I have service running on another machine that periodically checks the logs, and the site, and emails me updates on a schedule.

Answer 2

If you are feeling particularly adventurous, there are ways to create and analyze crash dumps of IIS.

http://support.microsoft.com/kb/892277

Using this, it's possible to find out the call stack at the crash point.

Answer 3

You should check Tess Ferrandez "If broken it is, fix it you should" blog. It is the best resource I know of for debugging production asp.net applications. All the logs won't help you enough, probably. As most of the time its application code that is responsible for the crashes.