scary problem with IIS on Windows 2019 Standard, IIS is not writing W3C log files! I did see this similar item, but did not need to make new directories
- Three Windows Standard 2019 servers running under ESXi 6.7.
- Patches applied from August 2020, OS Build 17763.1397
- They use a shared configuration, distributed with DFS
Logging configured globally to use
- 1 log file per Site
- format W3C (with a custom field CF-Connecting-IP)
- Encoding UTF-8
- Destination: log file only
- Rollover: weekly
Configured on each web site (over 2000 sites), we place the log file in a directory like d:\www-logs\hostname.domain.com
Running smoothly in production since February 2020
At midnight UTC on August 31, all three servers quit logging W3C files in the specified log directories! Notice the gap in 1 representative log file directory
7/18/2020 4:58PM u_ex200703_x.log
7/25/2020 4:59PM u_ex200704_x.log
7/31/2020 4:59PM u_ex200705_x.log
8/1/2020 2:04PM u_ex20080_x.log
8/8/2020 4:59PM u_ex200802_x.log
8/15/2020 4:59PM u_ex200803_x.log
8/22/2020 4:59PM u_ex200804_x.log
8/29/2020 4:59PM u_ex200805_x.log
8/31/2020 4:21PM u_ex200806_x.log
9/4/2020 4:59PM u_ex200904_x.log
9/4/2020 5:11PM u_ex200905_x
(servers are in Pacific time, -7:00 UTC)
Colleague discovered this on Sept 3... I rebooted the server, no change. It still serves pages normally, without logging activity. When I watch the server with PROCMON, no attempt is made to write to files in the log directories, even as web sites remain responsive. I verified global Logging is enabled, and that logging per site is also enabled. The W3C Logging Service is running.
I changed Logging at the global IIS level to Daily... servers began to log hits immediately, in a new file. Today, I observe that log files roll over OK at midnight UTC.
August might have been a bit unusual, in that weekly files reached a sixth file... could Microsoft fail to handle cases of more than 5 weeks in a month?
I am sure there is no way to recover the lost log records. Any experiences to the contrary? Has anyone else observed this at log roll over?
