Data Loss Occurs When IIS Service Logging Type Returns to W3C Format (300340)


The information in this article applies to:

  • Microsoft Operations Manager 2000
This article was previously published under Q300340

SYMPTOMS

After you change the logging type of an Internet Information Server (IIS) service from W3C to either NCSA or Microsoft IIS, when you then return to the W3C logging type, Microsoft Operations Manager (MOM) may experience data loss in the early portion of the new log.

CAUSE

This problem can occur because of the way MOM reads log files. A new log file is created every time the logging type of an IIS service changes. When you return to the W3C logging type, IIS overwrites the old log of that type and starts logging. However, MOM waits until the new log file reaches the size of the old log file before starting to read that W3C log file again.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

For example, when IIS is logging activity for the World Wide Web Publishing service in W3C format, IIS logs access to the server in an ExMMYYDD.log format file. MOM reads the file and marks the last lines that it reads as an offset value, for example N. If you change the log file format to NCSA format or Microsoft IIS format and you then go back to W3C format, IIS overwrites the existing ExMMYYDD.log file from the beginning. However, MOM ignores any new entries in the log until the size of the log reaches the existing offset (N). Only then does MOM resume reporting on the monitored log file.

For additional information about the effects of changing IIS logging types on MOM, refer to the following Microsoft Knowledge Base article:

295870 IIS Log Provider Does Not Keep Track of Previously Monitored Log

Modification Type:MinorLast Reviewed:6/13/2005
Keywords:kbbug kbinterop KB300340
©2004 Microsoft Corporation. All rights reserved.