- 5 minutes to read

How to monitor the IIS (W3SVC) log files

This guide shows you how to monitor IIS (W3SVC) log files using the Nodinite Log File Parser Monitoring Agent. You will learn how to configure monitoring, set up RegEx filters, and leverage Nodinite's alerting and diagnostics to proactively detect and resolve issues.

On this page, you will learn how to:

✅Set up monitoring for IIS (W3SVC) log files with Nodinite
✅Use RegEx filters to target specific log file patterns
✅Configure alerts for errors and warnings in your IIS logs
✅Access diagnostics and manage log file resources

Info

This guide will teach you how to monitor the IIS (W3SVC) log files using the Nodinite Log File Parser Monitoring Agent.

Note

This article assumes your IIS uses the W3C Extended Log File Format, and the date and time stamp in the IIS log files is in GMT

Before you begin

Ensure you comply with the prerequisites and install the Nodinite Log File Parser Monitoring Agent.

Step 1: Add a new monitoring configuration

To add a new monitoring entry, click the Add button from the Content File tab.
Content File tab
Content File tab in Nodinite Log File Parser Monitoring Agent.

  1. Enable the configuration
  2. Name the configuration
  3. Provide an optional description
  4. Set the Application ID (You must have a matching entry in the Applications Tab)

General Tab
General tab for configuration details.

Step 2: Set the monitor path

Next, enter the path to where the IIS (W3SVC) log files are located (for example, C:\inetpub\logs\LogFiles\W3SVC1).

  1. Enter the path
  2. Enter the RegEx-based filter (\.log$)

Path tab
Path tab for specifying log file location and filter.

Below is a table with some common RegEx file filter examples:

Filter Example Comment
\.xml$ XML Files All XML files with suffix ".xml"
\.txt$ Text Files All text files with suffix ".txt"
^ONLYME\.data$ Specific file Only this file "ONLYME.data"
^PrefixedFileName.*\.csv$ Matching a file name pattern Files with prefix ^PrefixedFileName, and suffix .csv

Step 3: Set the start match

Next, enter the start match configuration.

  1. 'Line contains' (what error codes are we looking for? In this case 4xx and 5xx)
\- \- (4[0-9][02-9]|5[0-9]{2})

Match tab
Match tab for RegEx error code configuration.

  1. Leave the Clear Date Time field empty for now. This field is populated by the system when an end-user is clearing previous problems.
  2. Select the time option (Created after Clear Date Time - File time span)
  3. Set the 'File time span' field to 1.00:00:00. You may need to tune this setting. This allows files created less than a day ago to be included in the monitoring... however, actual Lines are a smaller subset of this collection of files.
  4. Check the 'Lines have a DateTime' checkbox
  5. 'Match date' (the date, in this case, the format is 2017-05-17 13:37:00)
^([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2})

Info

The date is required if you want to ignore previous errors. You can ignore previous errors by clicking the Clear menu item in the Actions button on the Resource.

Warning if previous lines in the text files are ignored
A RegEx for the Date time is required to understand how to parse the date time for rows in the text file.
6. 'Matched date groups': 1

Time options tab
Time options tab for date/time configuration.

Save

You must click 'Save' or 'Save and close' for changes to persist. The new settings/thresholds are evaluated on the next synchronization.
Save and Close buttons
Here's an example of the Save options.

Note

The delay in presenting the new evaluated state depends on the monitoring agent's synchronization interval

Save and close, save, and close the dialogue.
Cancel, closes the dialogue without saving any changes.

Step 5: Configure the Monitor View

Next, add the named Resource to a Monitor View.

Errors detected
Here's an example of a Monitor View with errors detected in IIS log files.

You can further review the details about the errors by clicking on the Actions button, and then clicking on the Error Report menu item.
error action
Error Report action in Monitor View.

This action opens a new modal with a list of all IIS log files where an error is still active (> last clear date-time).
Error Report
Error Report modal with active errors.

Additional information is available if you expand the row.
Details
Expanded error details in the Error Report.

Tip

You can ignore old errors; by clicking on the Clear Errors menu item in the Actions button. The Resource is then in the OK state until an entry matching the configuration is later found.

Step 6: Manage Diagnostic Log Files

To view the set of diagnostics files included in the Monitoring, click the Actions button, and then, the Show Log file(s) menu item.
Show Log File(s) menu item
Show Log File(s) menu item for diagnostics.

Next, a screen presents including a table with all the Nodinite diagnostics log files.
Log Files
Diagnostics log files table.

You can perform the following Actions on the diagnostic files:

Next Step

Nodinite File Monitoring Agent