Support >
  About cybersecurity >
  IIS7 Complete Raiders Failed Request Tracking Configuration
IIS7 Complete Raiders Failed Request Tracking Configuration
Time : 2023-01-05 09:27:00
Edit : Jtti

Failed request tracing can be configured at two levels:

- At the site level, you can enable or disable tracing and configure log file settings.

- At the application level, it is possible to specify failure conditions when capturing trace events, while also configuring which trace events should be captured in log file entries.

(1) View the list of failed request tracking rules

To manage trace rules for failed requests, you can view a list of all trace rules for failed requests at a specific configuration level. The list can be sorted by path, associated trace provider, HTTP status code, time taken to process the request, or scope (local or inherited). Additionally, rules can be grouped by scope to quickly see which rules apply at the current configuration level, and which rules are inherited from a parent.

1. Open IIS Manager and navigate to the level you want to manage.

2. In "Function View", double-click "Failed Request Tracking Rules".

In addition, it can also be implemented through the command line. To view the list of failed request tracking rules, please use the following syntax:

appcmd configure trace “string”

The variable string is the name of the site whose list of failed request tracing rules to view.

(2) Enable trace logging for failed requests

If you want IIS to log information about requests that fail to serve site or application content, you can enable trace logging for failed requests. When trace logging for failed requests is enabled, IIS provides targeted logs, eliminating the need to wade through lists full of irrelevant log entries to find failed requests. Also, bugs can be resolved without reproducing them.

The following can be configured:

- the location of the log file

- the maximum number of log files to keep

- The maximum size of the log file.

1. Open IIS Manager and navigate to the level you want to manage.

2. In the Connections pane, click Websites.

3. In the Feature View, select the site for which you want to enable trace logging.

4. In the Actions pane, under Configuration, click Failed Request Tracking.

5. In the Edit Site Failed Request Tracking Settings dialog box, select Enabled to enable logging for this site.

6. In the "Directory" text box, type the path where you want to store the log files, or click the browse button ("...") to find the desired location on your computer. The default path is %SystemDrive%\inetpub\logs\FailedReqLogFiles.

  Note:

It is best practice to store log files (such as those for failed request traces) in a directory outside of systemroot.

7. In the Maximum number of trace files text box, type the maximum number of trace log files to keep, and then click OK.

(3) Disable failed request tracking logging

Site-level trace logging of failed requests can be disabled when it is no longer necessary to trace failed requests to the site or to applications on the site. When trace logging for failed requests is disabled, IIS no longer creates trace logs for any requests to the site that fail by the definition of failure.

1. Open IIS Manager and navigate to the level you want to manage.

2. In the Connections pane, click Websites.

3. In the Feature View, click the site for which you want to disable trace logging.

4. In the Actions pane, under Configuration, click Failed Request Tracking.

5. In the Edit Website Failed Request Tracing Settings dialog box, clear Enabled, and then click OK.

(4) Create tracking rules for failed requests

If a request to the server fails or takes too long, you can define a failed request trace rule that will capture trace events for this request and log them as they occur without reproducing the corresponding mistake. Events are written to the trace log only when a request exceeds the time interval allotted for processing to complete, or if a response generates the specified combination of HTTP status and sub-status codes. The trace log only contains information specific to that failed request. Find the information you need about a specific failed request without having to consult a large log file containing every request.

Note: Trace logging must be enabled before trace logs can be created for failed requests. For more information about how to enable trace logging, see IIS 7.0: Enabling Trace Logging for Failed Requests.

Note: When a configuration setting is added, it is added at the local level and at all sublevels that inherit the setting.

1. Open IIS Manager and navigate to the level you want to manage.

2. In "Function View", double-click "Failed Request Tracking Rules".

3. On the Failed Request Tracking Rules page, click Add in the Actions pane.

4. In the Specify what to track area of the Add Failed Request Tracking Rule dialog box, select:

- everything (*) – when all files in a directory are to be tracked.

- ASP.NET (*.aspx) – when all .aspx files in a directory are to be tracked.

- ASP (*.asp) – when all .asp files in a directory are to be tracked.

- Custom - When the definition fails for a certain custom content set (such as "xyz.exe" or "*.jpg"). It can contain at most one wildcard and must be within the directory defined by the set-failure request?.

5. Click Next.

6. In the Define Trace Conditions area of the Add Failed Request Trace Rule dialog box, select one or more of the following conditions to trace:

- Status Code – Enter the status code to track. Multiple comma-separated status codes can be entered in this list. Status codes can also be subdivided using sub-status codes, such as "404.2.500".

- Elapsed Time – Enter the maximum time (in seconds) that the request should take.

- Event Severity – Select the severity level to track from the Event Severity drop-down list. You can choose Error, Fatal Error, or Warning.

Note: If all conditions are specified, the first condition met will generate a failed request trace log file.

7. Click Next.

8. In the Select a Trace Provider area of the Add Failed Request Trace Rule dialog box, under Provider, select one or more of the following trace providers:

- ASP – When you want to track the start and completion of the execution of an ASP request.

- ASPNET - when you want to see the transfer of requests into and out of managed code. This includes *.aspx requests.

- ISAPI extensions – when you want to track requests going into and out of the ISAPI extension process.

- WWW Server - When requests are to be traced through the IIS worker process.

9. In the Select a Trace Provider area of the Add Failed Request Trace Rule dialog box, under Verbosity, select one or more of the following verbosity levels:

- General – Provides information giving the context of the request activity, for example, a GENERAL_REQUEST_START event that logs the requested URL and verb.

- Fatal Errors – Provides information about operations that could cause the process to exit or are about to cause the process to exit.

- Errors – Provides information about the component that encountered an error and was unable to continue processing the request. These errors usually indicate server-side problems.

- Warning – Provides information about components that encountered an error but can continue processing the request.

- Info – Provides general information about the request.

- Detailed – Provides detailed information about the request. This is the default selection.

10. If you selected the "ASPNET" trace provider in step 8, in the "Select Trace Provider" area of the "Add Failed Request Trace Rule" dialog box, under "Area", select the One or more of the following functional areas:

- Structural - When you want to track events primarily related to entering and leaving various parts of the ASP.NET structure.

- Modules – When you want to track events logged as requests enter and leave the various HTTP pipeline modules.

- Pages – When you want to generate trace events corresponding to the execution of specific ASP.NET page-related events (eg, Page_Load, etc.).

- AppServices – when you want to track events logged as part of the new AppServices functionality.

11. If you selected the WWW Server trace provider in step 8, under Region in the Select Trace Provider region of the Add Failed Request Tracing Rule dialog box, select the One or more of the following functional areas of :

- Authentication - When you want to track authentication attempts, for example, when tracking authenticated usernames, authentication schemes (anonymous, basic, etc.), and results of authentication attempts (success, failure, error, etc.).

- Security – When you want to generate a trace event when the IIS server rejects a request for security-related reasons (for example, denying a client's request to access a resource).

- Filters – When you want to determine how long ISAPI filters take to process requests.

- StaticFile – when you want to track the time it takes to complete a static file request.

- CGI – when trace events are to be generated if the request is for a CGI file.

- Compressed – when trace events are to be generated if the response is a compressed response.

- cache – when trace events are to be generated for cache operations associated with the request.

- RequestNotifications – When to capture all request notifications on entry and exit.

- Modules – when you want to trace events that are logged as requests enter and leave various HTTP pipeline modules, or when you want to capture trace events for managed modules.

12. Click Finish.

(5) Editing failed request tracking rules

When you want to change the failure definition of a rule, you can change the failed request tracking settings. You can also change these settings when you want to gather additional information about failed requests, for example, when you want to change the length of time to wait for a response before treating a request as a failed request.

1. Open IIS Manager and navigate to the level you want to manage.

2. In "Function View", double-click "Failed Request Tracking Rules".

3. On the Failed Request Tracking Rules page, click the rule that you want to change, and then click Edit in the Actions pane.

4. In the Specify What to Track dialog box, click Next.

5. You can also perform one or more of the following operations in the "Define Trace Conditions" dialog box:

- Change the status code in the Status Code text box to track failures with the changed status code.

- Change the "Elapsed time (seconds)" and type the time interval in the "Elapsed time (seconds)" text box.

- Change the event severity by selecting a new severity from the Event Severity drop-down list and click Next.

6. Optionally, in the Select Trace Provider dialog box, do one or more of the following to change the provider:

- Click ASP if you want to configure IIS to trace ASP requests.

- Click ASPNET if you want to configure IIS to trace ASP.NET requests.

- Click WWW Server if you want to configure IIS to track WWW server requests.

- Click ISAPI Extensions if you want to configure IIS to trace ISAPI requests.

7. Optionally click on a provider to change its level of detail.

8. Under Provider Properties, in the Verbosity drop-down list, click a level of detail.

9. Repeat steps 7 and 8 for each provider selected in the Select Trace Provider dialog box and whose verbosity level you want to change.

10. Optionally click on a provider to change the area you want it to track.

11. Under Region, select the region you want this provider to track.

12. Repeat steps 10 and 11 for each provider selected in the Select Tracking Provider dialog box that you want to change the area it tracks.

13. Click Finish.

Note: At least one trace provider must be specified for the Done button to be enabled.

(6) Delete failed request tracking rules

If you no longer need to trace a specific request failure, you can delete the trace rule for the failed request. A failed request tracking rule at the local level can be deleted, or a failed request tracking rule inherited from a parent level can be deleted.

1. Open IIS Manager and navigate to the level you want to manage.

2. In "Function View", double-click "Failed Request Tracking Rules".

3. On the Failed Request Trace Rules page, click the trace rule you want to delete to select it.

4. In the Actions pane, click Remove, and then click Yes.

JTTI-Defl
JTTI-COCO
JTTI-Selina
JTTI-Ellis
JTTI-Eom