IIS logs stopped working :(

Copper Contributor

We have been collecting IIS logs from a couple of servers for a month - everything working nicely.



However 2 days ago no more data was coming into the W3CIISLog table. I tried updating the MMA agent, rebooting the server, verifying IIS settings (hourly rollover). Log files also checks out on local disk of the server. But alas still no new data. We are getting other metrics (perf counters) from MMA, just no more IIS logs.



Any ideas?

3 Replies

Found this in event log on one server:


A module of type "Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.CloudFileUploadWriteAction" reported an exception Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.FileUploadException: Unable to get blob container for iislog from https://5a2a6ac1-5781-44f1-84c7-486e3b24XXXX.ods.opinsights.azure.com/ContainerService.svc. Will keep trying according to the specified policy. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
   at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
   at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
   --- End of inner exception stack trace ---
   at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
   at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)
   --- End of inner exception stack trace ---
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult)
   at Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.CloudFileUploadWriteAction.GetRequestStreamCallback(IAsyncResult asynchronousResult)
   --- End of inner exception stack trace --- which was running as part of rule "Microsoft.IntelligencePacks.IISLogUpload.LogUpload" running for instance "" with id:"{FA96AF16-353E-1089-6DEC-A4746ED4XXXX}" in management group "AOI-5a2a6ac1-5781-44f1-84c7-486e3b24XXXX".

@pjohnsen  did you discover the cause/solution? I've got the same problem....




@roryk After filing a support ticket, in the end we were told it was because of some networking issue in the region, so that the MMA on our servers were unable to send data to the IIS logs endpoint.