Failed Request Tracing is not creating logs

[Nedim]

You may notice that Failed Request Tracing (FREB) rule is not creating log files even though the condition in your rule is met.

Reinstalling the Tracing module normally solves issues related to FREB but this may not be an acceptable approach if Shared Configuration is used or you can’t restart the server (uninstalling the Tracing module requires server restart)

Solution

Here are a few things to checks:

• Make sure FREB is enabled
• Check if the log path is correct
• Check if the application pool identity has permissions to write to this path
• Add a new website and add a rule for status codes between 200 and 600

If there are still no log files, It’s time to check the applicationHost.config file. For an issue I troubleshot, module references were missing. This is how we solved it:

• Back up applicationHost.config file
• Open the original one. Add the following lines in <globalModules> section

<globalModules>
   …
   <add name="TracingModule" image="%windir%\System32\inetsrv\iisetw.dll" />
   <add name="FailedRequestsTracingModule" image="%windir%\System32\inetsrv\iisfreb.dll" />
   …
</globalModules>

• Add the following line into <modules> section

<modules>
   …
   <add name="FailedRequestsTracingModule" lockItem="true" />
   …
</modules>

• Make sure the provider definitions are correct. Here is a definition that works for WWW Server:

<traceProviderDefinitions>
       … 
       <add name="WWW Server" guid="{-4j25-9512-qp1}">
            <areas>
               <add name="Authentication" value="2" />
               <add name="Security" value="4" />
               <add name="Filter" value="8" />
               <add name="StaticFile" value="16" />
               <add name="CGI" value="32" />
               <add name="Compression" value="64" />
               <add name="Cache" value="128" />
               <add name="RequestNotifications" value="256" />
               <add name="Module" value="512" />
               <add name="FastCGI" value="4096" />
               …
            </areas>
       </add>
       …
</traceProviderDefinitions>

• Restart IIS and test if logs are created now