Client Management Suite

Hi,

Just wondering what folks do to keep their IIS logs (I have a NS 7.1) in check? How many months worth do you keep of them and does Symantec have any recommended guidelines regarding this?

 

Thanks.

Make sure you keep them other than on the C: drive and check your httperr logs too. I've never seen any Symantec guidelines on this, if I think about it I delete any over three months old.

Hi Andy,

The logs are on a D: drive and I didn't realize I had as many as I thought. This may be a totally stupid question, but if I Prune (delete) can I just delete oldest? I notice they have a funky naming convention starting with u_extend1 and continuing on up. I assume (I am no SQL or IIS guy) you should just be able to delete oldest to newest and the naming convention will resume right with the current log it is on?

Thanks.

 

 

That's what I've always done with no problems. But like I said, find your httperr logs, they might be on the C: drive and growing too.

Three month is a safe value.

Additionally, if you wan to keep summary data of the older log files you can run the aila2 toolkit I posted here on Connect. This will give you a nice calendar view that allows you to see IIS patterns and usage growth over time (as well as pinpoint odd patterns - like a redirect loop I found at a custom site this week for example).

Here are tools based around aila2:

• aila2 (the log analyzer by itself) [1]
• aila2-runner [2]
• aila2 siteconfig [3]
• aila2 filter [4]

And here are some documentation:

• aila2: Version 1 Full Package with Installation and Execution Scripts [5]
• aila2-web: Introducing the Calendar View and siteconfig json file [6]
• aila2-web: How to Use Quickview.html to Draw Charts From IIS Log Files [7]

[1] https://www-secure.symantec.com/connect/nl/downloads/aila2-c-program-analyze-altiris-iis-log-files

[2] https://www-secure.symantec.com/connect/nl/downloads/aila2-runner-simple-tool-analyze-all-log-files-folder

[3] https://www-secure.symantec.com/connect/nl/downloads/aila2-siteconfig-tool-generate-site-configuration-file

[4] https://www-secure.symantec.com/connect/nl/downloads/aila2-filter-tool-filter-iis-log-files-time-taken-or-uri-stem-fields

[5] https://www-secure.symantec.com/connect/nl/articles/aila2-version-1-full-package-installation-and-execution-scripts

[6] https://www-secure.symantec.com/connect/nl/articles/aila2-web-introducing-calendar-view-and-siteconfig-json-file

[7] https://www-secure.symantec.com/connect/nl/articles/aila2-web-how-use-quickviewhtml-draw-charts-iis-log-files

All the time that I've administered SMP, I haven't needed more than the last few hours of IIS logs. I'm not sure of your setup but I haven't had to manually define a retention policy for these logs either.

I redirect my IIS logs to a seperate partition and then I am only required to keep the last 30 days so if i notice that partition getting too low I go in and delete anything older than 30 days.
 

I typically keep 90 days of IIS logs on a seperate drive. If you would like you can manually delete the oldest, I utilize a microsoft technet script to purge the log files older than 90 days scheduled to run monthly. You can find the script by searching "Delete IIS Log Files Older Than 90 Days"