Make Time for the Convlog Utility; IIS Not Responding?

Editor's Note: Do you have a solution, code, or product recommendation that would benefit our readers? We'd love to hear from you. Email your IIS and Site Server solutions (400 words or less) to R2R at [email protected]. We'll edit submissions for style, grammar, and length. If we print your contribution, you'll get $100.

Make Time for the Convlog Utility
I inherited an IIS system and the task of generating a traffic analysis. When I looked at the logs, I found many megabytes of log files in the W3SVC format. Although this format had a lot of information in it, the time in the logs used Greenwich Mean Time (GMT) instead of local time. I was about to write some custom software to convert the time field when I discovered the convlog.exe utility, which ships with IIS. Convlog stands for convert log, and the utility converts any standard IIS log format into the National Center for Supercomputing Applications (NCSA) log format. What makes Convlog great is that it automatically converts the time to your local time, if you tell it to. Additionally, the utility performs a DNS name lookup on IP addresses in the log if you request it.

For example, the command

CONVLOG -ie extended.log -t ncsa:-0700

converts the W3SVC log to NCSA and adjusts the GMT time by 7 hours, making it Mountain Time in the United States.

NCSA logs don't contain all the information the W3SVC logs have, but they were sufficient for my purposes, and Convlog made easy work of getting the time zones corrected. For more information, refer to the IIS logging documentation.

—Brett Hill
[email protected]

IIS Not Responding?
I've had a few experiences in which IIS stopped responding. Usually, this lack of response is the result of poorly coded application-server middleware; sometimes it's even the result of Denial of Service (DoS). These situations are never convenient, and in many instances, a fix requires manual intervention. I began hunting and found a great piece of shareware called ServiceKeeper by Active+ Software (http://www.activeplus.com/us). While ServiceKeeper isn't an IIS-specific tool, it has come in pretty handy on a few of my IIS-dedicated machines.

ServiceKeeper can detect services that aren't running either by using Windows NT 4.0 service status or by testing using TCP/IP services such as Telnet, Ping, HTTP, and FTP. The application can recover a service by restarting that service, running a custom script, or rebooting the machine entirely. For my servers, I use a custom script.

A problem I encountered several times was that although IIS had stopped responding to requests, the service (w3svc) was still running. I tried to stop the service manually, but IIS reported that the service wasn't responding to control requests. So, using two tools from the Microsoft Windows NT Server 4.0 Resource Kit, I devised a script that forcibly stops and then restarts the inetinfo.exe process. The script is as follows:

kill inetinfo.exesleep 2net start w3svcnet start msftpsvc

You have to include the 2 seconds of sleep in order to allow the process to stop completely before restarting.

ServiceKeeper sells for $245 for two monitored servers, and it's well worth it if the machine in question is important. I installed ServiceKeeper 3 months ago, and since then the application has fixed the machine 10 times—on all occasions with as little as 10 seconds of downtime—and I was able to monitor ServiceKeeper in the Application Event Log.

—Chris Lehr
[email protected]