IIS Exception Monitor

To monitor Microsoft Internet Information Server (IIS) and diagnose problems within IIS and with applications running under IIS, Microsoft Technical Support created the IIS Exception Monitor. This tool monitors processes that are running on the server, looking for exceptions and access violations; it can monitor the system's status until an error occurs, then create a log file with details about what happened and what else was running at the time.

The IIS Exception Monitor consists of three components: the IIS Exception Monitor executable, the IIS Log File Analyzer, and the IIS Script File Customization Wizard. This month, let's look at the IIS Exception Monitor in detail and get an overview of the Log File Analyzer.

You can find the IIS Exception Monitor on Microsoft's Web site. Go to the Microsoft article "INFO: Troubleshooting Exceptions in Internet Server Products" (http://support.microsoft.com/support/ kb/articles/q160/3/60.asp), and download ixcptmon.exe (ixcptmona.exe for Alpha systems). You can also download the articles "Troubleshooting with the IIS Exception Monitor" and "Analyzing Logs from IIS Exception Monitor" from this page.

Installation
To install and configure the IIS Exception Monitor, follow these simple steps.

1. Double-click ixcptmon.exe.
2. Answer Yes to the question Are you sure you would like to install the IIS Exception Analysis Tools? to extract the files in ixcptmon.exe and begin Setup.
3. Select the drive and directory in which you want to install the IIS Exception Monitor. The default directory is C:\ixcptmon. You can install the tool into any directory, but the directory name can't include any spaces.
4. If the directory doesn't exist, answer Yes at the prompt to create the directory.

When the installation completes, the system displays the README file.

Configuration
To configure the IIS Exception Monitor, go to Programs, IIS Exception Monitor, IIS Exception Monitor and double-click Ixcptmon. Then, the IIS Exception Monitoring Wizard will walk you through the system configuration.

1. On the first page, click Next.
2. On the Check Symbols page that appears, select Yes, Verify the IIS symbols that I have installed, then click Next.

   These two steps cause Ixcptmon to review your system and determine which symbol files to install. When you create an executable program, the compiler can generate symbol files to provide a link between the executable file and the variable and function names in the source code. Effectively debugging an application requires using the symbol files, but the retail executable usually doesn't include them to keep its size to a minimum.

3. Ixcptmon lists the symbol files you need. The display varies according to the files you've installed. When the analysis process completes, select the first file in the list and click Download.

   If you have an Internet connection, this step downloads the file from its Microsoft source site. If you don't have an Internet connection, you can install the files from another resource such as the Microsoft Developer Network (MSDN) CD-ROMs.

4. Select each file in succession, and download it. The system prompts you during the process to install the symbol files you downloaded.

Some symbol files are extremely large and take a while to download, depending on the speed of your Internet connection. Also, make sure your system has adequate file space to store the files. When I downloaded the symbols, the files required 135MB.

Execution
If ixcptmon.exe is still running after you install the symbols in the configuration process, you can use the currently executing session. If it's not still running, start ixcptmon.exe as you did in the configuration step.

1. On the first page, click Next.
2. On the Check Symbols page that appears, click No, I am confident that the symbols are installed correctly, then click Next.
3. On the Process Options page that appears, select the type of process you want to monitor, then click Next. You can choose from in-process (within inetinfo.exe), out-of-process, or other processes unrelated to IIS. Most Web applications use in-process components, which execute in the IIS process space (inetinfo.exe). Most applications use in-process components for two reasons: IIS allows only in-process components unless you flip a switch in the metabase to change its default behavior, and in-process components are much faster than out-of-process components. However, the downside to in-process components is that they run in the inetinfo.exe process space. If an in-process component crashes, it's likely to take InetInfo down with it--one good reason for the IIS Exception Monitor. Thus, most of the time, administrators use the IIS Exception Monitor to monitor in-process components within the InetInfo process.
4. On the Session Options page that appears, you can set the way Ixcptmon executes. Ixcptmon has two operation modes: automatic and manual. Automatic turns on automatic monitoring and is the mode you use most of the time. Manual is the mode you use when you're working with Microsoft Technical Support because manual mode lets the support engineer use Ixcptmon to access your system over the Internet and work with you to solve the problem.

Automatic mode lets you monitor one IIS session (single mode) or continually monitor IIS. If IIS crashes while you're in single mode, Ixcptmon writes detailed information about the system's status and components into a log file. The log files are in the Logs directory under the Ixcptmon directory and have a .dbl extension.

Automatic mode also lets you put Ixcptmon into recursive mode to continually monitor IIS. Recursive mode monitors processes until an exception occurs. Then, Ixcptmon updates the log, kills the inetinfo.exe process, restarts inetinfo.exe, and starts monitoring again. Recursive mode in this instance means that Ixcptmon will continually call itself when it discovers a problem. This mode is the best choice in many cases because it automatically restarts the server and begins logging again after a problem occurs. You can start recursive mode interactively on the Session Options page by selecting the Enable Recursive Mode check box.

The Session Options page also lets you enter an address for alerts that the system generates automatically when an exception occurs. If you enter a system name or username in the Notify Admin dialog box, Ixcptmon automatically sends an alert message to the administrator on that system or to the username you enter using Net Send. If you have Collaboration Data Objects (CDO) installed and configured on the system, you can also use an email address for alerts. Then, you can specify the system name or email address on the command line using the /Notify switch followed by the email address. When you have completed the entries on the Session Options page, click Next.

1. On the Start Monitoring page that appears, click Run This Monitoring Session to start Ixcptmon and to begin monitoring. Ixcptmon starts ixcptmon.vbs with the switches set for the options you selected. After you click Run This Monitoring Session, the Successfully started Monitoring using the following command line: cscript.exe ixcptmon.vbs message appears. If the process starts successfully, a Command Prompt window opens. Don't close it because it's the execution window for ixcptmon.vbs.
2. Click Next to display the Session Status screen, which is your interface into the Ixcptmon process. The top part of the Session Status screen displays the current session and any existing log files. When ixcptmon.vbs starts, it shuts down the Web server processes, then restarts them. This process is necessary to hook into IIS to monitor the current applications. Be careful when you start Ixcptmon; I've gotten it into an infinite loop in which two Command Prompt windows were starting and stopping the Web server processes. This problem occurred when I had the system set to monitor IIS in recursive mode. To stop the loop, I had to restart Ixcptmon and return it to single mode.

Utilization
When you start using the IIS Exception Monitor, you need to view the log files that the Ixcptmon process generates with the Log File Analyzer (readlogs.exe). This component has special features to interpret and display the log file information.

You can view the log files that Ixcptmon creates in two ways.

• To access the log files directly from the Session Status screen, as Screen 1 shows, select the log you want to view in the top window on the screen, then click View Log. The top window contains the current running session and the log files for previous sessions. Click the top Refresh Status option at any time to refresh the status display.
• You must stop the monitoring process before you can view the current session's log file. If the IIS Exception Monitor detects an exception, it will automatically stop and write the log. To stop the monitor, open the Command Prompt window for the monitor and press Ctrl+C. This action stops the monitoring and stops and restarts IIS. Then, you can execute Ixcptmon again and view the logs.
• To display any log file, select it in the top window and click View Log. View Log opens the Log File Analyzer, which provides many options for viewing information about the status of the log session and IIS. When you start to view a log, the process reads the log file and, if possible, displays a dialog box that shows what might have triggered any errors in the log. For example, Screen 2 shows the message that occurred when the Log File Analyzer process opened a log file.

When I started the Log File Analyzer, it determined that I was probably using Ixcptmon in manual mode and that I might be trying to monitor 100 percent CPU utilization. Answering Yes to the prompt on Screen 2 displays a message with more information about this problem and provides suggestions for using Windows NT Performance Monitor and the IIS Exception Monitor together to solve the problem. The information from these two messages also appears in the log file window.

You can also use the Log File Analyzer function independently. To start, go to Programs, IIS Exception Monitor, IIS Log File Analyzer. Table 1 shows the buttons you see on the left side of the IIS Log File Analyzer window. These buttons let you access the Log File Analyzer options. Click Help to display readlogs.asp from the MSDN Web site. This Help file has a tremendous amount of useful information about reading and analyzing logs.

An important option is Report, which displays what occurred in the application and what the Log File Analyzer suggests about the problem. You can also configure the report via the Config option. Click Config to display the Readlogs Configuration dialog box that you can use to select your report options.

You can interactively use the Log File Analyzer to view the log file by clicking the appropriate button. These buttons are handy when you need to look for various things in the log file to pin down a problem.

Command Prompt
You can start Ixcptmon from either the Programs menu or the command prompt. To start ixcptmon.vbs automatically in recursive mode, execute it with the /r switch. If you run the monitor routinely on a system, you can place an icon on the task bar or desktop that lets you start ixcptmon.vbs with the appropriate switches.

You can also generate a new script (.vbs) file to customize the Ixcptmon options. The IIS Script File Customization Wizard lets you start with a basic set of functionality and customize it to suit your needs. You can then execute the resulting .vbs file immediately or later. To use the IIS Script File Customization Wizard, perform the following steps:

1. Start the wizard (under Programs, IIS Exception Monitor, IIS Script File Customization Wizard).
2. Select the starting command file, as Table 2 shows.
3. Select the commands to use.
4. Save the file.
5. Execute the IIS Exception Monitor.

The commands you use with the wizard are IIS Exception Monitor commands. You can find information about then in several places, including the readlogs.asp file and the reports that the Log File Analyzer generates.

A Powerful Tool
Ixcptmon is a powerful tool for sleuthing IIS problems. This tool isn't a panacea but rather a tool to help you determine where problems are occurring. Ixcptmon works best when you use it with other tools, such as Performance Monitor.