{"id":264,"date":"2026-01-08T02:00:05","date_gmt":"2026-01-08T02:00:05","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=264"},"modified":"2026-10-31T22:09:53","modified_gmt":"2026-10-31T22:09:53","slug":"iis-logging-analysis-slow-requests-errors","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/","title":{"rendered":"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors"},"content":{"rendered":"<p class=\"wp-block-paragraph\">IIS logs are the cheapest source of truth on a Windows server: plain text, written by the kernel-mode HTTP driver, and free to collect. They are also where most operators stop, because a folder of <code>u_ex261101.log<\/code> files is not analysis. The difference between a log directory and a working baseline is choosing the right W3C fields, rolling files on a boundary you can reason about, and running two or three queries that turn 200 MB of text into a list of slow URLs. This walkthrough does that on a small <a href=\"https:\/\/windows-vps.org\/\">Windows VPS running IIS<\/a> where the log volume and the disk are both finite.<\/p>\n\n<h2 class=\"wp-block-heading\">W3C field selection: what to log and what to skip<\/h2>\n<p class=\"wp-block-paragraph\">IIS logs W3C extended format with 24 selectable fields. The default set counts traffic and says nothing about latency, so open IIS Manager, select the site, open Logging and click Select Fields. Enable <code>time-taken<\/code>, <code>sc-status<\/code>, <code>sc-substatus<\/code>, <code>sc-win32-status<\/code>, <code>cs-method<\/code>, <code>cs-uri-stem<\/code>, <code>cs-uri-query<\/code> and <code>cs(User-Agent)<\/code>. Those eight plus the date and time give you everything needed to find slow requests and errors.<\/p>\n<p class=\"wp-block-paragraph\">Leave <code>cs(Cookie)<\/code> and <code>cs(Referer)<\/code> off. Cookies add 200-600 bytes per line on a session-heavy site and inflate the log by a third. <code>time-taken<\/code> is in milliseconds by default; on IIS 8.5 and later switch Logging to &#8220;Time&#8221; mode in bytes for a decimal value that sorts cleanly.<\/p>\n\n<h2 class=\"wp-block-heading\">Log rollover, retention and the disk they eat<\/h2>\n<p class=\"wp-block-paragraph\">Daily rollover is the default and right for most sites. Above 50,000 requests per day, go hourly: a 200 MB daily file is slow to search. Site-level truncation limits stop a runaway loop writing 30 GB before anyone notices.<\/p>\n<p class=\"wp-block-paragraph\">Estimate first: a request line is 180-260 bytes with default fields and 350-450 with query string, user agent and latency, so 10,000 requests per day is about 300 MB a month. Delete logs older than 30 days from Task Scheduler with <code>forfiles \/p C:\\inetpub\\logs\\LogFiles \/s \/m *.log \/d -30 \/c \"cmd \/c del @path\"<\/code>.<\/p>\n\n<h2 class=\"wp-block-heading\">Querying with PowerShell before installing anything<\/h2>\n<p class=\"wp-block-paragraph\"><code>Select-String<\/code> gets you surprisingly far on a single day file, and it is already installed. It is best for text matching &#8211; counting requests to a path, finding a user agent &#8211; but it cannot do a numeric comparison on <code>time-taken<\/code> because that field is the last one on the line and string sorting puts &#8220;900&#8221; after &#8220;12000&#8221;. Split the line and cast instead.<\/p>\n<p class=\"wp-block-paragraph\">The reliable one-liner: <code>Get-Content .\\u_ex261101.log | Select-Object -Skip 4 | ForEach-Object { $f = $_ -split ' '; [pscustomobject]@{ T=[int]$f[-1]; U=$f[5]; S=$f[8] } } | Where-Object { $_.T -gt 5000 } | Sort-Object T -Descending | Select-Object -First 40<\/code>. Skip the four header lines, split, cast, filter. That produces the 40 worst offenders with their URL stems and status codes in about four seconds for a 50 MB file.<\/p>\n\n<h2 class=\"wp-block-heading\">Log Parser Studio for grouped analysis<\/h2>\n<p class=\"wp-block-paragraph\">Log Parser Studio is a free GUI over the Log Parser 2.2 engine, and it comes with built-in query templates: slowest pages, top error URLs, requests by status code per hour. Point it at the log folder, pick the IIS W3C input format, and run the &#8220;IIS &#8211; Top 25 slowest pages&#8221; template; it reads many files per query without loading them into memory.<\/p>\n<p class=\"wp-block-paragraph\">A typical query groups by <code>cs-uri-stem<\/code> and averages <code>time-taken<\/code> while counting hits, so one slow endpoint with 50 hits does not get buried under a page that took 9 seconds once: <code>SELECT TOP 50 cs-uri-stem, COUNT(*) AS Hits, AVG(time-taken) AS AvgMs, MAX(time-taken) AS MaxMs FROM *.log WHERE time-taken &gt; 1000 GROUP BY cs-uri-stem ORDER BY AvgMs DESC<\/code>. Run the same query against a quiet week and a busy week and compare the averages, not the maximums.<\/p>\n\n<h2 class=\"wp-block-heading\">Correlating time-taken with app pool recycles<\/h2>\n<p class=\"wp-block-paragraph\">A latency spike with no code change and no traffic change is usually a recycle, and the recycle is usually caused by something other than the 1740-minute default. Memory limit, private bytes limit, or a config file change dropped into <code>bin<\/code> all trigger one. Recycling pauses request processing for a few seconds while the new worker starts, and any request already in flight is logged with a <code>time-taken<\/code> that includes the wait or with a 503 if the rapid-fail protection kicked in. Compare the timestamp of the slow traffic with the Application event log entry <code>WAS<\/code> event ID 5076 or the System log <code>WAS<\/code> 5009.<\/p>\n<p class=\"wp-block-paragraph\">Look for the shape rather than the event. A recycle produces a narrow band of slow requests, typically a 3-8 second spike on all endpoints at once, followed by normal times. A slow database produces a spike only on pages that query it. A slow disk or memory pressure produces slow times that rise gradually through the day and drop after a recycle. Set <code>Idle Time-out<\/code> to 0 and prefer a scheduled recycle at a fixed time over the default 1740-minute interval, so the spike lands where you can see it rather than in the middle of a customer order.<\/p>\n\n<h2 class=\"wp-block-heading\">Building an HTTP status baseline<\/h2>\n<p class=\"wp-block-paragraph\">What matters is the 5xx ratio per endpoint per hour, not the absolute count. A baseline query groups by status code and URL stem per day and stores the result as CSV; a week of those lets you alert on change rather than a fixed threshold. A healthy site sits near 92-97 percent 200s, 1-2 percent 404s from bots and favicon misses, and under 0.3 percent 5xx.<\/p>\n<p class=\"wp-block-paragraph\">Read <code>sc-win32-status<\/code> too. A 500 with win32 status 64 is a client reset, not your bug; 995 is a cancelled completion, usually a proxy timeout; a 401 with substatus 2 is a Windows auth handshake. Counting 500s without substatus means chasing phantom incidents.<\/p>\n\n<h2 class=\"wp-block-heading\">Where verbose logging stops being worth it<\/h2>\n<p class=\"wp-block-paragraph\">Above roughly 200 requests per second, logging costs real disk writes that compete with the app. Log only errors at the logging layer, keep one sampled week for trends, and let a reverse proxy or CDN handle request-level detail.<\/p>\n<p class=\"wp-block-paragraph\">The same rule applies to a VPS that is short on disk. If you must choose between 30 days of logs and 10 GB of free space, keep the logs but compress them nightly; the files compress 8:1 to 12:1 and a plain NTFS compressed folder costs almost nothing to read back. Whatever you choose, write the retention rule down, because nobody remembers why <code>W3SVC3<\/code> stopped producing files six months later.<\/p>\n\n<h2 class=\"wp-block-heading\">When to switch to failed request tracing<\/h2>\n<p class=\"wp-block-paragraph\">Logs say a request was slow but not where in the pipeline it spent the time. Failed Request Tracing captures each module&#8217;s entry and exit, authentication, rewrite rules and handler execution as XML for one request. Enable it per site with a rule for status codes 500-599 plus a <code>time-taken<\/code> threshold of 10,000 ms, put the directory on a different drive from the logs, and cap total files at 200.<\/p>\n<p class=\"wp-block-paragraph\">Turn it on for the hour you need and off afterwards; a bot hammering a missing page can fill a disk in a day. On a <a href=\"https:\/\/windows-vps.org\/\">small Windows VPS with a single data disk<\/a>, the pragmatic split is: W3C logs always on with daily rollover, FRT on demand with a 1 GB cap, and the two to three queries from this guide saved as a script you can rerun after every deploy.<\/p>\n\n<h2 class=\"wp-block-heading\">The five-minute weekly routine<\/h2>\n<p class=\"wp-block-paragraph\">Once fields and rollover are set the routine is small: slowest-URL query for seven days, diff the top twenty against last week, 5xx ratio per endpoint, confirm retention deletes files, compare volume to bandwidth. Four numbers, one command each.<\/p>\n<p class=\"wp-block-paragraph\">Anything that shows up gets a failed-request trace attached to the ticket before anyone restarts the app pool, because restarting first destroys the evidence.<\/p>","protected":false},"excerpt":{"rendered":"<p>If you are looking for a reliable way to transfer files between your Windows computer and an Ubuntu VPS you have come to the right place In this guide we will explore how to connect to ftp from windows to ubuntu vps<\/p>\n","protected":false},"author":1,"featured_media":265,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":2,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-264","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors - Windows VPS Blog<\/title>\n<meta name=\"description\" content=\"If you are looking for a reliable way to transfer files between your Windows computer and an Ubuntu VPS you have come to the right place In this guide we will explore how to connect to ftp from windows to ubuntu vps\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors\" \/>\n<meta property=\"og:description\" content=\"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-08T02:00:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-31T22:09:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"854\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@myxiechengxuan\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/\",\"name\":\"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg\",\"datePublished\":\"2026-01-08T02:00:05+00:00\",\"dateModified\":\"2026-10-31T22:09:53+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"description\":\"If you are looking for a reliable way to transfer files between your Windows computer and an Ubuntu VPS you have come to the right place In this guide we will explore how to connect to ftp from windows to ubuntu vps\",\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#primaryimage\",\"url\":\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg\",\"contentUrl\":\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg\",\"width\":1280,\"height\":854},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\",\"https:\/\/x.com\/myxiechengxuan\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors - Windows VPS Blog","description":"If you are looking for a reliable way to transfer files between your Windows computer and an Ubuntu VPS you have come to the right place In this guide we will explore how to connect to ftp from windows to ubuntu vps","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/","og_locale":"en_US","og_type":"article","og_title":"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors","og_description":"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors","og_url":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-01-08T02:00:05+00:00","article_modified_time":"2026-10-31T22:09:53+00:00","og_image":[{"width":1280,"height":854,"url":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg","type":"image\/jpeg"}],"author":"windows-vps","twitter_card":"summary_large_image","twitter_creator":"@myxiechengxuan","twitter_misc":{"Written by":"windows-vps","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/","url":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/","name":"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#primaryimage"},"image":{"@id":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#primaryimage"},"thumbnailUrl":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg","datePublished":"2026-01-08T02:00:05+00:00","dateModified":"2026-10-31T22:09:53+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"description":"If you are looking for a reliable way to transfer files between your Windows computer and an Ubuntu VPS you have come to the right place In this guide we will explore how to connect to ftp from windows to ubuntu vps","breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#primaryimage","url":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg","contentUrl":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2026\/01\/11088.jpg","width":1280,"height":854},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/iis-logging-analysis-slow-requests-errors\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"IIS Logging and Log Analysis on a Windows VPS: Finding Slow Requests and Errors"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog","https:\/\/x.com\/myxiechengxuan"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=264"}],"version-history":[{"count":4,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/264\/revisions"}],"predecessor-version":[{"id":987,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/264\/revisions\/987"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media\/265"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}