Setting up Failed Request Tracing to troubleshoot web application issues is pretty straightforward: Install Tracing module in Server Manager, enable Failed Request Tracing in IIS Manager, and add a rule for the type of issue you are working on (500 status code, delay over 10 seconds etc.).
However, you may notice that logs are not created even though the condition in your rule is met.
Note: Uninstalling the Tracing module in Server Manager and installing it back normally solves issues related to FREB but this is sometimes not a convenient approach if Shared Configuration is used or you are not able to restart the server (uninstalling the Tracing module requires server restart)
What to do if Failed Request Tracing (FREB) is not creating logs
Here are a few quick checks to do:
- Double-check if FREB is enabled
- Check if the path for creating logs is correct
- Make sure the application pool identity has permissions to write in this folder
- If everything looks good but the issue still exists, add a new website and add a rule for status codes between 200 and 600. This should trigger logging for all kinds of requests
If there are still no log files, It’s time to dive deep into the applicationHost.config file. This is the IIS configuration file that stores most of the IIS configuration including FREB related references. It is located under C:\Windows\System32\inetsrv\config
In the case I worked on, module references were missing. Here is how we solved the issue:
- Back up applicationHost.config
- Open the original file. Add these lines in <globalModules> section
<globalModules>
…
<add name="TracingModule" image="%windir%\System32\inetsrv\iisetw.dll" />
<add name="FailedRequestsTracingModule" image="%windir%\System32\inetsrv\iisfreb.dll" />
…
</globalModules>
- Add the line below into <modules> section
<modules>
…
<add name="FailedRequestsTracingModule" lockItem="true" />
…
</modules>
- Restart IIS and test if logs are created now
“FailedRequestTracing module detected invalid configuration”
After the changes above, you may come across the error messages below.
Log Name: Application
Source: Microsoft-Windows-IIS-W3SVC-WP
Event ID: 2288
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Description:
FailedRequestTracing module encountered problem while reading configuration. No logs will be generated until this condition is corrected. The problem happened at least 1 times in the last 5 minutes. The data is the error.
Log Name: Application
Source: Microsoft-Windows-IIS-W3SVC-WP
Event ID: 2285
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Description:
FailedRequestTracing module detected invalid configuration on path 'MACHINE/WEBROOT/APPHOST/DEFAULT WEB SITE'. Trace provider or tracing area name 'WWW Server' is not recognized. Check the <traceProviderDefinitions> section for currently supported list or providers and areas. No logs will be generated until this condition is corrected. The problem happened at least 1 times in the last 5 minutes. The data is the error.
Seeing these error messages is actually a good thing. It means Failed Request Tracing started working but it couldn’t find the provider “WWW Server” which was selected in the FREB rule.
Apparently, IIS is not able to read that section with “WWW Server” in the config file. There might be a typo, extra space, etc. Even if you don’t change the config file, If you simply uncheck “WWW Server” from the FREB rule, this error should go away but it may cause having less information in the logs.
In order to solve this issue, check the the definition of the WWW Server provider. Here is a definition that works without issues:
<traceProviderDefinitions>
…
<add name="WWW Server" guid="{-4j25-9512-qp1}">
<areas>
<add name="Authentication" value="2" />
<add name="Security" value="4" />
<add name="Filter" value="8" />
<add name="StaticFile" value="16" />
<add name="CGI" value="32" />
<add name="Compression" value="64" />
<add name="Cache" value="128" />
<add name="RequestNotifications" value="256" />
<add name="Module" value="512" />
<add name="FastCGI" value="4096" />
…
</areas>
</add>
…
</traceProviderDefinitions>
