ETW logging for IIS is a built-in diagnostic tool for tracking and logging events in IIS for troubleshooting performance issues, error tracking, and analyzing server behavior. 1. It captures detailed event data from Windows kernel and user-mode applications, such as HTTP requests, response times, failure information, and IIS internal processes; 2. Unlike traditional logs, ETW logs are stored in binary format and need to be processed by tools such as WPA or logman; 3. Low overhead, suitable for production environments, and supports real-time tracing and post-event analysis; 4. Especially suitable for diagnosing intermittent or difficult to reproduce; 5. Enable methods include using logman commands to create trace sessions, or managed through PerfMon and WPA; 6. It is recommended to use when standard IIS logs cannot meet requirements, such as positioning performance bottlenecks, cross-component tracing or obtaining detailed call stacks; 7. Analysis tools include WPA, logman/tracefmt and PerfView, which can visualize event timelines, CPU usage, and thread activity. Although ETW logging is not often used, it is very effective when analyzing server health in depth.

ETW logging (Event Tracing for Windows) for IIS is a built-in diagnostic tool that helps track and record events happening within IIS (Internet Information Services). It's useful for troubleshooting performance issues, tracking down errors, or understanding how your web server is being under different conditions.

Here's how it works and what you need to know.

What ETW Logging Does in IIS

ETW logging in IIS captures detailed event data from the Windows kernel and user-mode applications. It gives you insight into the HTTP requests, response times, failures, and internal IIS processes.

Unlike traditional logging methods that write to text files, ETW logs are captured in binary format and can be processed later using tools like Windows Performance Analyzer (WPA) or logman .

• It's low overhead, so it can be used in production environments.
• It supports real-time tracing and post-processing analysis.
• It's especially useful when you need to diagnose intermittent or hard-to-reproduce issues.

How to Enable ETW Logging for IIS

Enabling ETW logging involves setting up a trace session that listens for IIS-related events. Here's a basic way to do it using logman :

1. Open Command Prompt as Administrator.
2. Start a trace session:

    logman start "IIS-ETW-Trace" -p "IIS" -o "C:\traces\iis.etl" -ets

3. Reproduce the issue or wait for events to occur.
4. Stop the trace:

    logman stop "IIS-ETW-Trace" -ets

You can also use Performance Monitor (PerfMon) or WPA to start and manage traces.

Make sure the output directory exists and you have write permissions.

When to Use ETW Logging instead of Standard IIS Logs

Standard IIS logs (like W3C logs) are great for tracking basic request data. But they don't show you what's happening under the hood.

ETW logging is better when:

• You're dealing with performance bottlenecks like slow requests or high CPU usage.
• You want to trace events across multiple components (eg, IIS, ASP.NET, SQL).
• You need to capture detailed call stacks or timing data.

For example, if you notice some requests take 5 seconds occasionally but can't find the cause in regular logs, ETW can help you pinpoint where the time is being spent.

Tools to Analyze ETW Logs

Once you've captured an ETW trace, you'll need the right tools to make sense of it.

Here are the most common ones:

• Windows Performance Analyzer (WPA) – Part of the Windows ADK, it provides a visual way to analyze traces.
• logman / tracefmt – Useful for command-line processing and scripting.
• PerfView – A free tool from Microsoft that helps analyze ETW data, especially for .NET applications.

These tools can show you times of events, CPU usage, thread activity, and more.

Don't expect ETW logs to be human-readable in raw form – they need to be parsed and visualized.

ETW logging for IIS isn't something you'll use every day, but it's a powerful tool when you need to dig deeper into what's happening on your server. It's not overly complicated to set up, but knowing how to interpret the data makes all the difference.

Basically that's it.

The above is the detailed content of What is ETW logging for IIS?. For more information, please follow other related articles on the PHP Chinese website!