Over the last couple of months among other things I’ve been working on a tool to automatically the logs and information in my team we usually ask at the beginning of a new Support Call: all standard things such as IIS logs, event logs, .config files etc… Not all of those files are necessary for every case (as usual it depends on the problem at hand), but experience tells me the more information we have about the environment, the more chances we have to spot small inconsistencies, configuration problems etc… that sometimes can lay unnoticed and interfere with our work.

I tried to keep the UI as simple and organized as possible, utilization is very easy, just run it and click the “Collect” button, sit there a couple of minutes (how much exactly will depend on the logs collected) and you’re done. Please note that I’m still working on it, this is just a preview release but I’d love to have your feedback/bug reports/feature requests etc…, keeping in mind that the scope of this tool is to facilitate troubleshooting and data collection for IIS/ASP.NET related problems, I am not interested (and probably do not have the time) to build an omnicomprehensive tool to replace everything else we have today.

So, here is the list of what it collects so far:

  • IIS

    • IIS logs
    • IIS configuration (content of C:\Windows\System32\Inetsrv\config for IIS 7, metabase.xml for IIS 6)
    • HttpErr logs
    • Freb logs (IIS 7 only)


    • .config files and .browser files under .NET Framework installation folder(s): all versions available on the machine
    • .config files for the sites/vdirs configured in IIS (the list of sites and applications is dynamically read from the config store)
    • ASP.NET setup logs
    • ACLs for the sites and applications defined in IIS (the list of sites and applications is dynamically read from the config store)
    • Result from browsing get_aspx_version.aspx (the page does not exist, this is made on purpose to get the 404 error page from IIS)

  • Event Logs

    • Application
    • Security (not enabled by default)
    • System

  • Environment

    • System information (uses msinfo32.exe, might take a few minutes to complete)

  • Output location

    • By default the tool creates a new folder named with the current date and time in the same folder where you run the tool from, but you can chose a different location if you like

Update (March 9th, 2010): added support for IIS 6. Current version is 0.5

Update (March 13th, 2010): made some "code cleanup" and optimizations, source code available for download. Current version is 0.5.1

Already on the “to do” list:

  • Add possibility to copy IIS logs only for a specific timeframe (currently it copies all the logs in the folder but on a busy production server this could be a huge amount of data, mostly not useful) 
  • Support IIS7 shared configuration
  • Collect local policy information for the worker process account
  • Collect custom event logs (in case one is used to store custom application messages)
  • Improve performances and enhance application logging
  • Implement a log report (such a summary HTML page or similar) for easy access and review to the collected information
  • Automatically compress the collected logs for an easier transfer
  • Suggestions?

Comments (15)

  1. dm3281 says:

    Have you thought about posting the source?

  2. Yes, I'll do; I'm completing the IIS6 part then I'll publish the new version and the code

  3. Hashname says:

    Wow..this's brilliant..

    I can't count how many times I had to painfully guide our server admins to collect these logs from the production servers!! (those guys are primarily Unix server admins, and uses Windows machines only for MS Office!!!)

    Waiting patiently for the Win 2003 version..

    Thanks for sharing...

  4. The new version with IIS6 support is here 🙂

  5. rob says:

    Crashes on startup for me on Win7 x64:

    0:000> !pe -nested

    Exception object: 000000000232f400

    Exception type: System.ComponentModel.Win32Exception

    Message: The network path was not found

    InnerException: <none>

    StackTrace (generated):

       SP               IP               Function

       000000000040A8E0 000007FEF02BF34C System_ni!System.Diagnostics.PerformanceMonitor.Init()+0x1b6b9c

       000000000040C930 000007FEF0107AEC System_ni!System.Diagnostics.PerformanceCounterLib.GetPerformanceData(System.String)+0x5c

       000000000040C990 000007FEF01057F4 System_ni!System.Diagnostics.PerformanceCounterLib.get_CategoryTable()+0xa4

       000000000040CAA0 000007FEF0105CD4 System_ni!System.Diagnostics.PerformanceCounterLib.CounterExists(System.String, System.String, Boolean ByRef)+0x24

       000000000040CB10 000007FEF0105BF9 System_ni!System.Diagnostics.PerformanceCounterLib.CounterExists(System.String, System.String, System.String)+0x59

       000000000040CB70 000007FEEFBABA22 System_ni!System.Diagnostics.PerformanceCounter.Initialize()+0x192

       000000000040CC00 000007FF001A9A38 IDEVDataCollector!IDEVDataCollector.Form1.InitializeComponent()+0x9808

       000000000040ECC0 000007FF001A0208 IDEVDataCollector!IDEVDataCollector.Form1..ctor()+0x68

       000000000040ECF0 000007FF001A0168 IDEVDataCollector!IDEVDataCollector.Program.Main()+0x48

    StackTraceString: <none>

    HResult: 80004005

    Nested exception -------------------------------------------------------------

    Exception object: 000000000232f1d8

    Exception type: System.IO.IOException

    Message: The network path was not found.

    InnerException: <none>

    StackTrace (generated):

       SP               IP               Function

       000000000040C800 000007FEF29CEF17 mscorlib_ni!Microsoft.Win32.RegistryKey.Win32ErrorStatic(Int32, System.String)+0x3a08b7

       000000000040C850 000007FEF262EC69 mscorlib_ni!Microsoft.Win32.RegistryKey.OpenRemoteBaseKey(Microsoft.Win32.RegistryHive, System.String)+0xd9

       000000000040C8D0 000007FEF0108859 System_ni!System.Diagnostics.PerformanceMonitor.Init()+0xa9

    0:000> lmvm IDEVDataCollector

    start             end                 module name

    00000000001a0000 00000000001c6000   IDEVDataCollector C (no symbols)          

       Loaded symbol image file: C:IDEVDataCollector.exe

       Image path: IDEVDataCollector.exe

       Image name: IDEVDataCollector.exe

       Has CLR image header, track-debug-data flag not set

       Timestamp:        Tue Mar 09 07:33:05 2010 (4B965C21)

  6. Hi Rob, thanks.

    Just a few quick questions: are you running it as Administrator (elevated)? Are you using "shared configuration" for your IIS? Are you storing any files on a network share (IIS logs etc...)? Does it crash before starting the collection, or after? If it crashes after, please have a look at the status bar: which step does it tell it is performing?

  7. When cleaning the code before publishing I forgot to remove a PerformanceMonitor control I do not use anymore: I have removed it now, please download again the app and give it another try, it must be run elevated (Administrator)

  8. The source code is available for download 🙂

  9. rob says:

    Carlo, the updated version fixes the startup crash I mentioned earlier. Thanks!

  10. Angel says:

    Is it possible to add an option to collect only X number of days worth of logs?

  11. Hello Angel, thanks for testing my tool. Yes, I'm working on it, it's the #1 feature in my "do to" list 🙂

  12. Amil Eoj says:

    Thanks for making this available Carlo.  It's working brilliantly so far.  Great support tool!

  13. John says:

    Can I use part of this code in my application?

  14. John says:

    One suggestion would be able to collect these data from multiple machines(Webservers)

Skip to main content