IIS7 – How to set up logging to a remote UNC share?

  • Article

First of all, let me tell you that there isn’t much changes to the logging done to IIS 7.0 compared to IIS 6.0. Logging still happens through Http.Sys, and you can configure the logging directory (of FREB log directory) to be a UNC share. There are a few MSDN/Technet articles available for the same(for IIS 6.0), but here I’ve tried to keep the steps simple, together at one place, and few steps specific to IIS 7.0.

Configure UNC path for Logging using IIS manager

  1. Start IIS7 manager, select the website
  2. Select Logging from the Features View
  3. Enter the UNC path in the Directory

   image

 Configure Permissions on the remote UNC share

Since this is Http.SYS which is doing the logging, it is required to give the Computer Server account proper sharing permissions and NTFS permissions on the shared folder. If your server is in domain MyDomain, and the server name is MyServer, you can just type MyDomain\MyServer$.

image    image

Also make sure you select the “Computers” in the “Object Types…”.

Cross Domain Logging

Now comes another common problem – where the web server is in another domain, and the UNC share is in another domain. You can still configure it by setting up the remote share as a Null Session share. You can set up a Null Session by following the steps in this Technet article.

AFAIK, this article which talks about various events which may occur in IIS 6.0 would still apply for IIS 7.0. If you face any other problem other than listed in that article, drop a note here.

Hope this helps!

.rm