How to Configure Application Pool Recycle Event Logging in IIS 6.0
If you are running production IIS servers which host multiple web sites and application pools it is often quite important to be able to keep track of the various events which can impact the smooth running of your sites and applications. We recently had an issue where it appeared that certain sites were apparently being randomly re-started and we needed to get a handle on the problem and understand why this was happening. In order to do this I decided to enable logging of worker process recycling events by configuring the LogEventOnRecycle metabase property as described on Technet here :
Logging Worker Process Recycling Events in IIS 6.0 (IIS 6.0)
The online documentation states that by default IIS does not log worker process recycling events. However, this is not entirely accurate. If you execute the following command against an unmodified installation of IIS 6.0 you should see that it returns the value shown below :
cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs get w3svc/AppPools/LogEventOnRecycle
What this means is that if you have an application pool (say for example the DefaultAppPool) which was created with the default values in place, then that application pool will be recycled every 1740 minutes after the first request is made. When that event occurs it will in fact be recorded in the System event log as shown below. If you also schedule application pool recycles then those events will also be logged.
However, if an application pool is manually recycled or has its configuration altered in some way by an administrator then these events will not be logged if you have the default LogEventOnRecycle metabase property in place. This is one of those circumstances where I personally feel that the default setup value is not the best choice. I would rather have everything that affects my application pools logged so that I have a clearer picture of what is happening on my web servers. At the very least I would rather be informed about an unexpected application pool recycle than one which I have already scheduled and would therefore be likely to know about.
So, if you want to enable logging of all application pool recycling events you need to issue the following command :
cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs Set w3svc/AppPools/LogEventOnRecycle 255
Once you have done this you will start to see additional events related to application pool recycling being logged to the System event log. For example, if a configuration change is made to a specific application pool then you will see event ID 1080 being logged as shown here.
And if an administrator manually recycles an application pool then that event will also be captured. The online documentation contains a list of all the application pool recycle event ID’s which you can expect to see.
However, there are a few limitations which I think are worthy of comment. Firstly, it would be nice to see the actual user ID of the person who made the change being captured in the event log. And secondly, it appears that if instead of recycling an application pool an administrator simply stops and re-starts it, then these actions are not captured at all. I think this is a pretty serious oversight as it allows someone to circumvent the auditing process, which is never a good thing.
Having said this I still feel that there is a real benefit to be gained from enabling the logging of all application pool recycle events and I would recommend that you do this on all production or mission critical systems.