Page 1 of 2 12 Last
  • Jump to page:
    #1
  1. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2007
    Location
    NewHampshire
    Posts
    12
    Rep Power
    0

    IIS W3SVC1 Logs 4 Hours Off


    Hi All,

    When I have to troubleshoot an email issue, such as narrowing down an ip address logging onto our mail server and owa I use the daily log files located in the c:\winnt\system32\logfiles directory. I notice when displaying the information within these log files, when a user logs in the time that user logs in displays 4 hours ahead. I'm wondering if anyone else notices this in their enviroment and found a solution for it?

    We have exchange2003/iis6.

    Thanks in advance,
    Zoey
  2. #2
  3. No Profile Picture
    Grumpier old Moderator
    Devshed Supreme Being (6500+ posts)

    Join Date
    Jun 2003
    Posts
    14,428
    Rep Power
    4539
    Check the server time, and any settings that might be recording times in GMT. In IIS5 I think there was such a setting in the logging configurations.
    ======
    Doug G
    ======
    The man who doesn't read good books has no advantage over the man who can't read them.
    --Mark Twain
  4. #3
  5. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2007
    Location
    NewHampshire
    Posts
    12
    Rep Power
    0
    the server time is fine. It's strictly related to IIS and the metabase. I may have found a couple of articles that tell me to modify this setting in the metabase LogFileLocaltimeRollover from false to true
  6. #4
  7. Network Engineer
    Devshed Novice (500 - 999 posts)

    Join Date
    Jun 2004
    Location
    127.0.0.1
    Posts
    733
    Rep Power
    215
    You can use the option 'Use local time for file naming and rollover' in the logging properties of your website, but this will only create new log files based on your local time. The times recorded in the IIS logs when using 'W3C Extended File Format' are recorded in GMT; which can not be changed.
    PWD

    New Windows Administration Forum
    Nettric
  8. #5
  9. No Profile Picture
    Grumpier old Moderator
    Devshed Supreme Being (6500+ posts)

    Join Date
    Jun 2003
    Posts
    14,428
    Rep Power
    4539
    Thanks PWD
    ======
    Doug G
    ======
    The man who doesn't read good books has no advantage over the man who can't read them.
    --Mark Twain
  10. #6
  11. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2007
    Location
    NewHampshire
    Posts
    12
    Rep Power
    0
    Originally Posted by Doug G
    Thanks PWD
    Figured it out. The metabase.xml file needed to be edited and the LogFileLocaltimeRollover needed to be changed to "TRUE".

    Were you aware of this PWD and Doug???????
  12. #7
  13. No Profile Picture
    Grumpier old Moderator
    Devshed Supreme Being (6500+ posts)

    Join Date
    Jun 2003
    Posts
    14,428
    Rep Power
    4539
    Originally Posted by zoeythecat
    Figured it out. The metabase.xml file needed to be edited and the LogFileLocaltimeRollover needed to be changed to "TRUE".

    Were you aware of this PWD and Doug???????
    PWD probably knew already, since that's pretty much the answer PWD posted for you earlier. PWD knows a lot more than I do about IIS, I had no clue
    ======
    Doug G
    ======
    The man who doesn't read good books has no advantage over the man who can't read them.
    --Mark Twain
  14. #8
  15. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2007
    Location
    NewHampshire
    Posts
    12
    Rep Power
    0
    Lol...No, PWD mentioned about changing the local time on the default website. Here is what pwd suggested:

    "You can use the option 'Use local time for file naming and rollover' in the logging properties of your website, but this will only create new log files based on your local time. The times recorded in the IIS logs when using 'W3C Extended File Format' are recorded in GMT; which can not be changed."

    I had already tried that. PWD does not mention anything about the metabase.xml file.

    I thought I posting to a forum that had IIS experts.
  16. #9
  17. Network Engineer
    Devshed Novice (500 - 999 posts)

    Join Date
    Jun 2004
    Location
    127.0.0.1
    Posts
    733
    Rep Power
    215
    LOL...That's where the website (and ALL websites created in IIS) store it's configuration data...in the metabase. If you're so smart why don't you know this? Directly editing the metabae is the same as selecting the checkbox in the GUI. The value you changed was for the following setting:
    LogFileLocaltimeRollover

    here's the Microsoft overview of W3C Extended logging:

    W3C Extended Logging Format

    The timestamp created is in UTC (GMT) and is the standard for this log file format. Time, just like the order of the fields logged can not be changed...Local Rollover just creates the new log file based on your current time.

    Check your logs!
    Last edited by PWD; March 19th, 2008 at 07:27 AM.
    PWD

    New Windows Administration Forum
    Nettric
  18. #10
  19. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2007
    Location
    NewHampshire
    Posts
    12
    Rep Power
    0
    Nope...Your suggestion did not change the LogFileLocaltimeRollover to True. The metabase.xml file had this flag set to FALSE Your suggestion was tried a couple of months ago, which is why I posted here thinking the IIS experts (I guess you put yourself in this category) would be able to help. Here are some links that may dispute what you are saying.

    http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/7b654fd2-66c3-4331-bbc7-eb45c7d25b9c.mspx?mfr=true

    Also, from this IIS FAQ site, under IIS logging, there is a Question and Answer that I believe relates to this situation (And by the way, the logs are rolling over in local time now, which was the basis of my post anyway)
    Q. Is it possible to roll over W3C Extended log files according to local time instead of UTC?
    A. Yes. The LogFileLocaltimeRollover metabase property specifies IIS log file rollover behavior for W3C Extended logging. Set this property to true to create new log files based on local time instead of UTC.

    The bottom line is, by me chaning this flag to TRUE, my problem is solved.
  20. #11
  21. Network Engineer
    Devshed Novice (500 - 999 posts)

    Join Date
    Jun 2004
    Location
    127.0.0.1
    Posts
    733
    Rep Power
    215
    Did you restart IIS? Just cause you change the metabase or select it in your GUI doesn't apply the changes automatically...You need to restart IIS EVERY time a change is made whether through directly editing the metabase or using the GUIs (if it updates a metabase value).

    Then you have single handedly solved and hacked a W3C standard that has plagued the ENTIRE IT community since IIS 4...And have proved a 12+ year network administrator wrong.

    Q. Is it possible to roll over W3C Extended log files according to local time instead of UTC?
    A. Yes. The LogFileLocaltimeRollover metabase property specifies IIS log file rollover behavior for W3C Extended logging. Set this property to true to create new log files based on local time instead of UTC.
    Isn't that what I said? (I mentioned nothing regarding changing 'time' on the website only) It simply creates new the new log files based on your local time. So even if a visitor requests pages at 3/2/2008 at 3am UTC and it's 3/1/2008 11am your time, it will still be written in the 3/1/2008 log file. When your local time hits 12am IIS will then create a new log file for 3/2/2008...

    I believe your original question related to changing the timestamp on the request INSIDE your log file...
    Last edited by PWD; March 19th, 2008 at 11:23 AM.
    PWD

    New Windows Administration Forum
    Nettric
  22. #12
  23. Network Engineer
    Devshed Novice (500 - 999 posts)

    Join Date
    Jun 2004
    Location
    127.0.0.1
    Posts
    733
    Rep Power
    215
    UPDATE:
    Well, finally got some time at work today and dialed into 3 different Server 2003 Servers running multiple sites (Web, SharePoint, OWA, etc...). All currently are set to W3C logging and have the 'Use local time for file naming and rollover' checked in the properties of each website.

    I opened the metabase and, lo-and-behold, the value of LogFileLocaltimeRollover was set to 'True'.

    I go back to the website's properties, uncheck the box, restart IIS, and what's this? It is now set to 'False'?

    And one more time, I go back into the GUI, check the box to re-enable 'Use local time for file naming and rollover' again, restart IIS and the value of LogFileLocaltimeRollover was set back to 'True'? And what else? The time stamps on page requests insude the log file don't deviate from UTC time?

    Hmmm...AND if I directly edit the metabase, with true and/or false values, restart IIS...What happens? The checkmark appears and disappears from the checkbox in Logging properties of the website?

    PWD, you're a genius!

    I could care less about reputation points for being a smart-a**, but more concerned with what people find on these pages when they are looking for answers in the future...That the information they find is correct.
    PWD

    New Windows Administration Forum
    Nettric
  24. #13
  25. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2007
    Location
    NewHampshire
    Posts
    12
    Rep Power
    0
    Pwd,

    Sounds like you could be right. I have not restarted the IIS service yet. Sorry to hit such a nerve, but I appreciate the time you spent on this to set me right. You are right, it's very important to have this information correct and after reading your comments i'm convinced with the testing you did that you are probably right. The network administrator that works with the servers is telling me the time stamp on the log files were displaying local time. Maybe he is wrong. I'll check with him. You obviously know much more than I do and I was half kidding. I just thought the articles I found from Microsoft explained that the UTC time could be changed to local time. It sounds like this has been a problem with IIS that you are obviously aware of.

    I find it hard to believe that Microsoft articles describe that the local time can be set and this cannot be done.
  26. #14
  27. Network Engineer
    Devshed Novice (500 - 999 posts)

    Join Date
    Jun 2004
    Location
    127.0.0.1
    Posts
    733
    Rep Power
    215
    Long Story Short...
    That setting only controls the behavior of what IIS stamps the file name with and when new log files will be generated...Not what times are logged inside the log.

    My apologies for coming off so abrasive...I don't know everything.

    It's a community banging heads to make it through another day! Keep coming back!
    Last edited by PWD; March 19th, 2008 at 01:53 PM.
    PWD

    New Windows Administration Forum
    Nettric
  28. #15
  29. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2007
    Location
    NewHampshire
    Posts
    12
    Rep Power
    0
    Thanks
Page 1 of 2 12 Last
  • Jump to page:

IMN logo majestic logo threadwatch logo seochat tools logo