Home
  •  

Only one type of logging can be enabled at a time

Microsoft.Windows.InternetInformationServices.2008.Only.one.type.of.logging.can.be.enabled.at.a.time (Rule)

Knowledge Base article:

Summary

An Internet Information Services (IIS) Web server can be configured for Site, Central Binary, or Central W3C logging. In Central W3C logging, all client requests for all sites are logged to a single log file in W3C centralized format on the server. Central Binary logging also logs all sites centrally to a single file, but does so in centralized binary format. In Site logging, all client requests are logged at the site level, not centrally at the server level. These logging types depend on the World Wide Web Publishing Service for their configuration.

Resolutions

Configure the central logging format

Both centralized binary logging and centralized W3C logging are enabled. Because only one type of logging can be enabled at a time, the system has defaulted to central W3C logging. Use the following procedure to configure either W3C or binary logging.

Note:  If you want to use binary logging, you must perform this procedure.

To configure centralized logging by using IIS Manager:

Element properties:

TargetMicrosoft.Windows.InternetInformationServices.2008.WebServer
CategoryAlert
EnabledTrue
Event_ID1133
Event SourceMicrosoft-Windows-IIS-W3SVC
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Only one type of logging can be enabled at a time
{0}
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WA WriteAction Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.InternetInformationServices.2008.Only.one.type.of.logging.can.be.enabled.at.a.time" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.InternetInformationServices.2008.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-IIS-W3SVC</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>1133</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.2008.Only.one.type.of.logging.can.be.enabled.at.a.time.AlertMessage"]$</AlertMessageId>

    </WriteAction>

  </WriteActions>

</Rule>