To setup IIS request-based tracing you firsty have to decide what to trace. This decision is dependent on the nature of the problem that you need resolved. To setup the trace following items need to be specified:

1. Provider file
2. IIS providers
3. Verbosity levels

The Provider File

The provider file is a simple text file that resides on the local computer and tells Event Tracing for Windows (ETW) which providers should report trace data. This file also tells ETW how verbose the trace reporting should be; that is, how much data the providers should report, as well as what flags or areas to trace for each provider.

1. The contents of a provider file contain the following:
2. The names of the providers that will report trace data to ETW

3. Provider flags (for applicable providers) that define which areas of the provider to trace
A number that tells ETW how much trace data to collect for the specified provider, called verbosity level

IIS Providers

Components that provide tracing events to ETW, like ASP and ISAPI extensions, are called providers. In Windows Server 2003, Service Pack 1, the following IIS providers report trace data to ETW:

1. IIS: WWW Server
2. IIS: SSL Filter
3. IIS: ISAPI Extension
4. IIS: ASP
5. IIS: IISAdmin
6. IIS: Request Monitor

When you configure the trace session by creating the provider file, you define which providers report data. Components not listed in the provider file do not report trace data.

Verbosity Levels

You establish how much data each provider reports by setting the verbosity level in the provider file. The verbosity level is a number in the provider file, ranging from 0 to 5, where 0 is the least information and 5 is the most information.
How to Create a Provider File for Request-Based Tracing (IIS 6.0)

1. Create a new file in a text editor like Notepad.

2. Enter a provider name in double quotes, flags (if any) or zero (0), and the verbosity level.

For example:

“IIS: WWW Server” 0xFFFFFFFE 5

“IIS: Active Server Pages (ASP)” 0 5

“IIS: WWW Isapi Extension” 0 5

3. Start a new line for each provider, if you plan to trace more than one provider.

4. Save and close the provider file.

To trace requests in IIS components

1. From a command prompt, type logman startsession name-pfprovider file name-ets and press ENTER.

For example: logman start ASPtrace -pf ASPproviders -ets

2. Event Tracing for Windows prints to the screen details about the trace session you just started, including the name of the session, the file name where the trace data will be collected (session name.etl by default), the providers listed in the provider file, and whether or not the command was successful.

3. Allow the trace session to run until you have reproduced the problem or until your sites have processed enough requests to produce a manageable data set.

4. From the command prompt, type logman stopsession name-ets and press ENTER.

How to Process and View Trace Log Files
To process and view trace log files

1. Download Logparser, version 2.2 or later from the Microsoft Download Center.

2. Register Logparser.dll on your copy of Windows Server 2003 (version SP1 or later).

1. From a command prompt, navigate to the directory where you installed LogParser.

2. Type regsvr32 logparser.dll and press ENTER.

3. Open a command prompt and navigate to the directory where DumpTraceReqs.js is stored (%systemroot%\LogParser\Samples\Scripts, by default).

4. Type dumptracereqs tracelogname >newfilename.txt and press ENTER.

Tracelogname is the name of the trace log .etl file and newfilename.txt is the name of a new file where the post-processed data will be saved. LogParser and DumpTraceReqs.js process the trace log file and store the post-processed data in the newfilename.txt file.

5. To view the data, type notepadnewfilename.txt and press ENTER.

IISIIS