Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had a site stop working today and when I RDP'd into the server I saw a warning about low disk space. The first thing I checked was the inetpub folder where the log files are stored and sure enough it was huge, 40 GB huge. I do clean the files monthly but what is causing a day's worth of logging on a medium activity site (www.vbdotnetforums.com) to create 300-500 MB log files? I do have everything being logged so my SmarterStats software gives me the most info, but are there specific things I should/can turn off that is causing the most growth in these log files?

Also, sure would be nice if Microsoft someday had some sort of log file management such as deleting log files after they exceed a certain size (total), X days, etc. We all have to come up with some solution to delete the old ones manually.

Thanks

Neal

share|improve this question
    
300-500MB per day? If you're logging all page requests, that'll chew it up quickly. Don't log everything, and maintain your logs manually like @joeqwerty suggested. Add it to your daily checklist. You do have a daily checklist, right? –  user3914 Jan 9 '11 at 5:22

3 Answers 3

up vote 2 down vote accepted

Couple things to consider: first, make sure you don't have your logs on your system partition if you have control over the server at all. Ideally, have separate partitions (ideally drives, but at least partitions) for holding the C: drive (system files and page file), and your IIS content and logfiles. In terms of rotation, there are a bunch of people out there who have written scripts that can help with this, though I agree with the answer above: if this is not normal behavior, someone is trying to "tumble" your site in some manner. Script I use: www.scriptinganswers.com/vault/Files%20and%20Folders/ -> DelFileByExtAndAge.vbs

share|improve this answer

The answer to the question "What information should I log?" is "What information do you need to log?" Only you can answer that question.

As for Microsoft having an automated way of dealing with log maintenence, it's unfortunate that they don't but that's what a recurring task/reminder is for. Some sysadmin tasks just boil down to manual work and effort.

share|improve this answer
    
You don't need the points, but I +1'd you anyway. This is a sysadmin's job, whether they like it or not. –  user3914 Jan 9 '11 at 5:20

You may want to investigate for unauthorized access entries. If you're being scanned/brute-forced, that can fill those logs up real quick. You may want to look into storing those logs offsite or even just having them mailed to an independent email account(Gmail works wonders for this).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.