How to monitor file download on IIS?

Question

We are hosting .exe files on our IIS for our users to download. Is there a direct way to know how many request came for file download and from them how many got completed (successful download ) ? Do I have to parse all the logs for this ?

Thanks

Answer 1

Lets assume the following is one of your lines from the log:

192.168.114.201, -, 03/20/01, 7:55:20, W3SVC2, SERVER, 172.21.13.45, 4502, 163, 3223, 200, 0, GET, /DeptLogo.gif, -,

GET = client requested document/file

/DeptLogo.gif = File requested

200 = Response code (And 200 is supposed to mean the request was fulfilled)

The only part I am not sure about is if response code 200 will fire only if the file finished sending to the client (which still isn't 100% guarantee that it finished correctly on the client side), or if it fires once the server starts sending. I would test it yourself, download a file and let it complete, check the logs, then repeat and this time cancel the download and check the log again for differences.

Answer 2

First of all: Yes, you'll need to parse all the W3SVC logs to get a full view of how many times the *.exe files have been requested, and how many times the requests have been successful.

The IIS W3SVC logs will by default be placed in:

%windir%\System32\Logfiles\W3SVC\[SiteID]\exYYMMDD.log

or

%systemdrive%\Inetpub\logs\[SiteID]\exYYMMDD.log

depending on IIS version. This can be configured on top (server) level, and for individual sites. The W3SVC logs contain a number of fields (these can all be turn on or off in the IIS Manager).

What you need to make sure of here is that (at least) the following fields are enabled:

cs-uri-stem

sc-status

The cs-uri-stem is everything after the hostname, but before any query data.

In this example: https://some.domain.tld/give/me/files.exe?download=yes, the cs-uri-stem would be: /give/me/files.exe

So when you parse the log files, query them with something like cs-uri-stem LIKE '*.exe'. For each result, check out the HTTP status code, stored in the field sc-status. As Tim wrote, HTTP 200 means success. If a download starts, and the server serves the file correctly, but the client cancels/stops downloadning the file, the sc-status would probably be 206, which means Partial Content; the content/file was served, but the client only accepted some of it (or paused the download).

For a list of HTTP status codes in IIS 7.0 and IIS 7.5, check out: http://support.microsoft.com/kb/943891

For a similar list for IIS 5.0 and IIS 6.0, check out: http://support.microsoft.com/kb/318380