Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When IIS flushes log entries to disc does it always insert #Fields + #Date rows before writing the actual entries?

To put it another way: If i wanted to write a function that processes log entries how would i know which part of the log file i had already processed and which part was newly added.

share|improve this question
up vote 2 down vote accepted

No, it only does that between "closes" of the log file.

IIRC, they're not entirely predictable, and depend on application behaviour and traffic patterns. If no activity happens in X minutes (I remember X being a multiple of 5 but might be confusing that with something else), HTTP.SYS closes the log. Activity causes the log to reopen and this causes headers to be rewritten.

The worker process terminating doesn't necessarily cause new headers to be written, at least not on an overlapping recycle.

share|improve this answer
Ok. Good enough for me. – Jeroen Feb 12 '12 at 17:24

You can record the number of bytes (or lines) read from the file, or query the current file position and seek to it next time. Alternatively you can keep it open and try reading it until data is returned.

share|improve this answer
Interesting angle. I read IIS flushes every 60 seconds so that should give me the timestamp to hold on to. – Jeroen Feb 11 '12 at 22:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.