I had a site stop working today and when I RDP'd into the server I saw a warning about low disk space. The first thing I checked was the inetpub folder where the log files are stored and sure enough it was huge, 40 GB huge. I do clean the files monthly but what is causing a day's worth of logging on a medium activity site (www.vbdotnetforums.com) to create 300-500 MB log files? I do have everything being logged so my SmarterStats software gives me the most info, but are there specific things I should/can turn off that is causing the most growth in these log files?

Also, sure would be nice if Microsoft someday had some sort of log file management such as deleting log files after they exceed a certain size (total), X days, etc. We all have to come up with some solution to delete the old ones manually.



  • 300-500MB per day? If you're logging all page requests, that'll chew it up quickly. Don't log everything, and maintain your logs manually like @joeqwerty suggested. Add it to your daily checklist. You do have a daily checklist, right? – user3914 Jan 9 '11 at 5:22

Couple things to consider: first, make sure you don't have your logs on your system partition if you have control over the server at all. Ideally, have separate partitions (ideally drives, but at least partitions) for holding the C: drive (system files and page file), and your IIS content and logfiles. In terms of rotation, there are a bunch of people out there who have written scripts that can help with this, though I agree with the answer above: if this is not normal behavior, someone is trying to "tumble" your site in some manner. Script I use: www.scriptinganswers.com/vault/Files%20and%20Folders/ -> DelFileByExtAndAge.vbs

| improve this answer | |

The answer to the question "What information should I log?" is "What information do you need to log?" Only you can answer that question.

As for Microsoft having an automated way of dealing with log maintenence, it's unfortunate that they don't but that's what a recurring task/reminder is for. Some sysadmin tasks just boil down to manual work and effort.

| improve this answer | |
  • You don't need the points, but I +1'd you anyway. This is a sysadmin's job, whether they like it or not. – user3914 Jan 9 '11 at 5:20

You may want to investigate for unauthorized access entries. If you're being scanned/brute-forced, that can fill those logs up real quick. You may want to look into storing those logs offsite or even just having them mailed to an independent email account(Gmail works wonders for this).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.