Thursday, November 27, 2008

ActiveSync and IIS Logs

In checking our own SBS box this morning, I noticed that, over time, we've been losing around 60 MB/day or so o drive space on C:. This has never been an issue as we have ample free space, but I finally had a little time so looked further into it.

So, running TreeSize Free I noticed that C:\WINDOWS\system32\LogFiles\W3SVC1 had a size nearing 20 GB which was a little more than it should be. This W3SVC1 folder is where IIS logs activity for the Default website (the one running the Exchange web services (such as OWA and ActiveSync) and various other features of SBS 2003. What's been happening is that as we have regular ActiveSync access to our SBS box, we've been generating a lot of log action due to the default IIS settings in SBS basically logging everything and its dog. (All up, this logging isn't a bad thing as it allows us to retrospectively look at the logs and see what's been happening, or alternately run active filtering of these logs to see what's happening now.)

I've been thinking about writing a little IIS Log Roll script to handle this automagically, but have not yet done this - I'm wondering if I should dedicate a little time to this so that we can move and zip each day's log file (by default, these are in an uncompressed folder) off the C: drive/partition to a data/Tech location elsewhere on the server.

Anyway, as a heads up, if you notice capacity on the SBS C: drive/partition slowly fading away and you have a number of activesync/owa users on this server, then keep an eye on this folder and the size of the log files it contains.


The Outspoken Wookie


Chris Knight said...

Set the logs to daily or monthly naming (for easier log analysis/manipulation) and compress the LogFiles folder. Should be enough. If you want to go one step further, a simple script that moves files based on modification date will do.

LogParser's a great tool for analysis and AWStats can generate some interesting stats for not much effort.

Daniel Mundy said...

I usually just move/delete the log files manually, something automated would be great (I've looked and come up with nothing)

I've always shied away from using folder compression because I've found it usually slows down systems...