w3svc log file retention

Question

User713946516 posted

I have a windows 2019 Azure VM running several web sites.  Logging is turned on and they are logging to a non-%systemroot% directory.   The problem is, it's only keeping about 48 hours of logs.   As far as I can tell, the IIS logging feature is set up exactly the same as all the other servers we've ever had, but THIS one for some reason doesn't want to keep log files around that are older than 2 days old.   I'm all for programming scripts to delete or archive old logs regularly, I haven't DONE anything like that on this server yet.  If I did, it would be monthly at most.   We'd like it to stop deleting log files > 2 days old but I cannot figure out how.  Help?  All I can find around the internet are people explaining how to use scripts and tasks etc to MAKE it delete and archive old logs, but not anything about making it STOP deleting the old log files (as this server of mine has decided to do).

Answer 1

User-848649084 posted

Hi,

Please again check the is there any script you or someone else set to delete log file on some duration? Cloud you please share how many visits per day on your site? does this happen to all the sites? and what size it consumes to sore the log file in 2 days? try to change the log file directory and check that is this issue still exists or not.

Answer 2

User713946516 posted

I already did change the log file to a different directory to see if that fixed it.  It did not.   

Yes, it's happening for all sites on the server W3SVC1-W3SVC4 log directories are all exhibiting the behavior.

There are no user-implemented scheduled tasked on this server, and we can't think of anywhere else that might be set to regularly delete old log files.   

The number of visits to the sites on this server fluctuates, depends on if this server is in the load balancer or not.  Typically 1 day for the main site generates anywhere from 100,000-400,000 KB log file.  I've change the Log File Rollover settings in IIS from daily to weekly to see if that makes any difference.

Is it possible that some kind of setting in Azure for the VMs could be causing this?  Some setting in Log Analytics or something telling it to ingest and delete the w3svc logs?  

Answer 3

User-848649084 posted

Hi,

you could try to set the auditing for the log folder and check who is deleting the log file by following below steps:

1)Navigate Windows Explorer to the file or folder you want to monitor(in your case select the log folder).

2)Right-click on the target folder/file and select Properties.

3)Security → Advanced.

4)Select the auditing tab.

5)Click the Continue button.

6)Click the ADD button.

7)Choose the users or groups you want to give audit permissions to(select everyone)

8)In the Auditing Type dialog box, select All.

9)In applies to the box select "this folder, subfolders, and files".

10)select all the permission and click ok to apply the settings.

To check the auditing detail, open event viewer and check the windows security logs for the detail about the change.