quarta-feira, março 27, 2013

The HTTP status code in IIS 7.0, IIS 7.5, and IIS 8.0


http://support.microsoft.com/kb/943891

When you try to access content on a server that is running Internet Information Services (IIS) 7.0, 7.5, or 8.0 by using the HTTP protocol, IIS returns a numeric code that indicates the status of the response. The HTTP status code is recorded in the IIS log. Additionally, the HTTP status code may be displayed in the client browser.

The HTTP status code may indicate whether a request is successful or unsuccessful. The HTTP status code may also reveal the exact reason that a request is unsuccessful.

Log file locations

By default, IIS 7.0, IIS 7.5, and IIS 8.0 put log files in the following folder:
inetpub\logs\Logfiles
This folder contains separate directories for each World Wide Web website. By default, the log files are created in the directories daily, and the log files are named by using the date. For example, a log file may be named as follows:
exYYMMDD.log

The HTTP status codes

This section describes the HTTP status codes that IIS 7.0, IIS 7.5, and IIS 8.0 use.

Note This article does not list every possible HTTP status code as dictated in the HTTP specification. This article includes only the HTTP status codes that IIS 7.0, IIS 7.5, and IIS 8.0 can send. For example, a custom Internet Server API (ISAPI) filter or a custom HTTP module can set its own HTTP status code.

1xx - Informational

These HTTP status codes indicate a provisional response. The client computer receives one or more 1xx responses before the client computer receives a regular response.

IIS 7.0, IIS 7.5, and IIS 8.0 use the following informational HTTP status codes:
  • 100 - Continue.
  • 101 - Switching protocols.

2xx - Success

These HTTP status codes indicate that the server successfully accepted the request.

IIS 7.0, IIS 7.5, and IIS 8.0 use the following success HTTP status codes:
  • 200 - OK. The client request has succeeded.
  • 201 - Created.
  • 202 - Accepted.
  • 203 - Nonauthoritative information.
  • 204 - No content.
  • 205 - Reset content.
  • 206 - Partial content.

3xx - Redirection

These HTTP status codes indicate that the client browser must take more action to fulfill the request. For example, the client browser may have to request a different page on the server. Or, the client browser may have to repeat the request by using a proxy server.

IIS 7.0, IIS 7.5, and IIS 8.0 use the following redirection HTTP status codes:
  • 301 - Moved permanently.
  • 302 - Object moved.
  • 304 - Not modified.
  • 307 - Temporary redirect.

4xx - Client error

These HTTP status codes indicate that an error occurred and that the client browser appears to be at fault. For example, the client browser may have requested a page that does not exist. Or, the client browser may not have provided valid authentication information.

IIS 7.0, IIS 7.5, and IIS 8.0 use the following client error HTTP status codes:
  • 400 - Bad request. The request could not be understood by the server due to malformed syntax. The client should not repeat the request without modifications.

    IIS 7.0, IIS 7.5, and IIS 8.0 define the following HTTP status codes that indicate a more specific cause of a 400 error:
    • 400.1 - Invalid Destination Header.
    • 400.2 - Invalid Depth Header.
    • 400.3 - Invalid If Header.
    • 400.4 - Invalid Overwrite Header.
    • 400.5 - Invalid Translate Header.
    • 400.6 - Invalid Request Body.
    • 400.7 - Invalid Content Length.
    • 400.8 - Invalid Timeout.
    • 400.9 - Invalid Lock Token.
  • 401 - Access denied.

    IIS 7.0, IIS 7.5, and IIS 8.0 define several HTTP status codes that indicate a more specific cause of a 401 error. The following specific HTTP status codes are displayed in the client browser but are not displayed in the IIS log:
    • 401.1 - Logon failed.
    • 401.2 - Logon failed due to server configuration.
    • 401.3 - Unauthorized due to ACL on resource.
    • 401.4 - Authorization failed by filter.
    • 401.5 - Authorization failed by ISAPI/CGI application.
  • 403 - Forbidden.

    IIS 7.0, IIS 7.5, and IIS 8.0 define the following HTTP status codes that indicate a more specific cause of a 403 error:
    • 403.1 - Execute access forbidden.
    • 403.2 - Read access forbidden.
    • 403.3 - Write access forbidden.
    • 403.4 - SSL required.
    • 403.5 - SSL 128 required.
    • 403.6 - IP address rejected.
    • 403.7 - Client certificate required.
    • 403.8 - Site access denied.
    • 403.9 - Forbidden: Too many clients are trying to connect to the web server.
    • 403.10 - Forbidden: web server is configured to deny Execute access.
    • 403.11 - Forbidden: Password has been changed.
    • 403.12 - Mapper denied access.
    • 403.13 - Client certificate revoked.
    • 403.14 - Directory listing denied.
    • 403.15 - Forbidden: Client access licenses have exceeded limits on the web server.
    • 403.16 - Client certificate is untrusted or invalid.
    • 403.17 - Client certificate has expired or is not yet valid.
    • 403.18 - Cannot execute requested URL in the current application pool.
    • 403.19 - Cannot execute CGI applications for the client in this application pool.
    • 403.20 - Forbidden: Passport logon failed.
    • 403.21 - Forbidden: Source access denied.
    • 403.22 - Forbidden: Infinite depth is denied.
    • 403.502 - Forbidden: Too many requests from the same client IP; Dynamic IP Restriction limit reached.
  • 404 - Not found.

    IIS 7.0, IIS 7.5, and IIS 8.0 define the following HTTP status codes that indicate a more specific cause of a 404 error:
    • 404.0 - Not found.
    • 404.1 - Site Not Found.
    • 404.2 - ISAPI or CGI restriction.
    • 404.3 - MIME type restriction.
    • 404.4 - No handler configured.
    • 404.5 - Denied by request filtering configuration.
    • 404.6 - Verb denied.
    • 404.7 - File extension denied.
    • 404.8 - Hidden namespace.
    • 404.9 - File attribute hidden.
    • 404.10 - Request header too long.
    • 404.11 - Request contains double escape sequence.
    • 404.12 - Request contains high-bit characters.
    • 404.13 - Content length too large.
    • 404.14 - Request URL too long.
    • 404.15 - Query string too long.
    • 404.16 - DAV request sent to the static file handler.
    • 404.17 - Dynamic content mapped to the static file handler via a wildcard MIME mapping.
    • 404.18 - Querystring sequence denied.
    • 404.19 - Denied by filtering rule.
    • 404.20 - Too Many URL Segments
  • 405 - Method Not Allowed.
  • 406 - Client browser does not accept the MIME type of the requested page.
  • 408 - Request timed out.
  • 412 - Precondition failed.

5xx - Server error

These HTTP status codes indicate that the server cannot complete the request because the server encounters an error.

IIS 7.0, IIS 7.5, and IIS 8.0 use the following server error HTTP status codes:
  • 500 - Internal server error.

    IIS 7.0, IIS 7.5, and IIS 8.0 define the following HTTP status codes that indicate a more specific cause of a 500 error:
    • 500.0 - Module or ISAPI error occurred.
    • 500.11 - Application is shutting down on the web server.
    • 500.12 - Application is busy restarting on the web server.
    • 500.13 - Web server is too busy.
    • 500.15 - Direct requests for Global.asax are not allowed.
    • 500.19 - Configuration data is invalid.
    • 500.21 - Module not recognized.
    • 500.22 - An ASP.NET httpModules configuration does not apply in Managed Pipeline mode.
    • 500.23 - An ASP.NET httpHandlers configuration does not apply in Managed Pipeline mode.
    • 500.24 - An ASP.NET impersonation configuration does not apply in Managed Pipeline mode.
    • 500.50- A rewrite error occurred during RQ_BEGIN_REQUEST notification handling. A configuration or inbound rule execution error occurred.
      Note Here is where the distributed rules configuration is read for both inbound and outbound rules.
    • 500.51- A rewrite error occurred during GL_PRE_BEGIN_REQUEST notification handling. A global configuration or global rule execution error occurred.
      Note Here is where the global rules configuration is read.
    • 500.52- A rewrite error occurred during RQ_SEND_RESPONSE notification handling. An outbound rule execution occurred.
    • 500.53- A rewrite error occurred during RQ_RELEASE_REQUEST_STATE notification handling. An outbound rule execution error occurred. The rule is configured to be executed before the output user cache gets updated.
    • 500.100 - Internal ASP error.
  • 501 - Header values specify a configuration that is not implemented.
  • 502 - Web server received an invalid response while acting as a gateway or proxy.

    IIS 7.0, IIS 7.5, and IIS 8.0 define the following HTTP status codes that indicate a more specific cause of a 502 error:
    • 502.1 - CGI application timeout.
    • 502.2 - Bad gateway: Premature Exit.
    • 502.3 - Bad Gateway: Forwarder Connection Error (ARR).
    • 502.4 - Bad Gateway: No Server (ARR).
  • 503 - Service unavailable.

    IIS 7.0, IIS 7.5, and IIS 8.0 define the following HTTP status codes that indicate a more specific cause of a 503 error:
    • 503.0 - Application pool unavailable.
    • 503.2 - Concurrent request limit exceeded.
    • 503.3 - ASP.NET queue full

Common HTTP status codes and the causes

The following table describes the causes of some common HTTP status codes.
Collapse this tableExpand this table
CodeDescriptionNotes
200OKIIS 7.0, IIS 7.5, and IIS 8.0 successfully processed the request.
304Not modified The client browser requests a document that is already in the cache, and the document has not been modified since the document was cached. The client browser uses the cached copy of the document instead of downloading the document from the server.
400Bad request The Http.sys file blocks IIS 7.0, IIS 7.5, and IIS 8.0 from processing the request because of a problem in the request. Typically, this HTTP status code means that the request contains characters or sequences that are not valid or that the request contradicts the security settings in the Http.sys file.
401.1Logon failedThe logon attempt is unsuccessful probably because of a user name or a password that is not valid. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942044 Error message when you try to run a web application that is hosted on IIS 7.0: "HTTP Error 401.1 - Not Found"
401.2Logon failed due to server configurationThis HTTP status code indicates a problem in the authentication configuration settings on the server. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942043 Error message when you try to visit a webpage that is hosted on IIS 7.0: "HTTP Error 401.2 - Unauthorized"
401.3Unauthorized due to ACL on resourceThis HTTP status code indicates a problem in the NTFS file system permissions. This problem may occur even if the permissions are correct for the file that you are trying to access. For example, this problem occurs if the IUSR account does not have access to the C:\Winnt\System32\Inetsrv directory. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942042 Error message when you try to browse a webpage that is hosted on a server that is running IIS 7.0: "HTTP Error 401.3 - Unauthorized"
401.4Authorization failed by filterAn ISAPI filter does not let the request be processed because of an authorization problem. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942079 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 401.4 - Authorization failed by filter"
401.5Authorization failed by ISAPI/CGI applicationAn ISAPI application or a Common Gateway Interface (CGI) application does not let the request be processed because of an authorization problem. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942078 Error message when you visit a website that is hosted on a computer that is running IIS 7.0: "HTTP Error 401.5 - Authorization failed by ISAPI/CGI application"
403.1Execute access forbiddenThe appropriatelevel of the Execute permission is not granted. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942065 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.1 - Forbidden"
403.2Read access forbiddenThe appropriate level of the Read permission is not granted. Verify that you have set up IIS 7.0, IIS 7.5, and IIS 8.0 to grant the Read permission to the directory. Additionally, if you use a default document, verify that the default document exists. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942036 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.2 - Forbidden"
403.3Write access forbiddenThe appropriate level of the Write permission is not granted. Verify that the IIS 7.0, IIS 7.5, and IIS 8.0 permissions and the NTFS file system permissions are set up to grant the Write permission to the directory. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942035 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.3 - Forbidden"
403.4SSL requiredThe request is made over a nonsecure channel, and the web application requires a Secure Sockets Layer (SSL) connection. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942070 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.4 - Forbidden"
403.5SSL 128 requiredThe server is configured to require a 128-bit SSL connection. But, the request is not sent by using 128-bit encryption. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942069 Error message when you try to browse a webpage that is hosted on IIS 7.0: "HTTP Error 403.5 - Forbidden"
403.6IP address rejectedThe server is configured to deny access to the current IP address. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942068 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.6 - IP Address Rejected"
403.7Client certificate requiredThe server is configured to require a certificate for client authentication. But, the client browser does not have an appropriate client certificate installed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942067 Error message when you try to run a web application that is hosted on a server that is running IIS 7.0: "HTTP Error 403.7 - Forbidden"
403.8Site access deniedThe server is configured to deny requests based on the Domain Name System (DNS) name of the client computer. For more information about how to resolve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
942066 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.8 - Forbidden"
403.12Mapper denied accessThe page that you want to access requires a client certificate. But, the user ID that is mapped to the client certificate is denied access to the file. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942064 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.12 - Client Certificate Denied"
403.13Client certificate revokedThe client browser tries to use a client certificate that was revoked by the issuing certification authority. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942063 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.13 - Forbidden"
403.14Directory listing deniedThe server is not configured to display a content directory listing, and a default document is not set. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942062 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.14 - Forbidden"
403.16Client certificate is untrusted or invalid.The client browser tries to use a client certificate that is not trusted by the server that is running IIS 7.0, IIS 7.5, or IIS 8.0 or that is not valid. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942061 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.16 - Forbidden"
403.17Client certificate has expired or is not yet valid.The client browser tries to use a client certificate that is expired or that is not yet valid. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942038 Error message when you try to visit a webpage that is hosted on Internet Information Services 7.0: "HTTP Error 403.17 (Forbidden) - The client certificate has expired"
403.18Cannot execute requested URL in the current application pool.A custom error page is configured, and the custom error page resides in a different application pool than the application pool of the requested URL. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942037 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.18 - Forbidden"
403.19Cannot execute CGI applications for the client browser in this application pool.The identity of the application pool does not have the Replace a process level token user right. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942048 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 403.19 - Forbidden"
404.0Not found.The file that you are trying to access was moved or does not exist. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942041 Error message when you try to open a webpage that is hosted on IIS 7.0: "HTTP Error 404.0 - Not Found"
404.2ISAPI or CGI restriction.The requested ISAPI resource or the requested CGI resource is restricted on the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942040 Error message when you try to visit a webpage that is hosted on a computer that is running IIS 7.0: "HTTP Error 404.2 – Not Found"
404.3MIME type restriction. The current MIME mapping for the requested extension type is not valid or is not configured. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942032 Error message when users visit a website that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 404.3 - Not Found"
404.4No handler configured. The file name extension of the requested URL does not have a handler that is configured to process the request on the Web server. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942052 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 404.4 - Not Found"
404.5Denied by request filtering configuration. The requested URL contains a character sequence that is blocked by the server. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942053 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 404.5 - URL Sequence Denied"
404.6Verb denied. The request is made by using an HTTP verb that is not configured or that is not valid. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942046 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 404.6 - VERB_DENIED"
404.7File extension denied. The requested file name extension is not allowed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942045 Error message when you try to browse a webpage that is hosted on IIS 7.0: "HTTP Error 404.7 - FILE_EXTENSION_DENIED"
404.8Hidden namespace. The requested URL is denied because the directory is hidden. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942047 Error message when you try to visit a webpage that is hosted on IIS 7.0: "HTTP Error 404.8 - HIDDEN_NAMESPACE"
404.9File attribute hidden. The requested file is hidden. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942049 Error message when you try to visit a website that is hosted on IIS 7.0: "HTTP Error 404.9 - File Attribute Hidden"
404.10Request header too long. The request is denied because the request headers are too long. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942077 Error message when you visit a website that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 404.10 - REQUEST_HEADER_TOO_LONG"
404.11Request contains double escape sequence. The request contains a double escape sequence. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942076 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 404.11 - URL_DOUBLE_ESCAPED"
404.12Request contains high-bit characters. The request contains high-bit characters, and the server is configured not to allow high-bit characters. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942075 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 404.12 - URL_HAS_HIGH_BIT_CHARS"
404.13Content length too large. The request contains a Content-Length header. The value of the Content-Length header is larger than the limit that is allowed for the server. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942074 Error message when you visit a website that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 404.13 - CONTENT_LENGTH_TOO_LARGE"
404.14Request URL too long. The requested URL exceeds the limit that is allowed for the server. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942073 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 404.14 - URL_TOO_LONG"
404.15Query string too long. The request contains a query string that is longer than the limit that is allowed for the server. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942071 Error message when you visit a website that is hosted on a server that is running IIS 7.0: "HTTP Error 404.15 - Not Found"
404.17Dynamic content mapped to the static file handler. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
2019689 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 404.17 - Not Found"
405.0Method not allowed. The request is made by using an HTTP method that is not valid. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942051 Error message when a user visits a website that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 405.0 - Method not allowed"
406.0Invalid MIME type. The request is made by using an Accept header that contains a MIME value that is not valid. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942050 Error message when you visit a website that is hosted on a server that is running Internet Information Services 7.0: "HTTP Error 406 - Not Acceptable"
412.0Precondition failed. The request is made by using an If-Match request header that contains a value that is not valid. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942056 Error message when you visit a website that is hosted on Internet Information Services (IIS) 7.0: "HTTP Error 412 - Precondition failed"
500Internal server error. This HTTP status code may occur for many server-side reasons. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942031 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 500.0 - Internal Server Error"
500.11Application is shutting down on the web server. The request is not processed because the destination application pool is shutting down. Wait for the worker process to finish shutting down, and then try the request again. If this problem persists, the web application may be experiencing problems that prevent the web application from shutting down correctly.
500.12Application is busy restarting on the web server. The request is not processed because the destination application pool is restarting. This HTTP status code should disappear when you refresh the page. If this HTTP status code appears again after you refresh the page, the problem may be caused by antivirus software that is scanning the Global.asa file. If this problem persists, the web application may be experiencing problems that prevent the web application from restarting correctly.
500.13Web server is too busy. The request is not processed because the server is too busy to accept any new incoming requests. Typically, this HTTP status code means that the number of incoming concurrent requests exceeds the number that the IIS 7.0, IIS 7.5, or IIS 8.0 web application can process. This problem may occur because the performance configuration settings are set too low, the hardware is insufficient, or a bottleneck occurs in the IIS 7.0, IIS 7.5, or IIS 8.0 web application. A common troubleshooting method is to generate a memory dump file of the IIS 7.0, IIS 7.5, or IIS 8.0 processes when the error is occurring and then to debug the memory dump file.
500.15Direct requests for Global.asax are not allowed. A direct request for the Global.asa file or for the Global.asax file is made. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942030 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 500.15 - Direct request for global.asa are not allowed"
500.19Configuration data is invalid. This HTTP status code occurs because of a problem in the associated Applicationhost.config file or in the associated Web.config file. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942055 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 500.19 - Internal Server Error"
500.100Internal ASP error. An error occurs during the processing of an Active Server Pages (ASP) page. To obtain more specific information about the error, disable friendly HTTP error messages in the web browser. Additionally, the IIS log may show an ASP error number that corresponds to the error that occurs. For more information about ASP error messages and about the meaning of ASP error messages, click the following article number to view the article in the Microsoft Knowledge Base:
294271 ASP error codes
501.0Not implemented. The client browser sends an HTTP-Trace verb, and the server is not configured to process the HTTP-Trace verb. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942058 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 501.0 - Not Implemented"
502.1CGI application timeout. A CGI application does not return a valid HTTP response in the configured time limit. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942059 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 502.1 - Bad Gateway"
502.2Bad gateway: Premature ExitA CGI application returns an HTTP response that is not valid to the server that is running IIS 7.0, IIS 7.5, or IIS 8.0. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
942057 Error message when you visit a website that is hosted on IIS 7.0: "HTTP Error 502.2 - Bad Gateway"
503.0Service unavailable. The request is sent to an application pool that is currently stopped or that is currently disabled. To resolve this issue, make sure that the destination application pool is started. The event log may give information about why the application pool is stopped or disabled.
503.2Concurrent request limit exceeded. The appConcurrentRequestLimit property is set to a value that is lower than the current number of concurrent requests. IIS 7.0, IIS 7.5, and IIS 8.0 do not allow more concurrent requests than the value of the appConcurrentRequestLimit property.

quarta-feira, fevereiro 27, 2013

Subnet Calculator

Site interessante para calcular as subnets de redes de forma a atingir todos os servidores em causa em por exemplo rotas nas máquinas:

http://portal.monitis.com/subnet-calculator

quarta-feira, dezembro 05, 2012

LogParser - Comando para obter registos de um eventId

Comando para obter registos de um eventId:


LogParser "SELECT * Strings AS Parameters FROM Application WHERE EventID=20503 

LogParser - More Commands


Examples
Keep in mind that most of the examples that I give here are all-in-one command line queries (even though many wrap to multiple lines when displayed here). However, queries can also be run as
logparser file:XXXXX.sql
where XXXXX is the name of a file containing a logparser-friendly sql query. There are a couple examples of this in the following list.
The examples given here have been obtained from a variety of sources, including the documentation that ships with the tool, blogs and online documentation, and my own experience. Unfortunately, I don’t have a record of the origin of each individual example, as I’ve compiled these piecemeal over the last two or three years.
I hope you’ll find something useful here and gain an appreciation for just how robust this tool is.
1) All pages hits by a given IP address
logparser "select cs-uri-stem, count(cs-uri-stem) as requestcount from [LogFileName] where c-ip = ’000.00.00.000′ group by cs-uri-stem order by count(cs-uri-stem) desc"
2) Hits on a particular page by IP address
logparser "select c-ip, count(c-ip) as requestcount from [LogFileName] where cs-uri-stem like ‘/search.aspx%’ group by c-ip order by count(c-ip) desc"
3) ReverseDNS example. This attempts to find the domain associated with a given IP address.
logparser "select c-ip, REVERSEDNS(c-ip) from [LogFileName] where c-ip = ’000.00.00.000′ group by c-ip"
4) CSV example. All hits on a page, written to a CVS file.
logparser "select * into OUTPUT.CSV from [LogFileName] where cs-uri-stem like ‘/pagename.aspx’"
5) Chart example. All hits on a page by an IP address, displayed on a chart.
logparser "select c-ip, count(c-ip) as requestcount into logparserchart.gif from [LogFileName] where cs-uri-stem like ‘/pagename.aspx’ group by c-ip order by count(c-ip) desc" -o:chart
6) Hits per hour from a particular IP address
logparser "select TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 3600)), count(*) as numberrequests from [LogFileName] where c-ip=’000.000.00.000′ group by TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date,time), 3600))"
7) Basic list of IP addresses generating traffic
logparser "select c-ip, count(c-ip) as requestcount from [LogFileName] group by c-ip order by count(c-ip) desc"
8) Basic list of pages being hit
logparser "select cs-uri-stem, count(cs-uri-stem) from [LogFileName] where cs-uri-stem like ‘%aspx%’ or cs-uri-stem like ‘%ashx%’ group by cs-uri-stem order by count(cs-uri-stem) desc"
9) Basic list of pages being hit, including which IPs are doing the hitting
logparser "select cs-uri-stem, c-ip, count(cs-uri-stem) from [LogFileName] where cs-uri-stem like ‘%aspx%’ or cs-uri-stem like ‘%ashx%’ group by cs-uri-stem, c-ip order by count(cs-uri-stem) desc"
10) Pages being hit after a specific date and time
logparser "select cs-uri-stem, c-ip, count(cs-uri-stem) from [LogFileName] where cs-uri-stem like ‘%aspx%’ or cs-uri-stem like ‘%ashx%’ and date=’2009-06-04′ and time > ’15:00:00′ group by cs-uri-stem, c-ip order by count(cs-uri-stem) desc"
11) Counts of hits of ASPX/ASHX pages by hour from a particular IP address
logparser "select TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 3600)), count(*) as numberrequests from [LogFileName] where c-ip=’000.000.00.00′ and (cs-uri-stem like ‘%aspx%’ or cs-uri-stem like ‘%ashx%’) group by TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date,time), 3600))"
12) Counts of hits against specific pages by hour from a particular IP address
logparser "select TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 3600)), cs-uri-stem, count(*) as numberrequests from [LogFileName] where c-ip=’000.000.00.00′ and (cs-uri-stem like ‘%aspx%’ or cs-uri-stem like ‘%ashx%’) group by TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date,time), 3600)), cs-uri-stem order by numberrequests desc"
13) Top browsers
logparser "Select top 50 to_int(mul(100.0,PropCount(*))) as Percent, count(*) as TotalHits, cs(User-Agent) as Browser from [LogFileName] group by Browser order by Totalhits desc"
14) Hourly Bandwidth (chart)
logparser "Select TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 3600)) As Hour, Div(Sum(cs-bytes),1024) As Incoming(K), Div(Sum(sc-bytes),1024) As Outgoing(K) Into BandwidthByHour.gif From [LogFileName] Group By Hour"
15) Requests by URI
logparser "SELECT top 80 QUANTIZE(TO_TIMESTAMP(date, time), 3600) as Hour, TO_LOWERCASE(STRCAT(‘/’,EXTRACT_TOKEN(cs-uri-stem,1,’/'))) as URI, COUNT(*) AS RequestsPerHour, SUM(sc-bytes) AS TotBytesSent, AVG(sc-bytes) AS AvgBytesSent, Max(sc-bytes) AS MaxBytesSent, ADD(1,DIV(Avg(time-taken),1000)) AS AvgTime, ADD(1,DIV(MAX(time-taken),1000)) AS MaxTime FROM [LogFileName] GROUP BY Hour, URI Having RequestsPerHour > 10 ORDER BY RequestsPerHour ASC"
16) Top 10 Images by size
logparser "Select Top 10 StrCat(Extract_Path(TO_Lowercase(cs-uri-stem)),’/') AS RequestedPath, Extract_filename(To_Lowercase(cs-uri-stem)) As RequestedFile, Count(*) AS Hits, Max(time-taken) As MaxTime, Avg(time-taken) As AvgTime, Max(sc-bytes) As BytesSent From [LogFileName] Where (Extract_Extension(To_Lowercase(cs-uri-stem)) IN (‘gif’;'jpg’;'png’)) AND (sc-status = 200) Group By To_Lowercase(cs-uri-stem) Order By BytesSent, Hits, MaxTime DESC"
17) Top 10 URLs for a website, with total hits, max time to serve, and average time to serve
logparser "Select TOP 10 STRCAT(EXTRACT_PATH(cs-uri-stem),’/') AS RequestPath, EXTRACT_FILENAME(cs-uri-stem) AS RequestedFile, COUNT(*) AS TotalHits, Max(time-taken) AS MaxTime, AVG(time-taken) AS AvgTime, AVG(sc-bytes) AS AvgBytesSent FROM [LogFileName] GROUP BY cs-uri-stem ORDER BY TotalHits DESC"
18) Top 20 clients
logparser "Select Top 20 c-ip AS Client, Count(*) AS Hits INTO Chart.gif FROM [LogFileName] GROUP BY c-ip ORDER BY Hits Desc"
19) Referrer Broken Links (i.e. external references to broken links on your site)
logparser "SELECT DISTINCT cs(Referer) as Referer, cs-uri-stem as Url INTO ReferBrokenLinks.html FROM [LogFileName] WHERE cs(Referer) IS NOT NULL AND sc-status = 404 AND (sc-substatus IS NULL OR sc-substatus=0)" -tpl:ReferBrokenLinks.tpl
20) Status codes
logparser "SELECT sc-status As Status, COUNT(*) As Number INTO StatusCodes.gif FROM <2> GROUP BY Status ORDER BY Status"
21) Search the Event Log for W3SVC (IIS) log entries and color-coordinate as to Error, Warning, Information. This example writes the output of the query to an HTML file that is generated using a template file.
logparser "SELECT TimeGenerated,EventTypeName,Strings,Message,CASE EventTypeName WHEN ‘Error event’ THEN ‘RED’ WHEN ‘Warning event’ THEN ‘YELLOW’ WHEN ‘Information event’ THEN ‘WHITE’ ELSE ‘BLUE’ END As Color INTO file.html FROM System WHERE SourceName = ‘W3SVC’" -tpl:IISEventLogEntries.tpl
Where IISEventLogEntries.tpl is a file that contains the following:
<LPHEADER>
<HTML>
<HEAD>
<STYLE>
TD { font-family: Arial };
TH { font-family: Arial };
</STYLE>
</HEAD> <BODY> <TABLE BORDERCOLOR="BLACK" BORDER="1" CELLPADDING="2" CELLSPACING="2">
<TR>
<TH COLSPAN=4 BGCOLOR="BLACK"><FONT COLOR=WHITE>New W3SVC Messages in System Event Log</FONT></TH>
</TR>
<TR>
<TH ALIGN=LEFT BGCOLOR="#C0C0C0">Time Generated</TH>
<TH ALIGN=LEFT BGCOLOR="#C0C0C0">Event Type</TH>
<TH ALIGN=LEFT BGCOLOR="#C0C0C0">Strings</TH>
<TH ALIGN=LEFT BGCOLOR="#C0C0C0">Message</TH>
</TR>
</LPHEADER>
<LPBODY>
<TR bgCOLOR="%Color%">
<TD>%TimeGenerated%</TD>
<TD>%EventTypeName%</TD>
<TD>%Strings%</TD>
<TD>%Message%</TD>
</TR>
</LPBODY>
</TABLE>
</BODY>
</HTML>
22) Upload Log Parser query results directly to a table in SQL Server
logparser "select * into LogTable from [LogFileName] where cs-uri-stem like ‘/folder/filename%’" -o:SQL -createTable:ON -server:[DatabaseServer] -database:[Database] -username:[SqlUser] -password:[SqlPassword]
23) Top 10 images by size sent. Note that this example also shows how to query multiple log files at once.
logparser "Select Top 10 StrCat(Extract_Path(TO_Lowercase(cs-uri-stem)),’/') AS RequestedPath, Extract_filename(To_Lowercase(cs-uri-stem)) As RequestedFile, Count(*) AS Hits, Max(time-taken) As MaxTime, Avg(time-taken) As AvgTime, Max(sc-bytes) As BytesSent INTO TOP10ImagesBySize.txt FROM logs\iis\ex*.log WHERE (Extract_Extension(To_Lowercase(cs-uri-stem)) IN (‘gif’;'jpg’;'png’)) AND (sc-status = 200) GROUP BY To_Lowercase(cs-uri-stem) ORDER BY BytesSent, Hits, MaxTime DESC"
24) Browser types (two different approaches)
logparser "SELECT distinct cs(User-Agent), count(*) as hits INTO useragentsalltypes.txt FROM logs\iis\ex*.log GROUP BY cs(user-agent) ORDER BY hits DESC"
logparser "SELECT TO_INT(MUL(100.0,PROPCOUNT(*))) AS Percent, COUNT(*) AS Hits, cs(User-Agent) as Browser INTO UseragentsHits.txt FROM logs\iis\ex*.log GROUP BY Browser ORDER BY HITS DESC"
25) Unique visitors per day. This requires two queries. The first query selects from the IIS logs into a CSV file, and the second selects from that CSV file.
logparser "SELECT DISTINCT cs-username, date INTO tempUniqueVisitorsPerDay.csv FROM logs\iis\ex*.log WHERE cs-username <> NULL Group By Date, cs-username"
logparser "SELECT date, count(cs-username) as UniqueVisitors into test.txt FROM tempUniqueVisitorsPerDay.csv GROUP BY date"
26) Top 10 largest ASPX pages.
logparser "Select Top 10 StrCat(Extract_Path(TO_Lowercase(cs-uri-stem)),’/') AS RequestedPath, Extract_filename(To_Lowercase(cs-uri-stem)) As RequestedFile, Count(*) AS Hits, Max(time-taken) As MaxTime, Avg(time-taken) As AvgTime, Max(sc-bytes) As BytesSent INTO top10pagesbysize.txt FROM logs\iis\ex*.log WHERE (Extract_Extension(To_Lowercase(cs-uri-stem)) IN (‘aspx’)) AND (sc-status = 200) GROUP BY To_Lowercase(cs-uri-stem) ORDER BY BytesSent, Hits, MaxTime DESC"
27) Top 10 slowest ASPX pages
logparser "SELECT TOP 10 cs-uri-stem, max(time-taken) as MaxTime, avg(time-taken) as AvgTime INTO toptimetaken.txt FROM logs\iis\ex*.log WHERE extract_extension(to_lowercase(cs-uri-stem)) = ‘aspx’ GROUP BY cs-uri-stem ORDER BY MaxTime DESC"
28) Top 10 slowest ASPX pages on a specific day
logparser "SELECT TOP 10 cs-uri-stem, max(time-taken) as MaxTime, avg(time-taken) as AvgTime INTO toptimetaken.txt FROM logs\iis\ex*.log WHERE extract_extension(to_lowercase(cs-uri-stem)) = ‘aspx’ AND TO_STRING(To_timestamp(date, time), ‘MMdd’)=’1003′ GROUP BY cs-uri-stem ORDER BY MaxTime DESC"
29) Daily bandwidth
logparser "Select To_String(To_timestamp(date, time), ‘MM-dd’) As Day, Div(Sum(cs-bytes),1024) As Incoming(K), Div(Sum(sc-bytes),1024) As Outgoing(K) Into BandwidthByDay.gif From logs\iis\ex*.log Group By Day"
30) Bandwidth by hour
logparser "SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS Hour, SUM(sc-bytes) AS TotalBytesSent INTO BytesSentPerHour.gif FROM logs\iis\ex*.log GROUP BY Hour ORDER BY Hour"
31) Average page load time per user
logparser "Select Top 20 cs-username AS UserName, AVG(time-taken) AS AvgTime, Count(*) AS Hits INTO AvgTimePerUser.txt FROM logs\iis\ex*.log WHERE cs-username IS NOT NULL GROUP BY cs-username ORDER BY AvgTime DESC"
32) Ave page load time for a specific user
logparser "Select cs-username AS UserName, AVG(time-taken) AS AvgTime, Count(*) AS Hits INTO AvgTimeOnSpecificUser.txt FROM logs\iis\ex*.log WHERE cs-username = ‘CONTOSO\User1234’ GROUP BY cs-username"
33) Error trends. This query is quite long, and is easier expressed in a text file than on the command line. So, Log Parser reads and executes the query contained in the specified text file.
logparser file:errortrend.sql
Where errortrend.sql contains the following:
SELECT
TO_STRING(To_timestamp(date, time), ‘MMdd’) AS Day,
SUM(c200) AS 200s,
SUM(c206) AS 206s,
SUM(c301) AS 301s,
SUM(c302) AS 302s,
SUM(c304) AS 304s,
SUM(c400) AS 400s,
SUM(c401) AS 401s,
SUM(c403) AS 403s,
SUM(c404) AS 404s,
SUM(c500) AS 500s,
SUM(c501) AS 501s,
SUM(c502) AS 502s,
SUM(c503) AS 503s,
SUM(c504) AS 504s,
SUM(c505) AS 505s
USING
CASE sc-status WHEN 200 THEN 1 ELSE 0 END AS c200,
CASE sc-status WHEN 206 THEN 1 ELSE 0 END AS c206,
CASE sc-status WHEN 301 THEN 1 ELSE 0 END AS c301,
CASE sc-status WHEN 302 THEN 1 ELSE 0 END AS c302,
CASE sc-status WHEN 304 THEN 1 ELSE 0 END AS c304,
CASE sc-status WHEN 400 THEN 1 ELSE 0 END AS c400,
CASE sc-status WHEN 401 THEN 1 ELSE 0 END AS c401,
CASE sc-status WHEN 403 THEN 1 ELSE 0 END AS c403,
CASE sc-status WHEN 404 THEN 1 ELSE 0 END AS c404,
CASE sc-status WHEN 500 THEN 1 ELSE 0 END AS c500,
CASE sc-status WHEN 501 THEN 1 ELSE 0 END AS c501,
CASE sc-status WHEN 502 THEN 1 ELSE 0 END AS c502,
CASE sc-status WHEN 503 THEN 1 ELSE 0 END AS c503,
CASE sc-status WHEN 504 THEN 1 ELSE 0 END AS c504,
CASE sc-status WHEN 505 THEN 1 ELSE 0 END AS c505
INTO ErrorChart.gif
FROM
logs\iis\ex*.log
GROUP BY
Day
ORDER BY
Day
34) Win32 errors
logparser "SELECT sc-win32-status as ErrorNumber, WIN32_ERROR_DESCRIPTION(sc-win32-status) as ErrorDesc, Count(*) AS Total INTO Win32ErrorNumbers.txt FROM logs\iis\ex*.log WHERE sc-win32-status>0 GROUP BY ErrorNumber ORDER BY Total DESC"
35) Substatus codes
logparser "SELECT sc-status, sc-substatus, Count(*) AS Total INTO 401subcodes.txt FROM logs\iis\ex*.log WHERE sc-status=401 GROUP BY sc-status, sc-substatus ORDER BY sc-status, sc-substatus DESC"
36) Substatus codes per day. This is another example of executing a query contained in a text file.
logparser file:substatusperday.sql
Where substatusperday.sql contains the following:
SELECT
TO_STRING(To_timestamp(date, time), ‘MMdd’) AS Day,
SUM(c1) AS 4011,
SUM(c2) AS 4012,
SUM(c3) AS 4013,
SUM(c4) AS 4014,
SUM(c5) AS 4015,
SUM(c7) AS 4017
USING
CASE sc-substatus WHEN 1 THEN 1 ELSE 0 END AS c1,
CASE sc-substatus WHEN 2 THEN 1 ELSE 0 END AS c2,
CASE sc-substatus WHEN 3 THEN 1 ELSE 0 END AS c3,
CASE sc-substatus WHEN 4 THEN 1 ELSE 0 END AS c4,
CASE sc-substatus WHEN 5 THEN 1 ELSE 0 END AS c5,
CASE sc-substatus WHEN 7 THEN 1 ELSE 0 END AS c7
INTO
401subcodesperday.txt
FROM
logs\iis\ex*.log
WHERE
sc-status=401
GROUP BY
Day
ORDER BY
Day
37) Substatus codes per page
logparser "SELECT TOP 20 cs-uri-stem, sc-status, sc-substatus, Count(*) AS Total INTO 401Pagedetails.txt FROM logs\iis\ex*.log WHERE sc-status=401 GROUP BY cs-uri-stem, sc-status, sc-substatus ORDER BY Total"
38) MB sent per HTTP status code
logparser "SELECT EXTRACT_EXTENSION(cs-uri-stem) AS PageType, SUM(sc-bytes) as TotalBytesSent, TO_INT(MUL(PROPSUM(sc-bytes), 100.0)) AS PercentBytes INTO PagesWithLargestBytesSent.htm FROM logs\iis\ex*.log GROUP BY Pagetype ORDER BY PercentBytes DESC"
39) 500 errors per ASPX and Domain User
logparser "SELECT cs-username, cs-uri-stem, count(*) as Times INTO 500PagesByUserAndPage.txt FROM logs\iis\ex*.log WHERE sc-status=500 GROUP BY cs-username, cs-uri-stem ORDER BY Times DESC"
40) Percent of 500 errors caused by each user
logparser "SELECT cs-username, count(*) as Times, propcount(*) as Percent INTO 500ErrorsByUser.csv FROM logs\iis\ex*.log WHERE sc-status=500 GROUP BY cs-username ORDER BY Times DESC"
41) Determine what percentage of the total bytes sent are being caused by each page type
logparser "SELECT EXTRACT_EXTENSION(cs-uri-stem) AS PageType, SUM(sc-bytes) as TotalBytesSent, TO_INT(MUL(PROPSUM(sc-bytes), 100.0)) AS PercentBytes INTO PagesWithLargestBytesSent.txt FROM logs\iis\ex*.log GROUP BY Pagetype ORDER BY PercentBytes DESC"
42) Top 20 pages with a specific HTTP return code
logparser "SELECT TOP 20 cs-uri-stem, sc-status, Count(*) AS Total INTO TOP20PagesWith401.txt FROM logs\iis\ex*.log WHERE TO_LOWERCASE(cs-uri-stem) LIKE ‘%.aspx’ and sc-status=401 GROUP BY cs-uri-stem, sc-status ORDER BY Total, cs-uri-stem, sc-status DESC"
43) Check traffic from IP addresses
logparser "Select c-ip AS Client, Div(Sum(cs-bytes),1024) As IncomingBytes(K), Div(Sum(sc-bytes),1024) As OutgoingBytes(K), MAX(time-taken) as MaxTime, AVG(time-taken) as AvgTime, count(*) as hits INTO errorsperip.txt FROM logs\iis\ex*.log GROUP BY client ORDER BY Hits DESC"
44) Check errors by IP address
logparser file:errorbyip.sql
Where errorbyip.sql contains the following:
Select
c-ip AS Client,
SUM(c400) AS 400s,
sum(c401) AS 401s,
SUM(c403) AS 403s,
SUM(c404) AS 404s,
SUM(c500) AS 500s,
SUM(c501) AS 501s,
SUM(c502) AS 502s,
SUM(c503) AS 503s,
SUM(c504) AS 504s,
SUM(c505) AS 505s
USING
CASE sc-status WHEN 400 THEN 1 ELSE 0 END AS c400,
CASE sc-status WHEN 401 THEN 1 ELSE 0 END AS c401,
CASE sc-status WHEN 403 THEN 1 ELSE 0 END AS c403,
CASE sc-status WHEN 404 THEN 1 ELSE 0 END AS c404,
CASE sc-status WHEN 500 THEN 1 ELSE 0 END AS c500,
CASE sc-status WHEN 501 THEN 1 ELSE 0 END AS c501,
CASE sc-status WHEN 502 THEN 1 ELSE 0 END AS c502,
CASE sc-status WHEN 503 THEN 1 ELSE 0 END AS c503,
CASE sc-status WHEN 504 THEN 1 ELSE 0 END AS c504,
CASE sc-status WHEN 505 THEN 1 ELSE 0 END AS c505
INTO
IPNumberFileName.txt
FROM
logs\iis\ex*.log
WHERE
c-ip=’<IP address goes here>’
GROUP BY
client
45) Find broken links
logparser "SELECT DISTINCT cs(Referer) as Referer, cs-uri-stem as Url INTO ReferBrokenLinks.txt FROM logs\iis\ex*.log WHERE cs(Referer) IS NOT NULL AND sc-status=404 AND (sc-substatus IS NULL OR sc-substatus=0)"
46) Top 10 pages with most hits
logparser "Select TOP 10 STRCAT(EXTRACT_PATH(cs-uri-stem),’/') AS RequestPath, EXTRACT_FILENAME(cs-uri-stem) AS RequestedFile, COUNT(*) AS TotalHits, Max(time-taken) AS MaxTime, AVG(time-taken) AS AvgTime, AVG(sc-bytes) AS AvgBytesSent INTO Top10Urls.txt FROM logs\iis\ex*.log GROUP BY cs-uri-stem ORDER BY TotalHits DESC"
47) Unique users per browser type (requires two queries)
logparser "SELECT DISTINCT cs-username, cs(user-agent) INTO UserAgentsUniqueUsers1.csv FROM logs\iis\ex*.log WHERE cs-username <> NULL GROUP BY cs-username, cs(user-agent)"
logparser "SELECT cs(user-agent), count(cs-username) as UniqueUsersPerAgent, TO_INT(MUL(PROPCOUNT(*), 100)) AS Percentage INTO UniqueUsersPerAgent.txt FROM UserAgentsUniqueUsers1.csv GROUP BY cs(user-agent) ORDER BY UniqueUsersPerAgent DESC"
48) Bytes sent per file extension
logparser "SELECT EXTRACT_EXTENSION( cs-uri-stem ) AS Extension, MUL(PROPSUM(sc-bytes),100.0) AS PercentageOfBytes, Div(Sum(sc-bytes),1024) as AmountOfMbBytes INTO BytesPerExtension.txt FROM logs\iis\ex*.log GROUP BY Extension ORDER BY PercentageOfBytes DESC"
49) Domains referring traffic to your site
logparser "SELECT EXTRACT_TOKEN(cs(Referer), 2, ‘/’) AS Domain, COUNT(*) AS [Requests] INTO ReferringDomains.txt FROM logs\iis\ex*.log GROUP BY Domain ORDER BY Requests DESC"
50) OS types (requires two queries)
logparser "SELECT DISTINCT c-ip, cs(user-agent) INTO UserAgentsUniqueUsers.csv FROM logs\iis\ex*.log WHERE c-ip <> NULL GROUP BY c-ip, cs(user-agent)"
logparser file:getos.sql
Where getos.sql contains the following:
SELECT
SUM (c70) AS Win7,
SUM (c60) AS Vista,
SUM (c52) AS Win2003,
SUM (c51) AS WinXP,
SUM (C50) AS Win2000,
SUM (W98) AS Win98,
SUM (W95) AS Win95,
SUM (W9x) AS Win9x,
SUM (NT4) AS WinNT4,
SUM (OSX) AS OS-X,
SUM (Mac) AS Mac-,
SUM (PPC) AS Mac-PPC,
SUM (Lnx) AS Linux
USING
CASE strcnt(cs(User-Agent),’Windows+NT+6.1′) WHEN 1 THEN 1 ELSE 0 END AS C70,
CASE strcnt(cs(User-Agent),’Windows+NT+6.0′) WHEN 1 THEN 1 ELSE 0 END AS C60,
CASE strcnt(cs(User-Agent),’Windows+NT+5.2′) WHEN 1 THEN 1 ELSE 0 END AS C52,
CASE strcnt(cs(User-Agent),’Windows+NT+5.1′) WHEN 1 THEN 1 ELSE 0 END AS C51,
CASE strcnt(cs(User-Agent),’Windows+NT+5.0′) WHEN 1 THEN 1 ELSE 0 END AS C50,
CASE strcnt(cs(User-Agent),’Win98′) WHEN 1 THEN 1 ELSE 0 END AS W98,
CASE strcnt(cs(User-Agent),’Win95′) WHEN 1 THEN 1 ELSE 0 END AS W95,
CASE strcnt(cs(User-Agent),’Win+9x+4.90′) WHEN 1 THEN 1 ELSE 0 END AS W9x,
CASE strcnt(cs(User-Agent),’Winnt4.0′) WHEN 1 THEN 1 ELSE 0 END AS NT4,
CASE strcnt(cs(User-Agent),’OS+X’) WHEN 1 THEN 1 ELSE 0 END AS OSX,
CASE strcnt(cs(User-Agent),’Mac’) WHEN 1 THEN 1 ELSE 0 END AS Mac,
CASE strcnt(cs(User-Agent),’PPC’) WHEN 1 THEN 1 ELSE 0 END AS PPC,
CASE strcnt(cs(User-Agent),’Linux’) WHEN 1 THEN 1 ELSE 0 END AS Lnx
INTO
GetOSUsed.txt
FROM
UserAgentsUniqueUsers.csv
51) Get timeout errors from the server Event Log. Display results in a datagrid.
logparser "select * from \\servername\application where message like ‘%timeout expired%’" -i:EVT -o:datagrid
52) Get exceptions from the server Event (Application) Log
logparser "select timegenerated, eventtypename, eventcategoryname, message into webserverlog.csv from \\servername\application where message like ‘%myapplication%exception%’" -i:EVT

Fonte: http://mlichtenberg.wordpress.com/2011/02/03/log-parser-rocks-more-than-50-examples/

terça-feira, dezembro 04, 2012

How Transactional Replication Works

Transactional replication is implemented by the SQL Server Snapshot Agent, Log Reader Agent, and Distribution Agent. The Snapshot Agent prepares snapshot files containing schema and data of published tables and database objects, stores the files in the snapshot folder, and records synchronization jobs in the distribution database on the Distributor.
The Log Reader Agent monitors the transaction log of each database configured for transactional replication and copies the transactions marked for replication from the transaction log into the distribution database, which acts as a reliable store-and-forward queue. The Distribution Agent copies the initial snapshot files from the snapshot folder and the transactions held in the distribution database tables to Subscribers.
Incremental changes made at the Publisher flow to Subscribers according to the schedule of the Distribution Agent, which can run continuously for minimal latency, or at scheduled intervals. Because changes to the data must be made at the Publisher (when transactional replication is used without immediate updating or queued updating options), update conflicts are avoided. Ultimately, all Subscribers will achieve the same values as the Publisher. If immediate updating or queued updating options are used with transactional replication, updates can be made at the Subscriber, and with queued updating, conflicts might occur. For more information, see How Updatable Subscriptions Work.



URL: http://msdn.microsoft.com/en-us/library/ms151706(v=sql.105).aspx

sexta-feira, novembro 30, 2012

IIS Recycle automático


Como configurar limites de memória nas APP Pools do IIS

Sempre que se configura um site de IIS é conveniente proceder à limitação da memória em uso por essa AppPool de forma a que sempre que ultrapassar esse limite vai forçar a matar os processos pendentes desse site, ou seja, matará falhas derivadas de erros de programação como processos que não têm o kill correpondente e ou não é feito o recycle dentro da própria aplicação/site.

========================================================

The same setting hasn't been changed since IIS 6.0.

In IIS mmc, click Application Pools. Right-click a pool and select Advanced
Settings. In Recycling section, you will see there are two settings:
Private Memory Limit (KB) and Virtual Memory Limit (KB) .

When any of these 2 settings are set, if the worker process exceeds the
private or virtual memory quota, IIS will recycle that pool which limits
the memory usage.


========================================================

Dificuldades já conhecidas:

All the limits in the application pool are for bad behaving apps. And more specifically:
  1. To prevent the bad app from disturbing to good apps.
  2. To try and keep the bad app running as much as possible.
In that light, the answer is off course: It depends.
If your application is leaking then without a limit it will crash around 1.2 - 1.6 Gb (if memory serves). So 1 Gb is sensible. If during normal operation your application consume not more the 100 Mb and you have many app pool on the server, than you should set the limit lower to prevent one app from damaging other apps.
To conclude. 1 Gb is sensible. Hitting the limits should be treated as application crash and debugged and fixed.

Want to learn more:

http://blogs.msdn.com/b/pfedev/archive/2009/01/22/memory-based-recycling-in-iis-6-0.aspx


segunda-feira, novembro 19, 2012

How to use IIS Logs with LOGPARSER

Exemplo de pesquisa do logparser para logs de iis

LogParser -i:IISW3C "SELECT * FROM \\servername\LogsConsolidation\Repository\W3C3\*.log WHERE cs-uri-stem  '/imagesSite/cover.jpg' " -o:CSV > C:\HitsCovers.csv
Resultado:

 
 
Outro exemplo agora com datas:
 
LogParser -i:IISW3C "SELECT * FROM \\ServerName\LogsConsolidation\Repository\W3C3\*.log WHERE cs-uri-stem = '/imagesServerName/imgCovers.jpg' AND (DATE >= '2012-11-16' AND DATE <= '2012-11-23')  " -o:CSV > C:\HitsCovers_Nov16_23.csv

How to use LogParser for Windows

O LogParser é uma tool potente de utilização em Windows para fazer pesquisa em Logs de IIS ou outros.
Tem parametrizações especificas para vários tipos de Logs.

Sites com info:

http://technet.microsoft.com/pt-br/library/cc779255(v=ws.10).aspx
http://technet.microsoft.com/en-us/scriptcenter/dd919274.aspx
http://support.microsoft.com/kb/910447
http://en.wikipedia.org/wiki/Logparser

Exemplos vários para LogParser:

Comando LOG PARSER
==> CSV
logparser "SELECT Count(EventID) AS Contador, ComputerName, EventID, EventTypeName, to_string(TimeGenerated,'yyyy-MM-dd hh:mm') AS DateEvent, Strings  from *.evt to EventViewerVDFAPPs_v2.csv WHERE TimeGenerated > timestamp('01-03-2011', 'dd-MM-yyyy') AND Strings
like'%Fail to obtain widget menu%' GROUP BY ComputerName, EventID, EventTypeName, DateEvent, Strings ORDER BY DateEvent Desc" -o:CSV
==> XML
logparser "SELECT Count(EventID) AS Contador, ComputerName, EventID, EventTypeName, to_string(TimeGenerated,'yyyy-MM-dd hh:mm') AS DateEvent, Strings  from *.evt to EventViewerVDFAPPs_v2.xml WHERE TimeGenerated > timestamp('01-03-2011', 'dd-MM-yyyy') AND Strings
like'%exception%' GROUP BY ComputerName, EventID, EventTypeName, DateEvent,Strings ORDER BY DateEvent Desc" -o:XML


-- PPI: Comando para ficheiros log de IIS e apanhar webservices e erros 500logparser "SELECT * FROM *.log to pires500.csv WHERE TEXT LIKE '%GETGROUPGRANTEDKEYS%' AND TEXT LIKE '% 500 %' " -o:csv
logparser ComputerName, EventId, EventType, SourceName, count(*) From 'STG-ASVR-*.Application.evt' to 'EventLogResult.csv' group by computername, eventId, EventType, SourceName Order By computername, eventtype, eventid" -o:CSV
logparser "Select ComputerName,to_string(TimeGenerated,'yyyy-MM-dd') as Day, EventTypeName, count(*) From 'STG-ASVR-*.Application.evt' to 'EventLogResult.csv' group by computername, Day, EventTypeName Order By computername, Day, eventtypeName" -o:CSV

-- PPI: Obtem os dados do EventViewer para um CSV do Evento 16571 (CCSKIPS)logparser "SELECT Count(EventID) AS Contador, ComputerName, EventID, EventTypeName, to_string(TimeGenerated,'yyyy-MM-dd hh:mm') AS DateEvent from mon-asvr-*_App.evt to EventViewerMON_ASVR.csv WHERE EventID = 16571 GROUP BY ComputerName, EventID, EventTypeName,
DateEvent ORDER BY DateEvent Desc" -o:CSV
-- PPI: Obtem dados dentro de um determinado período
logparser "SELECT ComputerName, EventID, EventTypeName, Strings, to_string(TimeGenerated,'yyyy-MM-dd hh:mm') AS DateEvent from CAX-DSVR-02_App.evt WHERE TimeGenerated < timestamp('30-09-2008','dd-MM-yyyy')  AND TimeGenerated > timestamp('20-09-2008', 'dd-MM-yyyy') 
GROUP BY ComputerName, EventID, EventTypeName, Strings, DateEvent ORDER BY DateEvent Desc"
logparser "SELECT ComputerName, EventID, EventTypeName, Strings, to_string(TimeGenerated,'yyyy-MM-dd hh:mm') AS DateEvent from CAX-DSVR-02_App.evt WHERE TimeGenerated < timestamp('30-09-2008','dd-MM-yyyy')  AND TimeGenerated > timestamp('20-09-2008', 'dd-MM-yyyy') 
GROUP BY ComputerName, EventID, EventTypeName, Strings, DateEvent ORDER BY DateEvent Desc"

-- PPI: Obter dados do Strings também (sem o Enter > falta descobrir o char)logparser "SELECT ComputerName, EventID, EventTypeName, to_string(TimeGenerated,'yyyy-MM-dd hh:mm') AS DateEvent, REPLACE_CHR(Message, '£', '') AS Message from CAX-DSVR-02_App.evt to Pesquisa.csv WHERE TimeGenerated < timestamp('30-09-2008','dd-MM-yyyy')  AND
TimeGenerated > timestamp('20-09-2008', 'dd-MM-yyyy')  GROUP BY ComputerName, EventID, EventTypeName, Message, DateEvent ORDER BY DateEvent Desc" -o:CSV

-- PPI: Obter dados de servidoreslogparser "SELECT ComputerName, EventId, EventTypeName, to_string(TimeGenerated, 'yyyy-MM-dd hh:mm') AS EventDate, Count(1) as CountEvents FROM EventLog_20081015.evt where EventId = 14206 GROUP BY ComputerName, EventID, EventTypeName, EventDate ORDER BY
EventDate DESC"

-- PPI: Looking for IP
logparser "SELECT ComputerName, EventId, EventTypeName, to_string(TimeGenerated, 'yyyy-MM-dd hh:mm') AS EventDate, Count(1) as CountEvents FROM EventLog_20081015.evt where EventId = 14206 and Strings like '%10.193.219.107%' GROUP BY ComputerName, EventID,
EventTypeName, EventDate ORDER BY EventDate DESC"
logparser "SELECT ComputerName, EventId, EventTypeName, to_string(TimeGenerated, 'yyyy-MM-dd hh:mm') AS EventDate, Count(1) as CountEvents FROM EventLog_20081015.evt where EventId = 14206 and Strings not like '%10.193.219.107%' GROUP BY ComputerName, EventID,
EventTypeName, EventDate ORDER BY EventDate DESC"

-- PPI: Para um determinado EventIDlogparser "SELECT UserName, ComputerName, EventId, EventTypeName, to_string(TimeGenerated, 'yyyy-MM-dd hh:mm') AS EventDate FROM *.evt to 'EventsSFB01_12994' where EventId = 12994 ORDER BY EventDate DESC" -o:csv
logparser "SELECT ComputerName, EventId, EventTypeName, to_string(TimeGenerated, 'yyyy-MM-dd hh:mm') AS EventDate, Count(1) as CountEvents FROM *.evt to 'EventsSFB01_12994' where EventId = 12994 GROUP BY ComputerName, EventID, EventTypeName, EventDate ORDER BY
EventDate DESC" -o:csv

-- PPI: Para obter uma lista em XML de uma determinada string em Logs de IISLogParser -i:TEXTLINE "SELECT * FROM \\Alfr-log-01\LogsConsolidation\Repository\W3C3\*.log WHERE Text like '%PromoFriends.jpg%'" -o:xml > C:\Oper\LogParser\WIDGETS\PromoFriends2.xml

quarta-feira, novembro 14, 2012

Most Common FTP errors

CodeDescription
100 CodesThe requested action is being taken. Expect a reply before proceeding with a new command.
110Restart marker reply.
120Service ready in (n) minutes.
125Data connection already open, transfer starting.
150File status okay, about to open data connection.
200 CodesThe requested action has been successfully completed.
200Command okay.
202Command not implemented
211System status, or system help reply.
212Directory status.
213File status.
214Help message.
215NAME system type. (NAME is an official system name from the list in the Assigned Numbers document.)
220Service ready for new user.
221Service closing control connection. (Logged out if appropriate.)
225Data connection open, no transfer in progress.
226Closing data connection. Requested file action successful (file transfer, abort, etc.).
227Entering Passive Mode
230User logged in, proceed.
250Requested file action okay, completed.
257"PATHNAME" created.
300 CodesThe command has been accepted, but the requested action is being held pending receipt of further information.
331User name okay, need password.
332Need account for login.
350Requested file action pending further information.
400 CodesThe command was not accepted and the requested action did not take place.
The error condition is temporary, however, and the action may be requested again.
421Service not available, closing control connection. (May be a reply to any command if the service knows it must shut down.)`
425Can't open data connection.
426Connection closed, transfer aborted.
450Requested file action not taken. File unavailable (e.g., file busy).
451Requested action aborted, local error in processing.
452Requested action not taken. Insufficient storage space in system.
500 CodesThe command was not accepted and the requested action did not take place.
500Syntax error, command unrecognized. This may include errors such as command line too long.
501Syntax error in parameters or arguments.
502Command not implemented.
503Bad sequence of commands.
504Command not implemented for that parameter.
530User not logged in.
532Need account for storing files.
550Requested action not taken. File unavailable (e.g., file not found, no access).
552Requested file action aborted, storage allocation exceeded
553Requested action not taken. Illegal file name.

http://www.theegglestongroup.com/writing/ftp_error_codes.php

segunda-feira, novembro 12, 2012

Lista de ocupação por diretorias

Quando em DOS temos problemas em obter uma lista da ocupação de diretorias, poder-se-á usar o seguinte script e comando:

diskusage.bat [dir] /L > ficOutput.txt

=============================================
@ECHO OFF
CLS
:: Use local variables
IF "%OS%"=="Windows_NT" SETLOCAL
:: Check command line arguments and Windows version
ECHO.%1 | FIND "/" >NUL
IF NOT ERRORLEVEL 1 IF /I NOT "%~1"=="/L" GOTO Syntax
ECHO.%1 | FIND "?" >NUL
IF NOT ERRORLEVEL 1 GOTO Syntax
ECHO.%1 | FIND "*" >NUL
IF NOT ERRORLEVEL 1 GOTO Syntax
IF NOT "%OS%"=="Windows_NT" GOTO Syntax
IF NOT "%~1"=="" IF /I NOT "%~1"=="/L" IF NOT EXIST "%~1" GOTO Syntax
SET LongFormat=1
IF /I NOT "%~1"=="/L" IF /I NOT "%~2"=="/L" SET LongFormat=0
:: Go to start directory
SET StartDir=%CD%
IF NOT "%~1"=="" IF /I NOT "%~1"=="/L" SET StartDir=%~1
PUSHD "%StartDir%"
IF ERRORLEVEL 1 GOTO Syntax
:: Display header
ECHO Directory Space used (MB)
ECHO.========= ===============
:: Display disk usage for start directory
IF NOT EXIST *.* GOTO SubDirs
FOR /F "tokens=3,4*" %%A IN ('DIR %1 /A-D /-C ^| FIND /I "File(s)"') DO SET ListDir=%%A
:: Different procedures depending on /L switch
IF "%LongFormat%"=="1" GOTO LongFormat
SET /A ListDir=%ListDir%+524288
SET /A ListDir=%ListDir%/1048576
ECHO..\ %ListDir%
SET ListDir=
GOTO SubDirs
:LongFormat
:: Strip last 6 digits from value
SET ListDir=%ListDir:~0,-6%
IF NOT DEFINED ListDir SET ListDir=0
:: Display resulting value in MB
ECHO..\ %ListDir%
:: Clear variable
SET ListDir=

:: Display disk usage for every subdirectory
:SubDirs
FOR /D %%A IN (*.*) DO CALL :List%LongFormat% "%%~A"
:: Done
POPD
GOTO End

:List0
:: Set variable value to bytes used by directory
FOR /F "tokens=3,4*" %%B IN ('DIR /A /-C /S "%~1" ^| FIND /I "File(s)"') DO SET ListDir=%%~B
:: Add 0.5MB in order to properly round the value when integer divided by 1MB
SET /A ListDir=%ListDir%+524288
:: Integer divide by 1MB
SET /A ListDir=%ListDir%/1048576
:: Display resulting value in MB
ECHO.%~1 %ListDir%
:: Clear variable
SET ListDir=
GOTO:EOF

:List1
:: Set variable value to bytes used by directory
FOR /F "tokens=3,4*" %%B IN ('DIR /A /-C /S "%~1" ^| FIND /I "File(s)"') DO SET ListDir=%%~B
:: Strip last 6 digits from value
SET ListDir=%ListDir:~0,-6%
IF NOT DEFINED ListDir SET ListDir=0
:: Display resulting value in MB
ECHO.%~1 %ListDir%
:: Clear variable
SET ListDir=
GOTO:EOF

:Syntax
ECHO.
ECHO DiskUse, Version 5.01 for Windows 2000 / XP
ECHO Display disk space used by subdirectories (tab delimited)
ECHO.
ECHO Usage:  DISKUSE  [ startdir ]  [ /L ]
ECHO.
ECHO Where:  "startdir"  is the directory containing subdirectories to be
ECHO                     inventoried (default is the current directory)
ECHO         "/L"        is used for large numbers, over 2GB, to prevent return
ECHO                     of negative numbers due to batch math limitations
ECHO                     (integer division by 1000000 instead of properly
ECHO                     rounded mathematical division by 1048576)
ECHO.
ECHO Written by Rob van der Woude
ECHO http://www.robvanderwoude.com
:End
IF "%OS%"=="Windows_NT" ENDLOCAL


=============================================
Resultado:

Directory Space used (MB)
========= ===============
.\ 0
Dir1 8893
Dir2 29
Dir3 29
Dir4 1334
Dir5 1333
Dir6 1463
Dir7 1326
Dir8 1546

Link Original:
http://www.tomshardware.co.uk/forum/117561-35-folder-size-command

Script Original:
http://www.robvanderwoude.com/files/diskuse_2k.txt
 

sexta-feira, outubro 12, 2012

Pesquisa Runtime no History em Linux


Para quem não sabe, se quando estão na linha de comando fizerem CTRL+R aparece a prompt abaixo e podem iniciar a escrever e acabarão por conseguir navegar no histórico de comandos, apanhando o último que fizeram e basta fazer enter assim que ele reconhecer o comando.

~]$
(reverse-i-search)`cd lo': cd log/

terça-feira, outubro 09, 2012

WGET command

If you have a proxy you will need to start with this command

$ export http_proxy=http://100.1.1.1:8080

And then you just need to call the site

$ wget -O- http://www.google.pt

The result should be like this - getting all the HTML page:

--12:37:20--  http://www.google.pt/
Connecting to 100.1.1.1:8080... connected.
Proxy request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `STDOUT'
    [&lt;=&gt;                                                                                                                                      ] 0           --.-K/s             <html itemscope="itemscope" itemtype="http://schema.org/WebPage"><head><title>Google</title><script>window.google={kEI:"cAx0UKm4DvCX0QWshYGYBA",getEI:function(a){var b;while(a&&!(a.getAttribute&&(b=a.getAttribute("eid"))))a=a.parentNode;return b||google.kEI},https:function(){return window.location.protocol=="https:"},kEXPI:"17259,23628,32690,35704,39523,39978,4000116,4000354,4000553,4000624,4000648,4000743,4000833,4000955,4001001,4001013,4001064,4001132,4001145,4001188,4001192,4001267,4001293,4001441,4001449,4001461",kCSI:{e:"17259,23628,32690,35704,39523,39978,4000116,4000354,4000553,4000624,4000648,4000743,4000833,4000955,4001001,4001013,4001064,4001132,4001145,4001188,4001192,4001267,4001293,4001441,4001449,4001461",ei:"cAx0UKm4DvCX0QWshYGYBA"},authuser:0,
ml:function(){},kHL:"pt-PT",time:function(){return(new Date).getTime()},log:function(a,b,c,e){var d=new Image,h=google,i=h.lc,f=h.li,j="";d.onerror=(d.onload=(d.onabort=function(){delete i[f]}));i<

...

(google.stt!==undefined)google.kCSI.stt=google.stt;google.csiReport&&google.csiReport()}if(window.addEventListener)window.addEventListener("load",
l,false);else if(window.attachEvent)window.attachEvent("onload",l);google.timers.load.t.prt=(f=(new Date).getTime());
})();
    [ <=>                                                                                                                                     ] 11,527      --.-K/s   in 0.001s
12:37:20 (20.6 MB/s) - `-' saved [11527]
</script></body></html>