IIS 6: Logging Application Pool Recycling Events to the Event Log

By default, IIS 6 logs application pool recycling events to the event log when memory limits are exceeded (noting that a memory limit is not set by default) and after elapsed time (29 hours by default).

There are other reasons for application pool recycling events, such as modifications to configuration files and manual recycling requests issued by administrators. Logging of recycling events to the event log is controlled by the LogEventOnRecycle metabase property (interpreted as a bitflag).

Updating the LogEventOnRecycle property to consider other recycling events can be achieved using adsutils.vbs, or by manually editing the metabase. The following examples enable logging for all possible recycling events.

Updating using adsutils.vbs

cscript adsutil.vbs Set w3svc/AppPools/DefaultAppPool/LogEventOnRecycle 255

Updating by Editing the Metabase

• Stop IIS: iisreset -stop
• Backup the metabase (found at: %WINDIR%\system32\inetsrv\MetaBase.xml) 
• Modify the LogEventOnRecycle property:
  

Branch :            /LM/W3SVC/AppPools/
Key Name:       LogEventOnRecycle
New Value:      255 (default is 137)

The metabase can be edited using the Metabase Explorer (available as part of the IIS 6 Resource Kit Tools).

• Start IIS: iisreset -start

For further information about the LogEventOnRecycle metabase property, see the following articles:

How to modify Application Pool Recycling events in IIS 6.0
LogEventOnRecycle Metabase Property

Also note that IIS creates worker processes for application pools on demand. Thus, a recycle request may be issued but not result in an event log entry if no actual worker process is active. For more information:

Why IIS6 Application Pool Recycle Events are Not Logged

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS