Complete Guide to Log Collections

introduction

The HTTP 500 Internal Server Error is one of the most common errors that developers and administrators face when hosting web applications on IIS. This error indicates that there is a problem with the server that prevents it from completing the request, but it does not provide any details about what went wrong. Understanding the 500 status code and collecting detailed logs is essential for troubleshooting the issue effectively. In this article, we will look at the 500 Internal Server Error, the reasons for it, and various ways to collect useful diagnostic logs.

outline

500 Internal Server Error is a generic server error that occurs when the server cannot process the request due to unexpected circumstances. IIS 7.0 and later versions define the following HTTP status codes that indicate more specific causes of Error 500. The table below shows the sub-status codes with their descriptions.

To learn more about http status codes, read this article. HTTP Status Codes Overview – Internet Information Services | Microsoft Learn.

Log collection

500 Internal Server Error is a common error and requires in-depth investigation to determine the root cause. This is where log collection plays a crucial role. You should collect the following logs:

1. IIS Logs
2. Failed request tracing log
3. Event logs for applications and systems.
4. ETW Tracking
5. Memory dump

1. IIS log

This is the starting point for troubleshooting all server errors. These logs provide a record of all incoming HTTP requests and the server’s responses, including status codes, timestamps, etc. To enable IIS logs, follow the steps below:

• open IIS Manager.
• Go to your website between window glass.
• open logging. Logs are usually stored in C:\inetpub\logs\LogFiles. Update the location as per your convenience.
• And click apply.

To collect logs, go to your log file directory and look for a folder name that ends with your site number. To find out your site number, go to: Site at connection panel. And find the ID column. For example, if your site ID is 2, the folder name will be W3SVC2.

2. Failed request tracing log

Failed Request Tracing Logs, or FREB, analyze the request processing pipeline to provide more detailed insights than IIS logs. It tracks which part of the pipeline is causing the failure. Follow the steps below to configure FREB.

• Open IIS Manager
• Go to your website between window glass.
• open Failed Request Tracking
• Clicking sound add In the right task pane.

• Choose All content
• Clicking sound
• next check Status Code(s)
• Checkbox. The status code should be:
• 500~600 And clicknext

• HridayDutta_7-1725961293804.png Check all offersCheckbox
• . And clickfinish
• . Select the newly created rule and click
• Edit site tracking. check make possible
• Checkbox Update directory
• Path (or leave as default) And clickgreat

HridayDutta_8-1725961333377.png

To collect logs, go to the log file directory and look for a folder name that ends with your site number. For example, if your site ID is 1, the folder name would be W3SVC1.

3. Event Log window Event Log

• This is another valuable source of information, especially when dealing with application crashes, service restarts, or other server-related issues that may result in a 500 error. open
• Event Viewer Send out Application and system Logs in the Windows Logs section saving Without any filters .evtx

HridayDutta_9-1725961916585.png

4. ETW Tracking

• You should use the PerfView tool. It is a powerful diagnostic tool for collecting performance traces and analyzing .NET applications. It is especially useful for investigating performance bottlenecks or runtime issues that may lead to 500 errors. Download Perfview tool ~ inRelease · microsoft/perfview (github.com)
• A profiler tool that captures ETW events from servers (no installation required). open Performance
• Tools and move collect Menus and Selections collect
• Options. Choosezipper ,absorption , Thread time
• Please select the checkboxes as shown below. expansion
• Advanced Options ChooseKernel base ,.net ,CPU Sample ,ISIS and Work (TPL)
• Please check the boxes as shown below. Add the following string to the additional provider: *Microsoft-Extended-LoggingFor .Net Core, add *. [do not miss * at the beginning]

• HridayDutta_5-1725965942684.png Clicking sound Start your collection
• button.
• Reproduce the problem Click to stop collectingStop collecting
• , It will be generated after waiting a while for it to merge. Perfview.etl.zip

file.

5. Memory dump If your application crashes unexpectedly Memory dump

• HridayDutta_6-1725966029000.png Select the type of work
• Full user dump And the number of action limits is as follows:3
• . Clicking soundnext
• . Please select Output location
• Save the dump file. and
• get sinceActivate Rules

HridayDutta_7-1725966059213.png

conclusion

HTTP 500 Internal Server Errors can be difficult to understand and troubleshoot, but with the right logging techniques, you can narrow down the cause and find a solution more efficiently. Start with basic IIS logs for high-level information, dig deeper with failed request trace logs for detailed request failures, use PerfView for performance bottlenecks, and if necessary, collect memory dumps for deeper analysis of crashes and unhandled exceptions. If you are comfortable analyzing this data, you should be able to glean insights from the collected logs. If you would like us to do this for you, let us know your case and we can do it for you.