Post-processing and Viewing IIS Request-Based Tracing Data

Applies To: Windows Server 2003, Windows Server 2003 with SP1

Event Tracing for Windows writes trace data to the trace log (.etl log file) in a binary format. To view the trace data, the trace log must be processed by a tool. The tools described below process .etl log files.

Trace Report (tracerpt.exe)

Trace Report ships with Windows Server 2003. To process the trace log file with Trace Report, type tracerpt filename and press ENTER. For example:

tracerpt NewTrace.etl

Trace Report converts the binary trace data into text and produces two files in the directory where you executed the tracerpt command:

• Summary.txt contains general details about the trace session, including which providers were used.

• DumpFile.csv contains the actual trace data in a text format. Open DumpFile.csv in a text editor like Notepad to view the trace data. The data in DumpFile.csv is readable (shown below), but the formatting is not as reader-friendly as the format produced by Log Parser and DumpTraceReqs (described later in this topic):

Event Name,       Type,        TID,           Clock-Time, Kernel(ms),   User(ms), User Data
  EventTrace,     Header, 0x000000EC,   127311198897300433,         10,         60,     8192, 33620485,     3790,        1, 127311199293485921,   100144,        0, 0x00000000,        6,        1,        4,        0,      730, 0x00B82930, 0x00B82944,                0,          3579545, 127311198897300433, 0x00000002,        0, 0, 0
  IISGeneral, GENERAL_REQUEST_START, 0x00000A74,   127311199074261949,          0,          0, {00000000-0000-0000-0200-0060000000ed},        1, "DefaultAppPool", 17077649788062662657,                0, "/ASPtest", "GET", 0, 0
   IISFilter, FILTER_START, 0x00000A74,   127311199074261949,          0,          0, {00000000-0000-0000-0200-0060000000ed}, "D:\IISDebugTools\IISCHAgent.dll", 0, 0
   IISFilter, FILTER_PREPROC_HEADERS_START, 0x00000A74,   127311199074261949,          0,          0, {00000000-0000-0000-0200-0060000000ed}, 0, 0
   IISFilter, FILTER_PREPROC_HEADERS_END, 0x00000A74,   127311199074261949,          0,          0, {00000000-0000-0000-0200-0060000000ed}, 0, 0
   IISFilter, FILTER_END, 0x00000A74,   127311199074261949,          0,          0, {00000000-0000-0000-0200-0060000000ed}

Log Parser 2.2 and the DumpTraceReqs.js script

Log Parser is a free tool for parsing and formatting log files or other files that contain large amounts of unformatted data. The DumpTraceReqs.js script, which is included with Log Parser 2.2 on the Microsoft Download Center, was written by the IIS team for the purpose of processing and formatting IIS request-based tracing logs. DumpTraceReqs.js groups all events per request in chronological order, and displays them per request. You do not have to be familiar with Log Parser and the sample script to format your trace logs. You simply execute a command from the command line and the tool processes the log file for you. Whenever possible, use Log Parser and DumpTraceReqs.js to process and view trace logs because the output is much easier to read than the output from tracerpt.exe. For example:

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
-----------------------------------------------------------------------
Request n.1: /ASPtest {00000000-0000-0000-0200-0060000000ed} 2004-5-7 22:11:47

  IISGeneral: GENERAL_REQUEST_START - IIS starts processing a new request
    SiteId: 1
    AppPoolId: DefaultAppPool
    ConnId: 1073741825
    RawConnId: 0
    RequestURL: /ASPtest
    RequestVerb: GET
    ContextIDSeq: 1
    Timestamp: 22:11:47.426.194900

  IISFilter: FILTER_START - W3 filter starts
    FilterName: D:\IISDebugTools\IISCHAgent.dll
    ContextIDSeq: 1
    Timestamp: 22:11:47.426.194900

  IISFilter: FILTER_PREPROC_HEADERS_START - Filter starts PREPROC_HEADERS notification
    ContextIDSeq: 1
    Timestamp: 22:11:47.426.194900

  IISFilter: FILTER_PREPROC_HEADERS_END - Filter ends PREPROC_HEADERS notification
    ContextIDSeq: 1
    Timestamp: 22:11:47.426.194900

  IISFilter: FILTER_END - W3 filter ends
    ContextIDSeq: 1
    Timestamp: 22:11:47.426.194900

Once Log Parser and DumpTraceReqs.js have processed your .etl file, Log Parser prints the data to the screen. Viewing the data on the screen may not be an optimal viewing experience, so it is recommended that you open the processed .etl file in Notepad, as described in How to Process and View Trace Log Files

Once you have opened the processed .etl file in Notepad, you will see that each request contains a list of the trace events that were recorded during the trace session. You can scroll down the page to view all the subsequent requests and events.

For the procedure to configure Log Parser 2.2 and process an .etl file using DumpTraceReqs.js, see How to Process and View Trace Log Files.

For more information about the tracing events in your trace log file, see the Tracing Events Reference.