How to Create a Provider File for Request-Based Tracing

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1

IIS components are called providers in the context of Event Tracing for Windows (ETW) because they provide trace data. When you start request-based tracing in IIS, you need to tell ETW which provider(s) to trace. You also need to tell ETW how much data each provider should report. The verbosity level is the name of the setting that indicates the amount of data requested. You define provider(s) and verbosity levels in a simple text file called a provider file. When you execute the command to start tracing, you specify the name of the provider file (and path, if necessary). ETW reads the provider file and begins tracing the provider(s) at the verbosity levels defined in that file.

In Windows Server 2003 (Service Pack 1 or later) the following IIS providers report trace data to ETW:

• IIS: WWW Server

• IIS: SSL Filter

• IIS: ISAPI Extension

• IIS: ASP

• IIS: IISAdmin

The IIS: WWW Server provider includes the following flags to enable various functional areas or subcomponents in the WWW server provider. You can define one or more functional areas in your provider file by specifying the flag number or the friendly flag name.

Verbosity levels include the following:

Level	Name	Description
0	General	IIS providers log only those few events required to provide some context to the request activity. These events include a General_Request_Start event that logs the URL and verb for the request and a General_Request_End event.
1	Fatal Error	IIS providers report events for actions that can cause a process to exit or actions that are about to cause a process to exit.
2	Error	IIS providers report events when components cannot continue processing a request. The request is immediately rejected. Expand table Note These events typically indicate a problem on the server side rather than a client-induced problem.
3	Warning	IIS providers report events when components experience an unexpected result/error but can continue processing the request.
4	Information	IIS providers report general information about requests.
5	Verbose	IIS providers report detailed information about requests.

1. Create a new file in a text editor like Notepad.

2. Enter a provider name in double quotes, flags (if any) or zero (0), and the verbosity level.

   For example:

   "IIS: WWW Server" 0xFFFFFFFE 5

   "IIS: Active Server Pages (ASP)" 0 5

   "IIS: WWW Isapi Extension" 0 5

3. Start a new line for each provider, if you plan to trace more than one provider.

4. Save and close the provider file.

Tracing Startup and Shutdown Issues in the IIS Admin Service

Configuring the IIS Request-Based Tracing Session