How to troubleshoot Notification Server issues with the IIS logs
search cancel

How to troubleshoot Notification Server issues with the IIS logs

book

Article ID: 152222

calendar_today

Updated On:

Products

IT Management Suite

Issue/Introduction

How can I use the IIS logs to troubleshoot issues with Altiris Agent communication?

Resolution

The default location for the IIS logs is at C:\WINDOWS\system32\LogFiles\W3SVC1.

Troubleshooting IIS logs can be arduous because of their sheer size. Every single Web transaction is recorded in the logs. The following items can assist in using IIS Logs when aiding troubleshooting.

This is an excerpt from an IIS log on a Notification Server:

2005-04-11 19:38:05 172.17.31.169 GET /ALTIRIS/NS/Agent/GetClientPolicies.aspx xml=%3CRequest%20configVersion=%222%22%3E%3CWrkstaGuid%3E%7BEDE45177-50D9-4851-9734-8B01BDC13A85%7D%3C%2FWrkstaGuid%3E%3C%2FRequest%3E&compress=1&hash=E43F52BD231649825F42180ED0099CFF 80 - 172.17.31.169 - 200 0 02005-04-11 19:38:05 172.17.31.169 GET /ALTIRIS/NS/Agent/GetPackageInfo.aspx xml=%3Crequest%20resource=%22%7BEDE45177-50D9-4851-9734-8B01BDC13A85%7D%22%20version=%221%22%20type=%22codebases%22%20compress=%221%22%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22172.17.31.169%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A 80 - 172.17.31.169 - 200 0 02005-04-11 19:38:05 172.17.31.169 GET /ALTIRIS/NS/Agent/GetPackageInfo.aspx xml=%3Crequest%20resource=%22%7BEDE45177-50D9-4851-9734-8B01BDC13A85%7D%22%20version=%221%22%20type=%22codebases%22%20compress=%221%22%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22172.17.31.169%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A 80 - 172.17.31.169 - 200 0 02005-04-11 19:38:06 172.17.31.169 GET /altiris/ns/agent/getpackagesnapshot.aspx PackageId=%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D&compress=1 80 - 172.17.31.169 - 200 0 02005-04-11 19:38:06 172.17.31.169 GET /Altiris/NS/NSCap/Bin/Win32/X86/HelloWorld/HelloSample.exe - 80 - 172.17.31.169 - 200 0 02005-04-11 19:38:07 172.17.31.169 POST /ALTIRIS/NS/Agent/PostEvent.asp - 80 - 172.17.31.169 - 200 0 02005-04-11 19:38:09 172.17.31.169 POST /ALTIRIS/NS/Agent/PostEvent.asp - 80 - 172.17.31.169 - 200 0 0

At a glance this appears to be very difficult to read. Not only this, but the sheer size of the IIS log can be daunting. The following tips will help you in utilizing this log in the troubleshooting process:

  • Turn off Word Wrap if you open this log in Notepad. This will allow you to see one entry per line. You can toggle this on or off as needed to assist in viewing the log.
  • With the client’s IP address, you can search using this value and find the entries placed in by the specified client computer.
  • You can search for specific pages; for example, /ALTIRIS/NS/Agent/PostEvent.asp.
  • When you find the post you are looking for, you can place the string into Internet Explorer to see a visible response from the server.

Example Problem: An Agent is not receiving its client policy XML when requested from the server. Steps to troubleshoot:

  1. Using time as a starting point, begin in the log at a point close to but before you request a configuration from the server.
  2. Search for the IP address of the client in question (172.17.31.169).
  3. Now find the line that references the GetClientPolicies.aspx. The result could be this line: 
    2005-04-11 19:38:05 172.17.31.169 GET /ALTIRIS/NS/Agent/GetClientPolicies.aspx xml=%3CRequest%20configVersion=%222%22%3E%3CWrkstaGuid%3E%7BEDE45177-50D9-4851-9734-8B01BDC13A85%7D%3C%2FWrkstaGuid%3E%3C%2FRequest%3E&compress=1&hash=E43F52BD231649825F42180ED0099CFF 80 - 172.17.31.169 - 200 0 0
  4. Now take the portion of the line that is the URL request, add the beginning of the HTTP request, as so: 
    http://servername/ALTIRIS/NS/Agent/GetClientPolicies.aspx?xml=%3CRequest%20configVersion=%222%22%3E%3CWrkstaGuid%3E%7BEDE45177-50D9-4851-9734-8B01BDC13A85%7D%3C%2FWrkstaGuid%3E%3C%2FRequest%3E&compress=1&hash=E43F52BD231649825F42180ED0099CFF
  5. When placed into the address if Internet Explorer and submitted, you’ll see the server’s response which may give you more information than what is found in the log.

Powered by Wolken Software