nl-cristi / logcatcher Goto Github PK

Tool to help collection of logs

License: MIT License

PowerShell 100.00%

powershell iis iis-server iis-site logs microsoft logcatcher troubleshooting

logcatcher's Introduction

LogCatcher

Download LatestZIP	How To Run First Time	Tool Description	For 2008R2

The LogCatcher Tool is designed to assist in troubleshooting various IIS issues like the following:

SSL and SSL Server certificates issues

Runtime errors and exceptions, including HTTP 400 and 50x errors

Handler mappings

HTTP Redirection

Errors in the IIS management console

IIS Extensions, Tools, and Add-Ons issues

FTP service issues

Server farm configuration issues

The tool collects logs that Microsoft Support Engineers use in order to diagnose IIS issues.

This tool is developed by IIS Support Engineers so it is ready to collect logs for issues we regularly encounter.

We would send this tool to you, generally as part of a support case, and gather data to help you diagnose your issue.

You can also download the tool on your own from our GitHub page if you want to try to diagnose the issue by yourself.

Our main focus is around reducing troubleshooting time and improving response times for our customers.

LogCatcher doesn't automatically upload the files to the Microsoft servers because we didn't want anyone to think that this tool collects data without your knowledge and approval. You can take a look at the zip archive generated by the tool and see exactly what data is collected and then choose to upload it to Microsoft for analysis.

We recommend you to inspect the zip before sharing it with anyone.

The structure of the ZIP should be similar to the following diagram:

LOGcatcher<Date of collection>.zip
    ├─── FolderContents.txt
    ├─── LogsInfo.CSV
    ├─── ToolLog.log
    │
    ├─── General
    │       ├── CertUtil
    │       │     └── *CertStoreName*.txt
    │       │
    │       ├── HttpErr
    │       │     └── httperr*.config
    │       │
    │       ├── IISConfig
    │       │     ├── administration.config
    │       │     ├── applicationHost.config
    │       │     └── redirection.config
    │       │
    │       ├── IISHistoryConfig
    │       │     └── CFGHISTORY_*\*
    │       │
    │       ├── NETFramework
    │       │     ├── assembly\*\*.config
    │       │     ├── Framework\*\*.config
    │       │     └── Framework64\*\*.config
    │       │
    │       ├── NETSH-HTTP
    │       │     ├── cachestate.txt
    │       │     ├── iplisten.txt
    │       │     ├── servicestate.txt
    │       │     ├── sslcert.txt
    │       │     ├── timeout.txt
    │       │     └── urlacl.txt
    │       │
    │       ├── Application.evtx
    │       ├── Cap2.evtx
    │       ├── IIS.log
    │       ├── IISDefaultPermissions.txt
    │       ├── Security.evtx
    │       ├── Setup.evtx
    │       ├── SitesOverview.csv
    │       ├── SrvInfo.txt
    │       ├── System.evtx    
    │       └── ToolLog.log
    │
    └─── Sites
            ├── bin
            │    └── *.config
	        │
            ├── FrebLogs
            │    ├── u_ex*.log
            │    └── freb.xsl
            │
            ├── IISLogs
            │    └── u_ex*.log
            ├── web.config
            │
            └── *.config

Please create a PR or an ISSUE for any question or feature requests/changes .

License : This project is licensed under the MIT License - see the LICENSE.md file for details

logcatcher's People

Contributors

Stargazers

Watchers

Forkers

wesamzia subzer0ms v-paulino sofiaestrela nt-7 ustabar

logcatcher's Issues

[Feature Request] Get logs from specific day

Not sure how doable it is, but it would be a nice addition to have a flag specifying a specific date for which you would like to collect the logs, in case of installations where large files are produced, and the issue you are interested in occurred a while ago.

Or in alternative, if easier to implement, a way to say logs between 20 and 19 day ago, for example.

HttpERR logs do not respect the MaxDays parameter

The collection of the HttpERR logs is not respecting the Logs Age parameter, which can lead to gigabytes of files being collected in older servers which can severely slow down the process.

Looking at the code for the http error logs operation

https://github.com/cristian-clamsen/LogCatcher/blob/96ab07cffb25f8efdcfca384e2d1679cad85b4ee/LogCatcher/General/CatchFilteredIISzip.ps1#L41-L45

I would assume that a quick fix would be to add the /maxage:$MaxDay similar to the operation bellow that catches the iis logs

https://github.com/cristian-clamsen/LogCatcher/blob/96ab07cffb25f8efdcfca384e2d1679cad85b4ee/LogCatcher/General/CatchFilteredIISzip.ps1#L33-L37

If you would like let me know, and I can test it and open a PR

[feature request] WCF traces

Collect existing WCF traces:
*.svclogs and sysnet.logs

List available SPNs

Hi there

SPNs are a important component on windows that create impact on a successful authentication workflow when using Windows Integrated Authentication. It Would be nice to Have a Feature to List all the SPNs.

[Feature Proposal] collecting history of IIS configuration

I propose to collect for troubleshooting using IIS config history.
Log can be found at C:\inetpub\history*.

add new feature to collect Default permissions

add new function in the tool to collect permissions based on https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-authentication-authorization/default-permissions-user-rights

Add flag to force FREB collection

Given that the amount of generated FREBS is limited, sometimes we disable Failed Request Tracing as soon as the issue we are trying to analyze happens in order for it to not be overwritten.

In those scenarios, when we run LogCatcher since they are disabled for the selected websites they are not automatically collected, and have to be zipped and collected separately.

For those scenarios it would be useful to have a flag to force FREB collection regardless of it being enabled or not for any given site.

As far as can see it could have two approaches:

-ForceFrebCollection $true and ignore whether the flag is set or not at the site level and try to collect
-FrebCollectionSiteIds 2,3 and specify for which sites we want to ignore the flag, as for customers with large installations there could be a large overhead in trying to collect for all of them.

Feature request - IIS UI add-in

That would be great to be able to right click a site (and even at application level) on IIS and start LogCatcher from context menu.

Make UI components Scale with Main Window

Main windows can be scaled but no component inside is scaling

Implement Feature to collect logs for specific time period

The tool currently collects all logs available.
Need to implement filtering based on age of logs.

[Feature request] Get the .NET version from the server

Hi Cristi,
Can you make the tool gather the .NET version installed on the IIS server?

if .NET Framework, it should read the registry value as described here https://learn.microsoft.com/en-us/dotnet/framework/migration-guide/how-to-determine-which-versions-are-installed
if .NET Core / .NET higher than 6, I guess it should capture the output of dotnet --version

Thank you.

Tool description

Implement full CLI functionality

Implement full CLI functionality so tool can be used only from Powershell.

GetWebSites errors out

Clicking GetSites button in UI spits the following error in the PS console.
On a pristine IIS installation.

Cannot convert argument "c", with value: "@{id=1; state=Started; name=Default Web Site;
applicationPool=DefaultAppPool; enabledProtocols=http; physicalPath=%SystemDrive%\inetpub\wwwroot}", for "AddRange" to
type "System.Collections.ICollection": "Cannot convert the "@{id=1; state=Started; name=Default Web Site;
applicationPool=DefaultAppPool; enabledProtocols=http; physicalPath=%SystemDrive%\inetpub\wwwroot}" value of type
"Selected.Microsoft.IIs.PowerShell.Framework.ConfigurationElement" to type "System.Collections.ICollection"."
At F:\Downloads\LogCatcher\LogCatcher\General\Functions.ps1:274 char:5

```
$arrproc.addrange($CurrentSites)
```
```
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : NotSpecified: (:) [], MethodException
- FullyQualifiedErrorId : MethodArgumentConversionInvalidCastArgument

Create feature where tool automatically loads UI components present in Products folder

Tool does not work on powershell 2 and 3

Demo Video with voice

Method to read automatically the logs location

Tool does not generate SiteInfo file for IIS 7.5

test ISSUE

Test ISSUE

collect IIS.log for troubleshoting IIS install features

include IIS.log in the Logs collected.
Log can be found at c:\windows\IIS.log

Create reports that shows events and logs grouped By the use case by timeframe

Hi there

When troubleshooting different use cases the common sources of that that we search for, currently is separated and in different folders, organized by the location where that information exists.

It would be useful to have a report that could shown the main useful information that happen in a timeframe that we could set in the
UI grouped by troubleshooting use case.

Currently we have different sources of information: Event Logs , IIS Logs, Freb Logs, Http Err Logs. For each entry that we find that is a error or warning we could increment the count, collect the Event ID and the Error Code/Status Code.

To not impact the time we take to collect all the data , this reports could be generated only by the person that is troubleshooting the issues. For this it could exist a button that could represent the trigger to generate such reports.

With this information we could easily identify i which time frame we had the main errors that we are looking for depending on the use case, such as Authentication or Crashing.