Advanced Troubleshooting with IIS Diagnostics Toolkit

IIS Diagnostics Toolkit Explained: Find and Fix IIS Issues Fast

When your IIS-hosted sites run slow, return errors, or behave inconsistently, the IIS Diagnostics Toolkit provides focused tools to quickly identify root causes and resolve issues. This article explains the toolkit’s key components, shows how to use them for common troubleshooting scenarios, and gives practical tips to speed diagnosis.

What is the IIS Diagnostics Toolkit?

The IIS Diagnostics Toolkit is a collection of free utilities from Microsoft for diagnosing, analyzing, and troubleshooting Internet Information Services (IIS). It includes tools for capturing HTTP requests, analyzing failed requests, inspecting worker process activity, and viewing detailed traces — all aimed at reducing time-to-resolution for IIS problems.

Core tools and what they do

• Failed Request Tracing (FREB) Viewer — Opens and analyzes FREB logs (failed request tracing) generated by IIS to show the sequence of modules and events for requests that meet configured failure criteria.
• IIS Logs and Log Parser — Parses standard IIS log files to filter and aggregate requests for patterns like slow responses, high error rates, or high-frequency clients.
• Debug Diagnostics (DebugDiag) — Captures and analyzes memory dumps, detects common issues (deadlocks, high CPU, memory leaks), and generates reports with likely causes and stack traces.
• Failed Request Tracing Module (IIS feature) — Configurable in IIS Manager to produce detailed trace events for requests that match status codes, latency thresholds, or specific URLs.
• Request Monitor and Worker Process Viewer — Lets you inspect active requests and worker process (w3wp.exe) health in real time to spot stuck threads or resource contention.

Quick setup checklist

1. Enable Failed Request Tracing in IIS Manager for the site(s) you want to monitor.
2. Configure trace rules: specify status codes (e.g., 500–599), time-taken thresholds (e.g., >3000 ms), or specific URLs.
3. Install Debug Diagnostics (DebugDiag) on servers where you need memory/CPU dump analysis.
4. Ensure IIS logging is enabled with appropriate fields (date, time, cs-uri-stem, sc-status, time-taken, cs-user-agent, etc.).
5. Centralize logs (file share or log aggregator) if troubleshooting across multiple servers.

Step-by-step workflows for common problems

1) Intermittent 500/5xx errors

• Reproduce the error and locate the corresponding FREB XML in the site’s TraceLogFiles folder.
• Open the file in FREB Viewer to inspect the module-by-module event timeline and find the module or managed code handler causing the failure.
• If FREB points to w3wp exception, capture a memory dump with DebugDiag and run the crash/hang analysis.
• Fix: patch or update the failing module, add exception handling, or adjust configuration causing the error.

2) Slow page loads / high latency

• Use IIS logs and Log Parser to identify URLs with high average time-taken and frequency.
• Enable FREB for the slow URL with a low time-taken threshold to capture traces of slow requests.
• Review worker process activity for thread pool starvation or blocking calls; collect a few lightweight memory dumps during slow periods.
• Fix: optimize slow code paths, add caching, tune ASP.NET thread pool or connection limits, or scale out.

3) Memory leaks / high memory usage

• Use DebugDiag to create memory dump collection rules for w3wp processes when private bytes exceed a threshold.
• Run DebugDiag’s memory leak analysis to get object type counts and suspect code modules.
• Correlate with application code to find undisposed objects, static caches growing unbounded, or unmanaged resources not released.
• Fix: correct code to dispose objects, reduce caching, or apply framework updates.

4) High CPU usage

• Capture CPU and thread snapshots (DebugDiag or ProcDump) while CPU is high.
• Analyze call stacks to find tight loops, expensive synchronous I/O, or excessive garbage collection.
• Fix: optimize hot paths, reduce blocking operations, or offload heavy processing to background workers.

Practical tips to diagnose faster

• Start with logs: good IIS logs often reveal the pattern before deeper tracing.
• Reproduce in a controlled environment when possible; use load generators to trigger issues reliably.
• Keep traces short and targeted — wide-open tracing generates large logs and noise.
• Correlate timestamps across IIS logs, FREB traces, and Windows Event Viewer.
• Automate dump collection for recurring spikes and rotate old dumps to conserve disk.

When to escalate

• If analysis points to native code or third-party modules without source access, contact the vendor with FREB and DebugDiag reports.
• For platform-level bugs (IIS or Windows components), include traces and dumps when opening Microsoft support cases.

Summary

The IIS Diagnostics Toolkit gives you a focused, practical toolset to move from symptom to root cause quickly: start with logs, use FREB for request-level traces, leverage DebugDiag for process-level memory/CPU issues, and inspect live worker process activity for immediate problems. With targeted tracing, well-configured rules, and correlated evidence, you can reduce mean time to repair for most IIS issues.

If you want, I can provide: a FREB rule template for a specific site, DebugDiag rule examples, or a Log Parser query to find slow URLs—tell me which one.