| Event Id | 2289 |
| Source | Microsoft-Windows-IIS-W3SVC-WP |
| Description | FailedRequestTracing Module failed to delete at least one log file from the directory '%3'. The problem happened at least %1 times in the last %2 minutes. The data is the error. |
| Event Information | According to Microsoft : Cause : This event is logged when FailedRequestTracing Module failed to delete at least one log file from the directory. Resolution : Enable tracing access to the log file directory In order for a worker process to write a failed request trace to a log file, the log file directory must exist, the IIS_IUSRS group must have the Write permission on the directory, and the disk must not be full. If the IIS_IUSRS group does not have write access to this directory, the logs will not be generated. If you specify a directory other than the default, make sure that the IIS_IUSRS group has the permission to write to it. To enable tracing access to the log file directory, perform the following procedures: 1.Find the current Failed Request Tracing log file path setting. 2.Make sure the configured Failed Request Tracing log file directory exists. 3.Make sure the IIS_IUSRS group or appropriate identity has permission to write to the directory. 4.Make sure there is sufficient disk space. To perform these procedures, you must have membership in Administrators , or you must have been delegated the appropriate authority. Find the current Failed Request Tracing log file path setting 1.Click Start , click Control Panel , and then click Administrative Tools . 2.Right-click Internet Information Services (IIS) Manager and select Run as administrator . 3.In the IIS Manager Connections pane, expand the Web server name, then Sites . 4.Select the Web site whose log file path you want to check. 5.In the Actions pane , click Configure Failed Request Tracing . The Edit Web Site Failed Request Tracing Settings dialog box appears. 6.If the Enable check box is cleared, select it. This will enable the Directory window in the dialog box. 7.In the Directory window, note the log file directory path. Make sure the configured Failed Request Tracing log file directory exists 1.Open an elevated Command Prompt window. Click Start , point to All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator . 2.Type start explorer . 3.Using Windows Explorer, navigate to the log directory location you noted earlier. If the directory does not exist, create it. Make sure the IIS_IUSRS group has permission to write to the log file directory 1.Right-click the log file directory folder and select Properties . 2.Click the Security tab. 3.In the Group or user names window, look for the IIS_IUSRS group. If it appears, select it. In the Permissions for IIS_IUSRS window, Allow should be selected for the Write permission. If the Write permission is not selected: 1.Click the Edit… button. 2.Select the IIS_IUSRS group again. 3.Select the Write check box under Allow , then click OK . 4.In the initial Permissions for IIS_IUSRS window, a check mark for the Write permission should now appear under the Allow column. If the IIS_IUSRS group does not appear in the in the Group or user names window: 1.Click Edit… , then Add . The Select Users, Computers, or Groups dialog box appears. 2.In the Enter the object names to select window, type servername \IIS_IUSRS , where servername is the name of the Web server, then click OK . 3.In the Permissions for IIS_IUSRS window, clear all check boxes and select the Allow check box for the Write permission, then click OK . 4.In the initial Permissions for IIS_IUSRS window, a check mark for the Write permission now appears under the Allow column. Verify : Tracing lets you diagnose and troubleshoot Web applications. Failed Request Tracing buffers trace events for a request and only flushes them to disk if the request falls into a user-configured error condition. The failed request tracing feature is a Web Server Role Service that can be installed through Server Manager. If the role service is installed, the Failed Request Tracing Module will be available by default for the Web sites and applications on the server. To create a test trace to verify that the Failed Request Tracing Module is working, see the article Troubleshooting Failed Requests using Tracing in IIS7. To verify that the Failed Request Tracing Module is installed, see the following information in section A. To install the Trace Role Service in Server Manager, see the following information in section B. To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority. A. Verify that the Failed Request Tracing Module is installed To verify that the Failed Request Tracing Module is installed: 1.Click Start , click Control Panel , and then click Administrative Tools . 2.Right-click Internet Information Services (IIS) Manager and select Run as administrator . 3.In the Connections pane, click the + sign by the Web server name to expand the tree beneath. 4.Click the Sites folder. 5.Double-click the name of the Web site for which you want to verify that failed request tracing is installed. The title of the middle pane changes to websitename Home, where websitename is the name of the site that you selected. 6.Under the Feature Name column, double-click the Modules icon. The Modules pane appears with a list of installed modules. 7.Find FailedRequestsTracingModule in the list. If it appears in the list, failed request tracing is available for the site. 8.If the module does not appear in the list, click the server name in the Connections pane , then double-click the Modules icon in Features View . The name FailedRequestsTracingModule should appear in the list. 9.If the module does not appear in the modules list at the server level, you will have to install the Tracing Role Service in Server Manager. B. Install the Tracing Role Service in Server Manager To install the Tracing Role Service in Server Manager: 1.Click Start and select Administrative Tools . 2.Right-click Server Manager and click Run as Administrator . 3.In Server Manager, click Roles . 4.In the Role Service column, find Web Server , then look for Health and Diagnostics . 5.Under Health and Diagnostics , look for Tracing. 6.Look under the Status column for the tracing status. 7.If the tracing status is Not installed , then click Add Role Services . 8.Under Health and Diagnostics , select the Tracing check box. 9.Click Next . 10. Click Install . After several moments, the Installation succeeded message should appear. 11.Click Close to close the Add Role Services window. Note : Installing health and diagnostics tracing in this manner enables support for both ETW tracing and Failed Request Tracing for IIS. |
| Reference Links | Event ID 2289 from Microsoft-Windows-IIS-W3SVC-WP |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.