IISTracer Monitor and IIS6

Read right for the site running IISTracer

IIS6 does not call ISAPI filter notifications for error messages. So you will not see IISTracer interface if you do not enable Read right and Directory browsing allowed right for the IISTracer monitoring URL. IIS shows this error message on IISTracer URL:

       HTTP Error 403.2 - Forbidden: Read access is denied.
      Internet Information Services (IIS)

       To solve this problem please go to IIS MMC, select site you are running IIS Tracer URL, click properties for the site or for iistracer directory, click home directory, check Read right and Directory browsing allowed and click Apply:
       Set directory browsing allowed and read right for IIS folder

Set directory browsing allowed and read right for IIS folder

See also Protect http interface using Username/Password, Client IP and certificates

Special settings for IIS6 - Disable read raw data notification

      IIS 6 does not support SF_NOTIFY_READ_RAW_DATA notification for ISAPI filters. This is main change for IISTracer. You should switch off this notification in IISTracer configuration application. If the READ_RAW_DATA notification is enabled for IISTracer, IISTracer is not loaded to IIS6 and you will see next message in your event log:

       An attempt was made to load filter 'C:\…..\IISTrace.DLL' but it requires the SF_NOTIFY_READ_RAW_DATA filter notification and this notification is not supported in Worker Process Isolation Mode. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

      To disable this notification, please go to Configuration application - basic setup and install filter to IIS, check "Disable read raw data notification", click Apply and restart W3SVC service.

Disable read raw data notification for IISTracer ISAPI filter

IISTracer and several application pools.

IIsTracer monitors and logs all application pool in IIS6, but works separatelly for each application pool. You can see only requests in the same application pool as the IISTracer interface is.

If you have more application pools, you can prepare environment to see requests in other pools.
      1. Create a IIS folder named as your IISTracer inteface (/iistracer) in IIS MMC
       - set 'directory browsing allowed' for the folder
       - set appropriate security for the folder to access IISTracer interface (IP address, authentication method, etc., see Protect http interface using Username/Password, Client IP and certificates)

      2. Create a subfolder under this folder named as the application pool you want to see (/iistracer/defaultpool/)
       - right click properties for the folder in IIS MMC, click 'Create application' and select application pool you want to see in IISTracer interface

      3. Go to http://yourserver/iistracer/defaultpool/

      4. Create next subfolders under this folder for other app pools you want to see (/iistracer/secondpool/, /iistracer/otherpool/)
       - right click properties for each of the folder in IIS MMC, click 'Create application' and selet application pool you want to see in IISTracer interface for appropriate URLs.

      5. Go to http://yourserver/iistracer/secondpool/

IIS6 sometimes does not load ISAPI filters by default. So the IISTracer ISAPI filter state can be 'Unknown" in IIS6 and the filter is loaded by IIS if you try any URL on your server.