breaks in IIS log file

[dvprez]

Hello I hope someone here can help me understand this, I'm not much of a server guy. I was looking through my IIS Log file, getting ready to add awstats to my server and there are a lot of breaks in the file. here's a snippet

#Software: Microsoft Internet Information Services 6.0 
#Version: 1.0 
#Date: 2008-06-21 00:16:09 
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status  
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
#Software: Microsoft Internet Information Services 6.0 
#Version: 1.0 
#Date: 2008-06-21 01:47:01 
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status  
Good line was here i deleted it 
#Software: Microsoft Internet Information Services 6.0 
#Version: 1.0 
#Date: 2008-06-21 04:55:00 
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status  
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
Good line was here i deleted it 
#Software: Microsoft Internet Information Services 6.0 
#Version: 1.0 
#Date: 2008-06-21 05:51:22 
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status  

[Staffa]

That's how Windows writes log files.
Each time a visitor arrives it writes the 4 # lines. When there is more than one visitor at the same time their lines are all under the 4 # of the first arrival.

[dvprez]

it keeps adding this part over and over again

#Software: Microsoft Internet Information Services 6.0 
#Version: 1.0 
#Date: 2008-06-21 01:47:01 
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status  

Every few hours or whenever at random. My other webservers don't do that. My other server infact gets over 30,000 unique visitors a day and this line only appears once at the top.I thought that those lines of code appear once at the top and never again.

I'm trying to figure out why it would be appearing multiple times (it has the appropriate time stamp each time) The new server, the one with the problem gets less than 100 visitors per day.

[Staffa]

I notice that there is quite a time span between each block.
My guess is that the server resets the 4 # after a certain time of no activity. It's a guess since you mention that it does not happen on the busy server where there is likely to be a constant flow of visitors.

[bateman_ap]

I have found that occurs when I have restarted the IIS service, is it crashing a lot and needing to restart?

[dvprez]

Like I said I'm not a big server guy but I checked the Application and System logs and I see no sign of a restart. I have also not manually restarted, nor noticed it restart on it's own(but I probably wouldn't since I don't check all the time)

[mrMister]

If your site hasn't had a visitor in a while then IIS shuts down the logging process to save resources. When a new visitor comes, the logging process is restarted and it writes those headers to the bottom of the log and then continues.

This is why you will find those headers more frequently in a site that isn't visited very often.