How to Find App Pool Recycles in Event Log
I have configured an app pool in IIS 7.5 to recycle when the memory usage goes above a certain level. I have also configured it to log this information.
Where in the event log should I look for this?
I have tried filtering based on the source being all the IIS items, e.g. 'IIS-W3SVC-WP', 'IIS-IISManager', and all the rest, but nothing.
I can see that it is adding in the items from the 'IIS-Configuration' log too which I enabled. But still nothing.
It seemed quite hard to find this information, but eventually, I came across this question
You have to look at the 'System' event log, and filter by the WAS source.
Here is more info about the WAS (Windows Process Activation Service)
As it seems impossible to filter the XPath message data (it isn't in the XML to filter), you can also use powershell to search:
Get-WinEvent -LogName System | Where-Object {$_.Message -like "*recycle*"}
From this, I can see that the event Id for recycling seems to be 5074, so you can filter on this as well. I hope this helps someone as this information seemed to take a lot longer than expected to work out.
This along with @BlackHawkDesign comment should help you find what you need.
I had the same issue. Maybe interesting to mention is that you have to configure in which cases the app pool recycle event is logged. By default it's in a couple of cases, not all of them. You can do that in IIS > app pools > select the app pool > advanced settings > expand generate recycle event log entry – BlackHawkDesign Jan 14 '15 at 10:00
As link-only answers are not preferred, I will just copy and paste the content of the link of the accepted answer
It is definitely System Log.
Which Log file? Well -- you can check the physical path by right-clicking on the System Log (e.g. Server Manager | Diagnostics | Event Viewer | Windows Logs). The default physical path is %SystemRoot%\System32\Winevt\Logs\System.evtx.
You can create a Custom Filter and filter by "Source: WAS" to quickly see only entries generated by IIS.
You may need first to enable logging of such even for a specific App Pool -- by default App Pool has only 3 recycle events out of 8 enabled. To change it using GUI: II S Manager | Application Pools | Select App Pool -> Advanced Settings | Generate Recycle Event Log Entry.
IIS version 8.5 +
To enable Event Tracing for Windows for your website/application
- Go to Logging and ensure either ETW event only or Both log file and ETW event ...is selected.
- Enable the desired Recycle logs in the Advanced Settings for the Application Pool:
- Go to the default Custom View: WebServer filters IIS logs:
Custom Views > ServerRoles > Web Server
- ... or System logs:
Windows Logs > System