Very large value for Time-taken in IIS log files

Hi
We are experiencing some problem with IIS 5.0.(slowness in the site) We
have enabled IIS logs. For some request Time-taken value in IIS log file
exceed 60 min mark. Any reason for this ? Also we have noted down in IIS logs
some request duplicating it self with some large value for Time-taken.
This is only happening in one web server, other web server's
response time is very good.

johndoe
Tue Oct 05 03:43:51 CDT 2004

Is this in a web hosting environemnet (e.g. hosting multiple websites)
or an intranet?
Do the long requests happen randomly or maybe there is a pattern. E.g.
Long requests happen on a certain domain, a certain page or when using a
special isapi filter
Do you have PHP installed on the server? If you have php installed and
enabled on the server check your logs to make sure it is not trying to load
a module that does not exist or that it does not have permission to access.


"Prasan" <Prasan@discussions.microsoft.com> wrote in message
news:01DF19E6-D75B-4A6F-85D0-6086D6830126@microsoft.com...
> Hi
> We are experiencing some problem with IIS 5.0.(slowness in the site) We
> have enabled IIS logs. For some request Time-taken value in IIS log file
> exceed 60 min mark. Any reason for this ? Also we have noted down in IIS
> logs
> some request duplicating it self with some large value for Time-taken.
> This is only happening in one web server, other web server's
> response time is very good.
>

Prasan
Tue Oct 05 08:05:03 CDT 2004

Thanks for the reply.
This is web hosting env. It hosts only one web app at the moment. Large
value occur randomly. For example out of 15000 requests 250 requests would
have very large value( more than 30 min) and some rquests are duplicating( we
can see same page have accessed at the same time by the same user/client with
very high time-taken value.). As I mentioned we have two web servers this is
only happenig in one web server. Both servers have same HW/SW. This is a
ASP/COM+ application. Any help??

johndoe
Wed Oct 06 02:42:08 CDT 2004

Well you may have your work cut out for you - Sort of.
If it were me and I had the time to kill i would start off by checking
for file access problems using a free tool called ntfilemon.
http://www.sysinternals.com/ntw2k/source/filemon.shtml
This is a very valuable tool for troubleshooting file access problems. With
a situation where you are not able to replciate the problem scenario this
will take alot longer. ntfilemon has a logging option for this.
Secondly if time is not an option or you are ntfilemon is unable to
reveal anything useful you must begin by comparing the "real" differences
betweenthe setups. I understand you said they are the same but 10+ years of
working with numerous computers and operating systems has taught me that
despite identical installs it is very easily possible for installations to
be different.
Start by comparing
services that are running,
Running processes and applications.
Installed Software, etc
ISAPI filters. (asp/asp.net, caching software, accelerators)

Also restating the obvious but sometimes overlooked it is important to
check the event viewer to see if IIS or the custom COM component is logging
any related messages. if the COM component is a 3rd party component you may
seek both technical support and/or upgrades if they are available




"Prasan" <Prasan@discussions.microsoft.com> wrote in message
news:C37F3D8F-8F8D-4470-AA3E-2AA5480E554B@microsoft.com...
> Thanks for the reply.
> This is web hosting env. It hosts only one web app at the moment. Large
> value occur randomly. For example out of 15000 requests 250 requests would
> have very large value( more than 30 min) and some rquests are
> duplicating( we
> can see same page have accessed at the same time by the same user/client
> with
> very high time-taken value.). As I mentioned we have two web servers this
> is
> only happenig in one web server. Both servers have same HW/SW. This is a
> ASP/COM+ application. Any help??
>

Prasan
Thu Oct 07 09:25:06 CDT 2004

Thanks John for your support.
Actually we found one extra Site Minder ISAPI filter in trubled machine.
we got rid of that, that reduced the no of requests with large values.
Also we suspect Netegrity also playing some roles here. Because sometime
when we login to the site, it takes lot of time to authenticate the user.


"johndoe@driver.net" wrote:

> Well you may have your work cut out for you - Sort of.
> If it were me and I had the time to kill i would start off by checking
> for file access problems using a free tool called ntfilemon.
> http://www.sysinternals.com/ntw2k/source/filemon.shtml
> This is a very valuable tool for troubleshooting file access problems. With
> a situation where you are not able to replciate the problem scenario this
> will take alot longer. ntfilemon has a logging option for this.
> Secondly if time is not an option or you are ntfilemon is unable to
> reveal anything useful you must begin by comparing the "real" differences
> betweenthe setups. I understand you said they are the same but 10+ years of
> working with numerous computers and operating systems has taught me that
> despite identical installs it is very easily possible for installations to
> be different.
> Start by comparing
> services that are running,
> Running processes and applications.
> Installed Software, etc
> ISAPI filters. (asp/asp.net, caching software, accelerators)
>
> Also restating the obvious but sometimes overlooked it is important to
> check the event viewer to see if IIS or the custom COM component is logging
> any related messages. if the COM component is a 3rd party component you may
> seek both technical support and/or upgrades if they are available
>
>
>
>
> "Prasan" <Prasan@discussions.microsoft.com> wrote in message
> news:C37F3D8F-8F8D-4470-AA3E-2AA5480E554B@microsoft.com...
> > Thanks for the reply.
> > This is web hosting env. It hosts only one web app at the moment. Large
> > value occur randomly. For example out of 15000 requests 250 requests would
> > have very large value( more than 30 min) and some rquests are
> > duplicating( we
> > can see same page have accessed at the same time by the same user/client
> > with
> > very high time-taken value.). As I mentioned we have two web servers this
> > is
> > only happenig in one web server. Both servers have same HW/SW. This is a
> > ASP/COM+ application. Any help??
> >
>
>
>

johndoe
Sat Oct 09 10:08:09 CDT 2004

Glad to see you were able to identify and eliminate some of the
problems. Hope you are able to resolve everything


"Prasan" <Prasan@discussions.microsoft.com> wrote in message
news:CE858008-76DB-4185-B31C-F380B8F05A6D@microsoft.com...
> Thanks John for your support.
> Actually we found one extra Site Minder ISAPI filter in trubled machine.
> we got rid of that, that reduced the no of requests with large values.
> Also we suspect Netegrity also playing some roles here. Because sometime
> when we login to the site, it takes lot of time to authenticate the user.
>
>
> "johndoe@driver.net" wrote:
>
>> Well you may have your work cut out for you - Sort of.
>> If it were me and I had the time to kill i would start off by
>> checking
>> for file access problems using a free tool called ntfilemon.
>> http://www.sysinternals.com/ntw2k/source/filemon.shtml
>> This is a very valuable tool for troubleshooting file access problems.
>> With
>> a situation where you are not able to replciate the problem scenario this
>> will take alot longer. ntfilemon has a logging option for this.
>> Secondly if time is not an option or you are ntfilemon is unable to
>> reveal anything useful you must begin by comparing the "real" differences
>> betweenthe setups. I understand you said they are the same but 10+ years
>> of
>> working with numerous computers and operating systems has taught me that
>> despite identical installs it is very easily possible for installations
>> to
>> be different.
>> Start by comparing
>> services that are running,
>> Running processes and applications.
>> Installed Software, etc
>> ISAPI filters. (asp/asp.net, caching software, accelerators)
>>
>> Also restating the obvious but sometimes overlooked it is important
>> to
>> check the event viewer to see if IIS or the custom COM component is
>> logging
>> any related messages. if the COM component is a 3rd party component you
>> may
>> seek both technical support and/or upgrades if they are available
>>
>>
>>
>>
>> "Prasan" <Prasan@discussions.microsoft.com> wrote in message
>> news:C37F3D8F-8F8D-4470-AA3E-2AA5480E554B@microsoft.com...
>> > Thanks for the reply.
>> > This is web hosting env. It hosts only one web app at the moment.
>> > Large
>> > value occur randomly. For example out of 15000 requests 250 requests
>> > would
>> > have very large value( more than 30 min) and some rquests are
>> > duplicating( we
>> > can see same page have accessed at the same time by the same
>> > user/client
>> > with
>> > very high time-taken value.). As I mentioned we have two web servers
>> > this
>> > is
>> > only happenig in one web server. Both servers have same HW/SW. This is
>> > a
>> > ASP/COM+ application. Any help??
>> >
>>
>>
>>