Locating IIS Logs with PowerShell

It has been a while since I last posted here at my blog. Work, holidays that required travelling across a state, getting married and a honeymoon in Cozumel, Mexico have kept me plenty busy during the last month and a half.  But I am back and looking forward to a new post and a new year of learning and working with PowerShell!

This post is going to deal with finding the location of your IIS logs using an advanced function I wrote in response to a Windows PowerShell forum post last year where a user wanted to find a way to list out all of the locations of the log file for each site. While I did not use the IIS PowerShell snap-in to solve this issue, I was able to solve it using the ADSI type and connecting to IIS that way.  This is just one way of working with IIS and other ways include WMI, a snap-in and the IIS provider. Here is a link that deals with using both ADSI and WMI for IIS.

I chose to work with ADSI as it appeared to be the easiest way for me to accomplish what I wanted to do.  The function is pretty simple and just creates a custom object to store the data I need. In this case, the server name, website name and log file location.  This function can be run against 1 or more servers and it will return back the information required, which could be exported out to a CSV file if needed.

One thing I ran into was the script would not return back anything when ran from a Windows 7 workstations.  Turns out I did not have everything loaded that needed to be running thanks to this site.

Here is an example of me running it against a server of mine.


Function Get-IISLogLocation { 
    This function can be ran against a server or multiple servers to locate 
    the log file location for each web site configured in IIS. 
    This function can be ran against a server or multiple servers to locate 
    the log file location for each web site configured in IIS.     
.PARAMETER computer 
    Name of computer to query log file location. 
    Name: Get-IISLogLocation 
    Author: Boe Prox 
    DateCreated: 11Aug2010  
Get-IISLogLocation -computer 'server1' 
This command will list the IIS log location for each website configured on 'Server1' 
    SupportsShouldProcess = $True, 
    DefaultParameterSetName = 'computer', 
    ConfirmImpact = 'low' 
        Mandatory = $False, 
        ParameterSetName = 'computer', 
        ValueFromPipeline = $True)] 
Begin { 
    $report = @() 
Process { 
    ForEach ($c in $Computer) { 
            Write-Verbose "Checking connection on $($c)"
            If (Test-Connection -comp $c -count 1) { 
                Write-Verbose "Making IIS connection to $($c)" 
                $sites = [adsi]"IIS://$c/W3SVC" 
                $children = $sites.children 
                ForEach ($child in $children) { 
                    Write-Verbose "Checking $child.servercomment" 
                    If ($child.KeyType -eq "IIsWebServer") { 
                        Write-Verbose "Found site"
                        $temp = "" | Select Server, WebSite, LogLocation 
                        $temp.Server = $c 
                        $temp.WebSite = $child.ServerComment 
                        $temp.LogLocation = $child.LogFileDirectory                            
                        $report += $temp  
End { 
This entry was posted in powershell, scripts and tagged , , , . Bookmark the permalink.

13 Responses to Locating IIS Logs with PowerShell

  1. John Provencher says:

    This works if IISAdmin is running, but it’s not there by default on IIS7+.

    Is there a way, short of loading applicationhost.config to an xml object, to retrieve the log locations from servers not running IISAdmin?

  2. John Provencher says:

    This only works if IISAdmin (legacy Metabase compatibility) is running, which isn’t running by default on IIS 7.0 and later. The only way I can figure to get the information is to use something like:

    [xml]$web=get-content \server\admin$\system32\inetsrv\config\applicationhost.config
    Then drilling down to $web.configuration.”system.applicationhost”.log.centralw3clogfile (or centralbinarylogfile). Is there an easier way to get the server comment and log location? I use this in a script that collects archived event logs and web logs from all our servers.

  3. Mike says:

    I’m a really new to PS and I’m not getting any output. I’ve made sure WebAdministration and ServerManager Module loaded. Named my file LL.ps1 made the following PS cmd line entries

    PS C:\scripts>. .\LL.ps1
    PS C:\scripts>Get-IISLogLocation -computer myserver

    Please advise

  4. Shahin says:

    Hi Boe Prex
    Could you please give an eksempel what that mean:
    “Make sure you dot source the script to load the function into the current session”

  5. Haythem says:

    I named it listiislogs.ps1 and ran it that way from ps console: \listiislogs.ps1 -computer ‘myserver’ . where myserver is hostname of the server hosting IIS. it doesn’t give any output. Can you advise please ?

  6. Jay says:

    I have a bit of an issue where if I run the command I will get all the information, but if I do .server .website or .loglocation it comes back blank. Running it against “localhost”.

    Also, seems to work just fine on W2k8 Std, but not R2 from my limited testing.

  7. Keith Templin says:

    Have you ever put this together with a IIS log cleanup script that can be scheduled and ran on a local computer? I am upset with IIS7 and still no log management, being a n00b with powershell I need to figure out how to delete each site’s logs if they are older than 30 days without hard coding the paths.


    • Boe Prox says:

      Hi Keith!

      I did something like that at work and will have to locate the code. It isn’t probably exactly what you are looking for but if I have time, I can update it to fit what you are looking for.

  8. David says:

    Thanks. Not only was this a very useful function for me it is nice example of coding that I have learned from.


Leave a Reply to Haythem Cancel reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s