We had some alerts coming up for an IIS site in Solarwinds which read the value for this 

Win32_PerfFormattedData_W3SVC_WebService(SITECODE)\TotalLockedErrors

And alerted us when above 0. This is a Custom Performance Counter Monitor which uses WMI to get the counter by reading the IIS Log Files.

Per Microsoft Description of the alert : 

Number of requests that could not be satisfied by the server because the requested document was locked (since service startup).Generally reported as HTTP error 423.

There is no other way to find out which files were locked apart from Parsing the IIS Log Files

How to do this?

Download and install these both

https://www.microsoft.com/en-us/download/confirmation.aspx?id=24659

https://techcommunity.microsoft.com/t5/exchange-team-blog/introducing-log-parser-studio/ba-p/601131 -> Click on LPSV2.D2.zip

Once done , open up Studio and insert the IIS Log Files. ( Click here for how to find these ) 

Make sure the Log type is set to IISW3CLOG 

Use the Query below to Query all the 423 Errors

The list you are presented should show you all the files that have been locked which you can inspect and up the threshold if needed or increase the value of this Threshold!

/* All 423 errors to any IIS/.NET Web Service */

SELECT cs-uri-stem as Uri,

sc-status as HttpStatus,

sc-substatus as SubStatus,

sc-win32-status as Win32Status,

COUNT(*) AS Total

FROM ‘[LOGFILEPATH]’

WHERE (sc-status = 423)

GROUP BY Uri, HttpStatus, SubStatus, Win32Status

ORDER BY Total DESC