IIS Performance Counter – Total Locked Errors – How to detect locked files

solarwinds-inc-logo[1]We had some alerts coming up for an IIS site in Solarwinds which read the value for this 


Win32_PerfFormattedData_W3SVC_WebService(SITECODE)\TotalLockedErrors

And alerted us when above 0. This is a Custom Performance Counter Monitor which uses WMI to get the counter by reading the IIS Log Files.

Per Microsoft Description of the alert : 

Number of requests that could not be satisfied by the server because the requested document was locked (since service startup).Generally reported as HTTP error 423.

There is no other way to find out which files were locked apart from Parsing the IIS Log Files

How to do this?

Download and install these both

https://www.microsoft.com/en-us/download/confirmation.aspx?id=24659

https://blogs.msdn.microsoft.com/friis/2014/02/06/how-to-analyse-iis-logs-using-logparser-logparser-studio/

Once done , open up Studio and insert the IIS Log Files. ( Click here for how to find these

Make sure the Log type is set to IISW3CLOG 

Use the Query below to Query all the 423 Errors

The list you are presented should show you all the files that have been locked which you can inspect and up the threshold if needed or increase the value of this Threshold!

 

/* All 423 errors to any IIS/.NET Web Service */
 
SELECT cs-uri-stem as Uri,
 
sc-status as HttpStatus,
 
sc-substatus as SubStatus,
 
sc-win32-status as Win32Status,
 
       COUNT(*) AS Total
 
FROM '[LOGFILEPATH]'
 
WHERE (sc-status = 423)
 
GROUP BY Uri, HttpStatus, SubStatus, Win32Status
 
ORDER BY Total DESC

 

1 Star2 Stars3 Stars4 Stars5 Stars (2 votes, average: 5.50 out of 5)
Loading...