Where IIS Logs Live
By default IIS writes one log folder per site under C:/inetpub/logs/LogFiles, with folder names like W3SVC1 where the number is the site ID shown in IIS Manager. Logs are plain text files in W3C format, one line per request, rotated daily. On busy servers these files grow quickly, so check disk space monthly and archive or delete old logs.
Enable the Fields That Matter
Select the site in IIS Manager, open Logging, and click Select Fields. For performance work, make sure these are ticked:
- time-taken — total milliseconds IIS spent on the request. This is the single most useful field for finding slow pages.
- sc-status and sc-substatus — the response codes, useful for spotting error spikes.
- cs-uri-stem and cs-uri-query — which page and parameters were requested.
- c-ip — the client address, useful for spotting abusive crawlers.
Finding Slow Requests
Open the log in a text editor and look at the last column when time-taken is enabled. Values above 3000 milliseconds deserve attention. For larger logs, use the free Microsoft Log Parser tool to query files with SQL style commands, for example grouping by page and sorting by average time-taken. This quickly shows whether one report page, one API call, or the whole site is slow.
Failed Request Tracing
For deeper analysis, enable Failed Request Tracing on the site and add a rule for requests that take longer than a chosen time. IIS then produces a detailed XML trace showing exactly which module or handler consumed the time, which separates application delays from authentication, compression, or rewrite delays.
Quick Checklist for a Slow Site
- Confirm CPU and RAM headroom in Task Manager.
- Check time-taken values in the logs to find the slow URLs.
- Check database query times for those URLs.
- Review application pool recycling events in Event Viewer.
Share your findings in a support ticket and our team will help you tune the server.
