Monitoring

Setup Logs
Microsoft Proxy Server Logs
Windows NT Logs
Performance Monitor Counters
SNMP MIBs

Setup Logs

The Server Setup Log
The Client Setup Log

The Server Setup Log

The Microsoft Proxy Server Setup program creates a log file, C:\Mpssetup.log. Customers calling Microsoft for assistance should have this file available when calling. It contains valuable information beyond any error messages that are displayed to the user.

The Setup log is overwritten each time Microsoft Proxy Server is installed.

Following is an example of a Microsoft Proxy Server Setup log:

Microsoft Proxy Server Setup Log
--------------------------------

MSP Setup: VerifyServerCondition camf=0 ois=0 or=1110 DstDir=NULL
MSP Setup: NT build 1381
MSP Setup: open file C:\WINNT\System32\w3pmon.dll returned 2
MSP Setup: VerifyServerCondition returnd OK!!! camf=0 ois=0 or=1110 DstDir=NULL
MSP Setup: FindVirtualRoot camf=10 ois=0 or=1120 DstDir=NULL
MSP Setup: FindVirtualRoot returnd OK!!! camf=10 ois=0 or=1120 DstDir=C:\InetPub\scripts\
MSP Setup: FindGibraltarDir camf=10 ois=0 or=4010 DstDir=NULL
MSP Setup: FindGibraltarDir returnd OK!!! camf=10 ois=0 or=4010 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: FindVirtualRoot camf=10 ois=0 or=1120 DstDir=C:\InetPub\scripts\
MSP Setup: FindVirtualRoot returnd OK!!! camf=10 ois=0 or=1120 DstDir=C:\InetPub\scripts\
MSP Setup: FindGibraltarDir camf=10 ois=0 or=4010 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: FindGibraltarDir returnd OK!!! camf=10 ois=0 or=4010 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: NetStop camf=15 ois=4 or=1130 DstDir=C:\msp\
MSP Setup: NetStoping wspsrv
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1130 DstDir=C:\msp\
MSP Setup: NetStop camf=15 ois=4 or=1140 DstDir=C:\msp\
MSP Setup: NetStoping w3svc
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1140 DstDir=C:\msp\
MSP Setup: NetStop camf=15 ois=4 or=1150 DstDir=C:\msp\
MSP Setup: NetStoping mspadmin
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1150 DstDir=C:\msp\
MSP Setup: NetStop camf=15 ois=4 or=1160 DstDir=C:\msp\
MSP Setup: NetStoping snmp
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1160 DstDir=C:\msp\
MSP Setup: SetCacheDir camf=15 ois=4 or=1170 DstDir=C:\msp\
MSP Setup: SetCacheDir returnd OK!!! camf=15 ois=4 or=1170 DstDir=C:\msp\
MSP Setup: SetNetConfig camf=15 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: SetNetConfig returnd OK!!! camf=15 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: NetShare camf=15 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: Net stop Sharing mspclnt
MSP Setup: NetShare returnd OK!!! camf=15 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: SetNetConfig camf=22 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: SetNetConfig returnd OK!!! camf=22 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: CreateLink camf=22 ois=4 or=1400 DstDir=C:\msp\
MSP Setup: CreateLink - szData is msp.pmc
MSP Setup: CreateLink returnd OK!!! camf=22 ois=4 or=1400 DstDir=C:\msp\
MSP Setup: CreateLink camf=22 ois=4 or=4050 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: CreateLink - szData is inetmgr.exe
MSP Setup: CreateLink returnd OK!!! camf=22 ois=4 or=4050 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: CreateLink camf=22 ois=4 or=5020 DstDir=C:\msp\docs\
MSP Setup: CreateLink - szData is toc_msp.htm
MSP Setup: CreateLink returnd OK!!! camf=22 ois=4 or=5020 DstDir=C:\msp\docs\
MSP Setup: AddVirtualIISRoot camf=22 ois=4 or=5030 DstDir=C:\msp\docs\
MSP Setup: AddInetmgrHelpAddOn camf=22 ois=4 or=5040 DstDir=C:\msp\docs\
MSP Setup: SetMspRegistry camf=24 ois=4 or=1230 DstDir=C:\msp\
MSP Setup: did not find snmp root registry
MSP Setup: InstallWspService returnd OK!!! camf=24 ois=4 or=1230 DstDir=C:\msp\
MSP Setup: NetShare camf=24 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: NetShare returnd OK!!! camf=24 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: InstallWspService camf=24 ois=4 or=1260 DstDir=C:\msp\
MSP Setup: InstallWspService returnd OK!!! camf=24 ois=4 or=1260 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1270 DstDir=C:\msp\
MSP Setup: NetStarting w3svc
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1270 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1280 DstDir=C:\msp\
MSP Setup: NetStarting wspsrv
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1280 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1290 DstDir=C:\msp\
MSP Setup: NetStarting mspadmin
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1290 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1300 DstDir=C:\msp\
MSP Setup: NetStarting snmp
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1300 DstDir=C:\msp\
MSP Setup: InstPerfmon camf=24 ois=4 or=3221 DstDir=C:\msp\
MSP Setup: InstPerfmon returnd OK!!! camf=24 ois=4 or=3221 DstDir=C:\msp\

The Client Setup Log

The client Setup program creates a log file, Mpcsetup.log, and places it in the root directory of the client computer’s hard disk. Customers calling Microsoft for assistance should have this file available when calling. It contains valuable information beyond any error messages that are displayed to the user.

The client Setup log is overwritten each time the client software is installed. Following is an example of a client Setup log:

Microsoft Proxy Server Setup Log
--------------------------------

MSP Setup: IsWinsockInWinDir camf=1 ois=0 or=90 DstDir=NULL
MSP Setup: winsock found in windir=1 in sysdir=0
MSP Setup: IsWinsockInWinDir returned DEFAULT!!! camf=1 ois=0 or=90 DstDir=NULL
MSP Setup: CheckFixInconsistency camf=0 ois=0 or=600 DstDir=NULL
MSP Setup: cleaning temp files
MSP Setup: IsCurrentDllRwsWin95_16 returned 1 result=1
MSP Setup: cleaning temp files
MSP Setup: wsock32.dll - Description: Microsoft Remote Windows Socket 32-Bit DLL
MSP Setup: wsock32.dll IsCurrentDllRws = yes
MSP Setup: CheckFixInconsistency returnd OK!!! camf=0 ois=0 or=600 DstDir=NULL
MSP Setup: IsWinsockInWinDir camf=13 ois=0 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir returnd OK!!! camf=13 ois=2 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir camf=13 ois=2 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir returnd OK!!! camf=13 ois=4 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir camf=5 ois=4 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir returnd OK!!! camf=5 ois=4 or=90 DstDir=NULL
MSP Setup: CheckWinsockApps camf=15 ois=4 or=700 DstDir=C:\mspclnt\
MSP Setup: CheckWinsockApps returned DEFAULT!!! camf=15 ois=4 or=700 DstDir=C:\mspclnt\
MSP Setup: CheckFixInconsistency camf=24 ois=4 or=600 DstDir=C:\mspclnt\
MSP Setup: warning - RemoveBeta2Wsock Delete file returned 2
MSP Setup: CheckFixInconsistency returned DEFAULT!!! camf=24 ois=4 or=600 DstDir=C:\mspclnt\
MSP Setup: SetReg camf=24 ois=4 or=800 DstDir=C:\mspclnt\
MSP Setup: SetReg returnd OK!!! camf=24 ois=4 or=800 DstDir=C:\mspclnt\
MSP Setup: SwithWsockdll camf=24 ois=4 or=1000 DstDir=C:\mspclnt\
MSP Setup: wsock32.dll - Description: Microsoft Remote Windows Socket 32-Bit DLL
MSP Setup: wsock32.dll IsCurrentDllRws = yes
MSP Setup: rws32.dll Version=1.0.163.2
MSP Setup: wsock32.dll Version=1.0.157.2
MSP Setup: HigherVersion rws32.dll = yes
MSP Setup: call _mktemp with __XXXXXX
MSP Setup: Added for post-reboot list : rename wsock32.dll to __a53287.tmp
MSP Setup: Added for post-reboot list : rename rws32.dll to wsock32.dll
MSP Setup: IsWinsock16Loaded_w95 returned 1 result=0
MSP Setup: LazyRename=0
MSP Setup: IsCurrentDllRwsWin95_16 returned 1 result=1
MSP Setup: rws.dll Version=1.0.163.2
MSP Setup: winsock.dll Version=1.0.157.2
MSP Setup: HigherVersion rws.dll = yes
MSP Setup: call _mktemp with __XXXXXX
MSP Setup: succeeded - rename winsock.dll To __a53287.tmp
MSP Setup: succeeded - rename rws.dll To winsock.dll
MSP Setup: SwitchWsockDll returnd OK!!! camf=24 ois=4 or=1000 DstDir=C:\mspclnt\

Microsoft Proxy Server Logs

Logging Overview
Logging to a File
Logging to a Database
Log Fields
Logging Issues

Logging Overview

Microsoft Proxy Server supports logging for the Web Proxy and WinSock Proxy services. You can log to:

A comma-delimited text file.
A table in an ODBC-compliant database, such as Microsoft SQL Server version 6.5 or Microsoft Access 7.0.

Logging can be configured separately for each of the two service logs, which are:

WinSock Proxy service log This file contains connection-specific log information for redirected Windows Sockets-based connections.

Note Entries to the WinSock Proxy service log appear under the source name of WinSockProxyLog in the Windows NT system log.
Web Proxy service log This file contains connection-specific log information for proxy connections between the Microsoft Proxy Server and its Web Proxy clients.

Note Entries to the Web Proxy service log appear under the source name of WebProxyLog in the Windows NT system log.

Note See Windows NT Logs later in this chapter for source names of all event types that can be logged.

The available logging options for each service include support for two log formats:

Regular Logging For smaller log sizes, this format supports a reduced number of information fields for log entries. Fields not supported are denoted with a hyphen (-).
Verbose Logging For a fuller level of detail in logging, all available information for each service is logged. Selecting this format increases the size of log files and requires more disk space for logging.

If you are uncertain about which format to use, you can use the following general guidelines:

If available disk space is limited on the volume assigned for logging, consider using the regular logging format.
If disk space is not limited or is not an issue, or you are planning to log service information to a database for further analysis, consider using the verbose logging format for the full reporting.

Tip Turn off Internet Information Server (IIS) logging when Web Proxy service logging is enabled. The IIS log is a subset of the information stored in the Web Proxy service log, so you can improve performance by turning off IIS logging. To turn off IIS logging, use Internet Service Manager to open the Logging property sheet for the WWW service. Clear the Enable Logging check box.

Logging to a File

Microsoft Proxy Server can log to comma-delimited text files (ASCII files), or to a table in an ODBC-compliant database (such as Microsoft SQL Server or Microsoft Access). This section discusses the location and other format conventions used for text file logs.

When logging to a text file, log fields are separated by the use of a single comma (,). If you are using a parsing tool to parse text file logs into database format, each comma in a log file entry should be used to force a field break to occur.

The default locations when logging to a text file are:

C:\Winnt\System32\W3plogs\Filename.log for Web Proxy service
C:\Winnt\System32\Wsplogs\Filename.log for WinSock Proxy service

The name given to text-file logs depends on how logging is configured. Logging can be configured to create a new log each day, week, month, or when the current log file reaches a specified size.

The Web Proxy service text file logs take the following form:

Daily logs are named W3yymmdd.log
Weekly logs are named W3Wyymmw.log
Monthly logs are named W3Myymm.log
Logs based on file size are named W3Bnnnn.log

The WinSock Proxy service text file logs take the following form:

Daily logs are named WSyymmdd.log
Weekly logs are named WSWyymmw.log
Monthly logs are named WSMyymm.log
Logs based on file size are named WSBnnnn.log

Where:

yy is a number between 00 and 99 indicating the year.
mm is a number between 01 and 12 indicating the month.
dd is a number between 01 and 31 indicating the day of the month.
w is a number between 1 and 5 indicating the week of the month.
nnnn is a number that increments with each new log that is opened.

To log to a text file and set the logging parameters

From Internet Service Manager, double-click the computer name next to the WinSock Proxy or Web Proxy service, and then click the Logging tab.
Make sure the Enable Logging option is selected.
Select either Regular Logging or Verbose Logging.

Regular logging records only a subset of all available information for each Internet access. This option reduces the disk space needed for a log file. Verbose logging records all available information for each Internet access.
Make sure the Log to File option is selected.
Select or clear the Automatically open new log option.

Select this option to periodically create a new log file, using the interval specified by the Daily, Weekly, Monthly, or When File Size Reaches options. When a new log file is started, the old log file is closed (and can optionally be archived on other storage media).

Clear this option to use the same log file continuously.
If you select the Automatically Open New Log option, specify the interval used to determine when to open a new log file. Select Daily, Weekly, Monthly, or When File Size Reaches. If you select When File Size Reaches, also enter a value for maximum allowed file size in the MB box.
Review, and if appropriate, change the log file directory.

To change this location, type a new path in the Log File Directory box, or click Browse and complete the dialog box that appears. It is possible to log to a local or remote drive, but in general it is recommended that you store your log file on a local disk.

Note To help prevent the disk from filling up, it is a good idea to store the logs and the Web Proxy cache on different volumes.
Click OK.

The log settings are saved.

Logging to a Database

Database Logging Overview
Installing ODBC Drivers
Defining a System Data Source Name
Setting Up Database Tables
Configuring the Service to Log to a Database

Database Logging Overview

When you install Microsoft Proxy Server, logging to a file is the default logging method. If you prefer to save logs in a database, you can configure the Web Proxy and WinSock Proxy services to do so.

Logging to any Open Database Connectivity (ODBC) version 2.5-compliant database, such as Microsoft SQL Server version 6.5 or Microsoft Access 7.0, is possible with Microsoft Proxy Server. ODBC is a standard API used for generic cross-platform connectivity across Windows-based database platforms. It is designed to be a general-purpose Call-Level Interface (CLI) for any database, including nonrelational Database Management Systems (DBMS). Microsoft Proxy Server supports ODBC for logging service information to databases.

Database logging increases the amount of time and resources needed by Microsoft Proxy Server to service Internet requests. Therefore, if your site has heavy Internet traffic, you should consider logging to a file to maximize performance.

The following procedure describes the basic steps for setting up logging to an ODBC-compliant database.

To prepare a SQL/ODBC database for Microsoft Proxy Server service logging

Install the database.
If you are using either Microsoft SQL Server or Microsoft Access for your preferred database, refer to your product documentation for more information on installation procedures.
Install the ODBC driver for the database you are using.
For more information, see Installing ODBC Drivers, later in this chapter.
Create a system Data Source Name (system DSN) for the database.
For more information, see Defining a System Data Source Name, later in this chapter.
Create a table in your database application with the necessary fields. Table elements, such as data types and field names, must be defined appropriately for the database application you are using.
For more information on specific database table formats for Microsoft SQL or Microsoft Access databases and tools for creating a table for service logging, see Setting Up Database Tables, later in this chapter.
Enable database logging using Internet Service Manager for each Microsoft Proxy Server service that will be using database logging. For more information on enabling service logging, see Configuring the Service to Log to a Database, later in this chapter.

Note Before configuring a server to log to a Microsoft Access database, be sure to check the latest information posted on the Microsoft Proxy Server home page on the Internet, at http://www.microsoft.com/proxy/. This site provides important information you need to know in order to configure Microsoft Proxy Server to log to a Microsoft Access database.

Installing ODBC Drivers

An ODBC driver must be installed before using ODBC logging options with Microsoft Proxy Server. ODBC drivers must be ODBC version 2.5 components. This version of ODBC supports system Data Source Names (DSNs), which allows Windows NT services to use ODBC.

To install the ODBC drivers

If an ODBC Driver is not already installed, run Internet Information Server Setup again from the Microsoft Internet Server program group. You will need to have access to the Windows NT Server compact disc, or to a network installation directory containing the complete contents of the compact disc.
Click the OK button.
Click the Add/Remove button.
Click the OK button.
Select the ODBC Drivers and Administration option.
Click the OK button. The Install Drivers dialog box appears.
To install the SQL Server driver, select the SQL Server driver from the Available ODBC Drivers list box.
Click the OK button. Setup will complete copying the necessary files.

Note Use Microsoft Access to install the Microsoft Access ODBC driver. To log to an Access database, Microsoft Proxy Server requires the 32-bit ODBC drivers shipped with Microsoft® Office95 and Microsoft® Access95. The ODBC driver for Microsoft Access 2.0 will not work with Microsoft Proxy Server.

Once ODBC drivers have been installed, you can use them to create and set system DSNs. For more information, see Defining a System Data Source Name later in this chapter.

Defining a System Data Source Name

The system DSN is a logical name used by ODBC to refer to the driver and any other information required to access the data, such as the name of the server where the database is located. Once the ODBC driver for your database is installed, a system DSN must be added for database logging.

When adding a DSN for your database, choose a unique name that is not likely to be repeated elsewhere in configuring the database. Avoid any types of names that could be repeated or assigned for database users. You may also use the default DSN, “Proxy Server SQL.” Also, the DSN you decide to use will need to match the DSN setting in the SQL or Access database to be used for logging.

For Microsoft SQL Server, the server name, network address, and network library displayed in this dialog box are specific to your installation. You must enter a server name, but if you do not know what to enter in the network address and network library fields you can accept the defaults.

To set a system Data Source Name

From the desktop of the server, click the Start button. Select Settings and click Control Panel.
Double-click the ODBC icon.
The ODBC Data Sources dialog box appears.
Click the System DSN button.

Important Be sure to click the System DSN button. Logging to a database will only work with system DSNs.

The System Data Sources dialog box appears.
Click the Add button.
The Add Data Source dialog box appears. The installed ODBC drivers are listed.
Select an ODBC driver and click OK. A dialog box specific to your driver appears.
Enter the Data Source Name and configure the DSN parameters.
Use a unique name for the DSN. For Microsoft SQL Server, the server name, network address, and network library displayed in this dialog box are specific to your installation. You must enter a server name, but if you do not know what to enter in the network address and network library fields you can accept the defaults. For Microsoft Access, the system DSN is the file name of the database. For example, if the Microsoft Access database you are logging to is named Proxylog.mdb, the system DSN would be Proxylog.
Click the Option button and specify a database name in the Database Name field.
Click OK.
The System Data Sources dialog box returns, with the new system data source name added.
Click Close, then click Close again.
The System Data Sources dialog box returns.
Click Close.

Setting Up Database Tables

Using the SQL Logging Table Tool
Microsoft SQL Server Table Format
Microsoft Access Table Format

Using the SQL Logging Table Tool

When installed, Microsoft Proxy Server provides an additional form-based tool that can be used to generate a single Microsoft SQL table with the required field names, data type, and field length settings (as described in Microsoft SQL Server Table Format below).

Note The same table format is used for regular and verbose logging formats. When regular logging format is selected, some fields are not used and will remain empty.

The SQL logging table tool, Mkplog.exe, should be executed as a URL from within a Web browser application on the same computer used for Microsoft SQL Server. Mkplog.exe is located in the IIS scripts directory (C:\Inetpub\Scripts\Tools) on the computer running Microsoft Proxy Server.

To create a table for logging with Microsoft Proxy Server by using Mkplog.exe

Open the Web browser application, such as Internet Explorer, on the computer running Microsoft SQL Server. This computer must be located on the same internal network segment as the computer running Microsoft Proxy Server.
Enter the correct URL to retrieve and load the form-based tool page in your browser. For example, if the server name for your Microsoft Proxy Server computer were Myproxyserver, you would type the URL as http://myproxyserver/scripts/tools/mkplog.exe.
Follow the on-screen instructions.

Note Mkplog.exe will work only for Microsoft SQL Server databases. Microsoft® Access tables must be created manually for use with logging.

Microsoft SQL Server Table Format

For a Microsoft SQL Server database table to be used for the WinSock Proxy or Web Proxy service log, refer to the following table when defining the required fields and data types.

SQL Table Structure

Field name	Data type	Length
ClientIP	varchar	50
ClientUserName	varchar	50
ClientAgent	varchar	100
ClientAuthenticate	char	5
logTime	datetime	—
service	varchar	25
servername	varchar	50
referredserver	varchar	100
DestHost	varchar	255
DestHostIP	varchar	50
DestHostPort	int	—
processingtime	int	—
bytessent	int	—
bytesrecvd	int	—
protocol	varchar	25
transport	varchar	25
operation	varchar	255
uri	varchar	255
mimetype	varchar	25
objectsource	varchar	25
resultcode	int	—

Microsoft Access Table Format

For a Microsoft Access database table to be used for the WinSock Proxy or Web Proxy service log, refer to the following table when defining the required fields and data types.

Microsoft Access Table Structure

Field name	Data type	Length
ClientIP	text	50
ClientUserName	text	50
ClientAgent	text	100
ClientAuthenticate	text	5
logTime	datetime	—
service	text	25
servername	text	50
referredserver	text	100
DestHost	text	255
DestHostIP	text	50
DestHostPort	Long Integer	—
processingtime	Long Integer	—
bytessent	Long Integer	—
bytesrecvd	Long Integer	—
protocol	text	25
transport	text	25
operation	text	255
uri	text	255
mimetype	text	25
objectsource	text	25
resultcode	Long Integer	—

Configuring the Service to Log to a Database

To enable the service to log to a database

From Internet Service Manager, double-click the computer name next to the WinSock Proxy or Web Proxy service, then click the Logging tab.
Select the Enable Logging check box.
Select either Regular Logging (to record only a subset of the available information) or Verbose Logging (to record all available information).
Select Log to SQL/ODBC Database.
In the ODBC Data Source Name (DSN) box, type the exact system DSN that you created for the database that you will be logging to.
In the Table field, type the name of the table that you will be logging to.
In the User Name and Password fields, type a user name and password that is valid for that database and table.
Click Apply, then click OK.

For more information about the Web Proxy and WinSock Proxy service logs, see “Configuring the Web Proxy service,” and “Configuring the WinSock Proxy Service.” For more information about Event Viewer and the Application and System logs, see your documentation for Windows NT.

Log Fields

Log Field Summary
Client Information Fields
Server Information Fields
Connection Information Fields
Object Information Fields

Log Field Summary

The Web Proxy and WinSock Proxy service logs contain information related to the following areas:

Client Information
Server Information
Connection Information
Object Information

When verbose logging is selected, the following fields appear in log entries:

Client Computer Name
Client User Name
Client Agent
Client Platform
Authentication Status
Log Date
Log Time
Service Name
Proxy Name
Referring Server Name
Destination Name
Destination Address
Destination Port
Processing Time
Bytes Sent
Bytes Received
Protocol Name
Transport
Operation
Object Name
Object MIME
Object Source
Result Code

When regular logging is selected, only the following elements appear in log entries:

Client Computer Name
Client User Name
Authentication Status
Log Date
Log Time
Service Name
Destination Name
Destination Port
Protocol Name
Object Name
Object Source
Result Code

Client Information Fields

Client Computer Name

Typically, this is the network IP address for the client computer initiating a Web Proxy or WinSock Proxy request. In cases where active caching is occurring, this field is the IP address for the computer running Microsoft Proxy Server.

Client User Name

The Windows NT logon account name for the current user on the client computer initiating the Web Proxy or WinSock Proxy request.

Client Agent

For the Web Proxy service, indicates specialized header information from the client browser to use when processing the proxy request.

For the WinSock Proxy service, indicates the name of the client application that is generating the Windows Socket process request.

Client Platform

For the Web Proxy service, this field is not used.

For the WinSock Proxy service, indicates the client operating system, as shown in the following table:

Field Entry Client Operating System

0:3.1 Windows 3.1

0:3.11 Windows for Workgroups

0:3.95 Windows 95 (16-bit)

1:3.11 Win32s

2:4.0 Windows 95 (32-bit)

3:3.51 Windows NT 3.51

3:4.0 Windows NT 4.0

Field Entry	Client Operating System
0:3.1	Windows 3.1
0:3.11	Windows for Workgroups
0:3.95	Windows 95 (16-bit)
1:3.11	Win32s
2:4.0	Windows 95 (32-bit)
3:3.51	Windows NT 3.51
3:4.0	Windows NT 4.0

Authentication Status

This indicates whether or not the Web Proxy or WinSock Proxy request is using an authenticated connection to the Microsoft Proxy Server.

Server Information Fields

Log Date

The date on Microsoft Proxy Server when the logged event occurred.

Log Time

The time on Microsoft Proxy Server when the logged event occurred.

Service Name

The name of the active service being logged. In verbose logging, “W3Proxy” indicates Web Proxy service logging, or “WSProxy” indicates WinSock Proxy service logging.

In regular logging, this field uses numbers. A value of “1” indicates Web Proxy service logging; a value of “2” indicates WinSock Proxy service logging.

Proxy Name

The name of the computer running Microsoft Proxy Server. This is the name assigned in Windows NT 4.0 Server for the computer.

Referring Server Name

The name of a downstream Microsoft Proxy Server that referred the proxy request to the current Microsoft Proxy Server. This field is not used in the current version of Microsoft Proxy Server and is reserved for later versions which will include support for cascading (multiple) proxy servers.

Connection Information Fields

Destination Name

The domain name for the remote computer servicing the current Web Proxy or WinSock Proxy connection. For Web Proxy service, a hyphen (-) in this field may indicate that an object was sourced from the Web Proxy Server cache and not from the destination. (One exception is negative caching. In that case, this field will indicate a destination name for which a negative cached object was returned.)

Destination Address

The network IP address for the remote computer servicing the current Web Proxy or WinSock Proxy connection. For Web Proxy service, a hyphen (-) in this field may indicate that an object was sourced from the Web Proxy Server cache and not from the destination. (One exception is negative caching. In that case, this field will indicate a destination IP address for which a negative cached object was returned.)

Destination Port

The reserved port number on the remote computer servicing the current Web Proxy or WinSock Proxy connection. This is used by the client application initiating the request.

Processing Time

This indicates the total time in milliseconds needed by Microsoft Proxy Server to process the current Web Proxy or WinSock Proxy connection. It measures elapsed server time from when the server first received the request to the time when final processing occurred on the server (results were returned to client and connection closed).

Note For cache requests processed through the Web Proxy service, processing time measures the elapsed server time needed to fully process a client request and return an object from the server’s cache to the client.

Bytes Sent

For the Web Proxy service, the number of bytes sent to the remote computer during the current connection. The use of a hyphen (-) or the use of a zero or negative number in this field indicates that this information was not provided by the remote computer, or that no bytes were sent to the remote computer.

The WinSock Proxy service does not enter data in this field.

Bytes Received

For the Web Proxy service, the number of bytes received from the remote computer during the current connection. The use of a hyphen (-) or the use of a zero or negative number in this field indicates that this information was not provided by the remote computer, or that no bytes were received from the remote computer.

The WinSock Proxy service does not enter data in this field.

Protocol Name

For the Web Proxy service, specifies the protocol used for transfer (such as HTTP, FTP, or Gopher).
For the WinSock Proxy service, specifies a well-known destination port number for the socketed application (such as port 1070 for RealAudio).

Transport

For the Web Proxy Service, specifies the transport protocol. For the Web Proxy service, this is always TCP.
For the WinSock Proxy service, specifies the transport protocol. For the WinSock Proxy service, this can be TCP, UDP, or IPX/SPX.

Operation

For the Web Proxy service, specifies the current HTTP method used. Possible values can include GET, PUT, POST, and HEAD.
For the WinSock Proxy service, specifies the current socket API call in use. Possible values can include Connect, Accept, SendTo, RecvFrom, GetHostByName.

Object Information Fields

Object Name

For the Web Proxy service, this field shows the contents of the URL request.
For the WinSock Proxy service, this field is not used.

Object MIME

For the Web Proxy service, the Multi-purpose Internet Mail Extensions (MIME) type for the current object. The following table provides a partial listing of MIME types supported by most Web browsers. This field may also be filled with a hyphen (-) to indicate that this field is not used, or that a valid MIME type was not defined or supported by the remote computer.

MIME Type Description

application/x-msdownload Application (executable).

image/gif GIF image file.

image/jpeg JPEG image file.

multipart/x-zip PKZIP archive file.

text/plain Plain text file.

MIME Type	Description
application/x-msdownload	Application (executable).
image/gif	GIF image file.
image/jpeg	JPEG image file.
multipart/x-zip	PKZIP archive file.
text/plain	Plain text file.

For the WinSock Proxy service, this field is not used.

Object Source

For the Web Proxy service, indicates the source used to retrieve the current object, as shown in the following table:

Source Values Source

Unknown No source information available.

Cache Source is cache. Object returned from cache.

RCache Source is Internet. Object added to cache.

VCache Source is cache. Object was verified to source and passed.

NVCache Source is cache. Object could not be verified to source.

VFInet Source is Internet. Cached object was verified to source and failed.

PragNoCacheInet Source is Internet. HTTP header field indicated “Do not cache.”

Inet Source is Internet. Object not cached.

Source Values	Source
Unknown	No source information available.
Cache	Source is cache. Object returned from cache.
RCache	Source is Internet. Object added to cache.
VCache	Source is cache. Object was verified to source and passed.
NVCache	Source is cache. Object could not be verified to source.
VFInet	Source is Internet. Cached object was verified to source and failed.
PragNoCacheInet	Source is Internet. HTTP header field indicated “Do not cache.”
Inet	Source is Internet. Object not cached.

For the WinSock Proxy service, this field is not used.

Result Code

For the Web Proxy service, this field can be used to indicate either a Windows error code (for values less than 100), an HTTP status code (values between 100 and 1000), or a Wininet or WinSock error code value (for values over 10000). A partial listing of some of the supported values for this field is listed below. For more information on other values, contact your technical support provider or see Microsoft TechNet for more information on specific values not listed here.

Values Description

200 Successful connection

10060 Connection timed out.

10061 Connection refused by destination.

10065 Host unreachable.

11001 Host not found.

For the WinSock Proxy service, this field indicates status information about the connection as shown in the following table:

Source Values Source

0 Successful connection.

1 Server failure.

2 Rejection by proxy (filtering).

3 Network unreachable (no DNS service available).

4 Host unreachable (no DNS entry for host).

5 Connection refused by destination.

6 Unsupported client request.

7 Unsupported address type.

Values	Description
200	Successful connection
10060	Connection timed out.
10061	Connection refused by destination.
10065	Host unreachable.
11001	Host not found.

Source Values	Source
0	Successful connection.
1	Server failure.
2	Rejection by proxy (filtering).
3	Network unreachable (no DNS service available).
4	Host unreachable (no DNS entry for host).
5	Connection refused by destination.
6	Unsupported client request.
7	Unsupported address type.

Logging Issues

In most cases, normal event logging for Web Proxy or WinSock Proxy services will not cause serious problems for Microsoft Proxy Server service performance.

Problems that can result from logging are most likely to be caused by filling up a disk drive that is being used for both logging and caching. For this reason, it is recommended that you monitor available disk space and service-log file size on a regular basis. This is particularly important if you are using a single disk drive for storing cache files and log files.

If a hard disk on the server becomes full, the Web Proxy and WinSock Proxy services will continue to operate, but logging may be affected for both services, and caching may be affected for the Web Proxy service. If all disks configured to store the logs are full, the services will continue to run but no new log entries will be saved.

Important Running Microsoft Proxy Server without logging should be considered a nonsecure condition.

If all disks configured to store the cache become full, the Web Proxy service can stop functioning, and will return error 112 (disk full) for many queries. To help prevent the disk from filling up, it is a good idea to store the logs and the cache on different volumes.

Windows NT Logs

Microsoft Proxy Server uses the Windows NT system log to register events for active services. When a service event is logged, each log entry lists a source name to indicate the service that logged the event to the system log. This information can be useful when monitoring server performance or troubleshooting problems with the server.

The following table lists event log source names and the services that correspond to each source name.

Source Name	Description
WebProxyServer	Web Proxy service events
WebProxyLog	Web Proxy logging events
WebProxyCache	Web Proxy caching events
WinSockProxy	WinSock Proxy service events
WinSockProxyLog	WinSock Proxy logging events
MSProxyAdmin	Microsoft Proxy Server administrative events

To view event messages from Event Viewer

From the Start menu, select Programs. Then, select Administrative Tools and click Event Viewer.
From the Log menu, select System for the current view.
To view source details about a message or a description of the message, select a message from the event listing and double-click it.

The Event Detail window for the selected message appears.

For information about individual messages logged to the Windows NT system log, see Appendix H, “Setup Messages,” Appendix I, “Web Proxy Messages,” and Appendix J, “WinSock Proxy Messages.” For more information about using Event Viewer, see your documentation provided for Windows NT Server or refer to the online Help.

Performance Monitor Counters

Using Performance Monitor
Microsoft Proxy Server Counters

Using Performance Monitor

Windows NT includes a tool called Performance Monitor for tracking computer performance. When you monitor a system, you actually monitor the behavior of its parts. A set of counters exists for the processor, memory, cache, hard disk, processes, and other parts that produce statistical information. Certain counters are standard; others are configured or added with the installation of new software.

When Microsoft Proxy Server is installed on a new installation of Windows NT Server, three additional Performance Monitor objects are created.

Web Proxy Server Cache This object type includes counters specific to URL caching performed by the Web Proxy service.
Web Proxy Server Service This object type includes counters specific to the Web Proxy Server service.
WinSock Proxy Server This object type includes counters specific to the WinSock Proxy Server service.

You do not need special privileges to open Performance Monitor. However, you do need to be logged on as a member of the Administrators group to use the diskperf command. For performance monitoring of Microsoft Proxy Server, you can select counters directly in Performance Monitor. There is also a Start menu option for quick access to WinSock Proxy performance monitoring.

Note Activating object counters for performance monitoring can increase disk access time.

To monitor Microsoft Proxy Server performance

From the desktop, click Start.
Select Programs, and then select the Microsoft Proxy Server program group.
Click Monitor Microsoft Proxy Server Performance.

Performance Monitor starts, and loads a set of Microsoft Proxy Server counters.

To start Performance Monitor without loading Proxy Server counters

From the desktop, click Start.
Select Programs, then select the Administrative Tools program group.
Click Performance Monitor.

To view counters

From the File menu, click New Chart.
From the Edit menu, click Add to Chart.
The Add to Chart dialog box appears.
Select an object from the Object list. For example, you might select WinSock Proxy Server.
The counters for that object appear in the Counter list.
Select a counter from the Counter list.
Click Add.
Repeat steps 3, 4, and 5 to add additional counters.
When all counters have been added, click Done.

The Performance Monitor window returns. Information from the selected counters is displayed.

For more information about using Performance Monitor, see its online Help. Also see your documentation for Windows NT.

The diskperf command turns the counters for disk activity on and off. Diskperf works for a local or a remote computer. After restarting the computer, you can use Performance Monitor to view disk performance data.

To activate the physical and logical disk counters

Log on as a member of the Administrators group.
At the command prompt, type diskperf to view Help information on how to turn diskperf on and off and how to specify a remote computer’s name.
Follow the instructions to turn diskperf on or off.
To activate the disk performance counters, reboot the server.

Microsoft Proxy Server Counters

About the Microsoft Proxy Server Objects
Web Proxy Server Cache Counters
Web Proxy Server Service Counters
WinSock Proxy Server Counters

About the Microsoft Proxy Server Objects

When Microsoft Proxy Server is installed, the following objects are installed into Performance Monitor: Web Proxy Server Cache, Web Proxy Server Service, and WinSock Proxy Server. These three Performance Monitor objects contain all additional performance counters that are added for monitoring Microsoft Proxy Server.

Statistics from each Microsoft Proxy Server counters can be displayed in the Performance Monitor window and added to charts, logs, or reports created for service monitoring.

Also, you can set system alerts for any specific counters. By setting alerts, you can choose to have any of the following responses occur when a counter reaches a predefined limit.

The active monitoring view for Performance Monitor changes to the Alert view and the Alert window displays information about the reason for the alert.
The event that caused the alert status is logged in the Application log of the Event Viewer.
An alert message is broadcast over the network by the server.

Note When the Web Proxy or WinSock Proxy services are stopped and restarted, most counter values are reset and previous counter data is cleared. Some Web Proxy Server Cache counter values for URLs or bytes stored in the cache are recalculated according to the persistent cache contents.

Web Proxy Server Cache Counters

The counters in the Web Proxy Server Cache object include counters specific to URL caching performed by the Web Proxy service. The following list describes those counters.

Active Refresh Bytes Rate The number of bytes of data per second retrieved from the Internet to proactively refresh popular URLs in the URL cache.
Active URL Refresh Rate The number of popular URLs per second that are preemptively refreshed in the URL cache from remote URL sources on the Internet.
Bytes Committed Rate The number of bytes of data per second committed to disk storage in the URL cache

Bytes in Cache The total number of bytes currently contained in the URL cache (stored on disk).
Bytes Retrieved Rate The number of bytes of data per second retrieved from disk storage in the URL cache.
Max Bytes Cached The maximum number of bytes that have been stored in the URL cache.
Max URLs Cached The maximum number of URLs that have been stored in the URL cache.
Total Actively Refreshed URLs The cumulative number of popular URLs in the URL cache that have been preemptively refreshed from the Internet.
Total Bytes Actively Refreshed The cumulative number of bytes retrieved from the Internet to preemptively refresh popular URLs in the URL cache.
Total Bytes Cached The cumulative number of bytes that have been stored in the URL cache.
Total Bytes Retrieved The cumulative number of bytes that have been retrieved from the URL cache.
Total URLs Cached The cumulative number of URLs that have been stored in the URL cache.
Total URLs Retrieved The cumulative number of URLs that have been retrieved from the URL cache.
URL Commit Rate The number of URLs per second committed to the URL cache.
URL Retrieve Rate The number of URLs per second retrieved from the URL cache.
URLs in Cache The current number of URLs in the URL cache.

Web Proxy Server Service Counters

The counters in the Web Proxy Server Service object include counters specific to the Web Proxy service. The following list describes those counters.

Cache Hit Ratio (%) The percentage of requests that have been served by using cached data, out of the total number of requests to Web Proxy Server.
Client Bytes Received/sec The rate at which data bytes are received by Web Proxy Server from Web Proxy clients.
Client Bytes Sent/sec The rate at which data bytes are sent by Web Proxy Server to the Web Proxy clients.
Client Bytes Total/sec The sum of Client Bytes Sent/sec and Client Bytes Received/sec. This is the total rate of all bytes transferred between Web Proxy Server and Web Proxy clients.
Current Users The number of users currently connected to Web Proxy Server.
DNS Cache Entries The current number of DNS domain name entries cached by Web Proxy Server.
DNS Cache Flushes The total number of times that the DNS domain name cache has been flushed or cleared by Web Proxy Server.
DNS Cache Hits The total number of times a DNS domain name was found within the DNS cache.
DNS Cache Hits (%) The percentage of DNS domain names served by the Web Proxy Server cache, out of the total of all DNS entries that have been retrieved by Web Proxy Server.
DNS Cache Retrievals The total number of DNS domain names that have been retrieved by Web Proxy Server.
FTP Requests The number of FTP requests that have been made to Web Proxy Server.
Gopher Requests The number of Gopher requests that have been made to Web Proxy Server.
HTTP Requests The number of HTTP requests that have been made to Web Proxy Server.
HTTPS sessions The total number of secure HTTP sessions serviced by the Secure Sockets Layer (SSL) tunnel.

Inet Bytes Received/sec The rate at which data bytes are received by Web Proxy Server from remote servers on the Internet.
Inet Bytes Sent/sec The rate at which data bytes are sent by Web Proxy Server to remote servers on the Internet.
Inet Bytes Total/sec The sum of Inet Bytes Sent/sec and Inet Bytes Received/sec. This is the total rate for all bytes transferred between Web Proxy Server and servers on the Internet.
Maximum Users The maximum number of users that have connected to Web Proxy Server simultaneously.
Sites Denied The total number of Internet sites to which Web Proxy Server has denied access.
Sites Granted The total number of Internet sites to which Web Proxy Server has granted access.
SNEWS Sessions The total number of SNEWS sessions serviced by the Secure Sockets Layer (SSL) tunnel.
SSL Client Bytes Received/sec The rate at which that Secure Sockets Layer (SSL) data bytes are received by Web Proxy Server from secured Web Proxy clients.
SSL Client Bytes Sent/sec The rate at which Secure Sockets Layer (SSL) data bytes are sent by Proxy Server to secured Web Proxy clients.
SSL Client Bytes Total/sec The sum of SSL Client Bytes Sent/sec and SSL Client Bytes Received/sec. This is the total rate for all bytes transferred between Web Proxy Server and secured Web Proxy clients.
SSL Sessions Scavenged The number of Secure Sockets Layer (SSL) sessions closed because of idle timeout and excessive SSL demand.

Thread Pool Active Sessions The number of sessions being actively serviced by thread pool threads.
Thread Pool Failures The number of requests rejected because the thread pool was overcommitted.
Thread Pool Size The number of threads in the thread pool.
Total Cache Fetches The total number of requests that have been served by using cached data from Web Proxy Server cache.
Total Failing Requests The total number of Internet service requests that have failed to be processed by Web Proxy Server due to errors. Errors can be the result of Web Proxy Server failing to locate a requested server URL on the Internet, or because of the client being denied access to the requested URL.
Total Internet Fetches The total number of requests that have been served by using data retrieved from servers on the Internet.
Total Requests The total number of Internet requests that have ever been made to Web Proxy Server.
Total SSL Sessions The total number of Secure Sockets Layer (SSL) sessions serviced by the SSL tunnel.
Total Successful Requests The total number of Internet requests that have been successfully processed by Web Proxy Server.
Total Users The total number of users that have ever connected to Web Proxy Server.
Unknown SSL Sessions The total number of unknown Secure Sockets Layer (SSL) sessions serviced by the SSL tunnel.

WinSock Proxy Server Counters

The counters in the WinSock Proxy Server object provide statistics about the WinSock Proxy service. The following list describes those counters.

Accepting TCP Connections The number of connection objects that wait for TCP connection from the client after a successful remote connection.
Active Sessions The number of active sessions.
Active TCP Connections The number of active TCP connections.
Active UDP Connections Total number of active UDP connections.
Available Control Worker Threads The number of control channel worker threads that are available or waiting in the completion port queue.
Available Data Worker Threads The number of data-pump worker threads that are available or waiting in the completion port queue.
Back-Connecting TCP Connections Total number of connections that are waiting for an inbound connect () call to finish. These are connections from the WinSock Proxy service to a client after the WinSock Proxy service accepted a connection from the Internet on a listening socket.
Bytes Read/sec Number of bytes read by the data-pump per second.
Bytes Written/sec Number of bytes written by the data-pump per second.
Connecting TCP Connections Total number of connections that are waiting for a remote connect() call to finish.
Control Worker Threads The number of control channel worker threads that are alive.
Data Worker Threads The number of data-pump worker threads that are alive.
Failed GetXByY Number of calls to gethostname/gethostbyaddr that have failed.
Listening TCP Connections Number of connection objects that wait for TCP connections from the Internet (after a successful listen).
Non-connected UDP mappings The number of mappings for UDP connections.
Pending GetXByY Number of calls to gethostname/gethostbyaddr that have not yet returned
Successful GetXByY Number of calls to gethostname/gethostbyaddr that have returned successfully.

SNMP MIBs

If you monitor your network using Simple Network Management Protocol (SNMP) software, you can use the SNMP Management Information Base (MIB) files provided with Microsoft Proxy server to enable SNMP monitoring of the Web Proxy and WinSock Proxy services.

The MIB file for Web Proxy service monitoring is W3p.mib. The MIB file for WinSock Proxy Service monitoring is Wsp.mib. These files are not installed on the server by the Setup program. They are on the Microsoft Proxy Server compact disc, and can be copied from the Perfctrs directory in the appropriate processor architecture directory (Alpha\Perfctrs for Alpha AXP, I386\Perfctrs for Intel, Mips\Perfctrs for MIPS, and Ppc\Perfctrs for PowerPC). Be sure to use the correct MIB file for the server’s processor architecture.

To use these MIB files with the Windows NT SNMP service, you must first compile them by using the MIB compiler that comes with your SNMP software. If you are using the Microsoft Software Development Kit (SDK), you can use the MIB compiler tool, Mibcc.exe, which is included to compile MIB files. For more information on compiling MIB files with this tool, see your Microsoft SDK documentation. For other MIB compiling tools, see the documentation for the product.

The SNMP service uses Object Identifiers (OIDs) for MIB processing. The OID for the W3p.mib is 11. The OID for the Wsp.mib is 12.

In addition to compiling the MIB files, you must also start the Web Proxy service and the WinSock Proxy service before configuring and starting the Windows NT SNMP service on the computer running Microsoft Proxy Server. Once the SNMP service has been started on both the remote SNMP monitoring computer and the local Microsoft Proxy Server computer, you can use your SNMP monitoring software to monitor Microsoft Proxy Server services.

Note Using SNMP on a gateway that is not secure can expose network routing information to unauthorized users.