IIS Logs Are Filling the Disk

Confirm that IIS logs are actually the problem

Scan the affected drive and open SizeTrend's Overview pane. When IIS is installed locally, SizeTrend reads the current IIS logging configuration and examines the configured log locations. This also helps when a site writes logs somewhere other than the familiar C:\inetpub\logs\LogFiles folder.

The overview shows the amount used by recognized IIS logs and breaks the files into age ranges. A drive full of recent traffic needs a different response from one holding several years of old logs.

Map the files back to the current sites

SizeTrend also reviews deployed IIS site storage, so the scan can give the paths some application context. Still, do not assume that every old-looking folder is abandoned. A server may contain stopped sites, historical deployments, shared log locations, or configuration that changed after the logs were written.

If IIS configuration changes after the scan, refresh the Overview before acting. SizeTrend checks that the current logging locations still match the review instead of using stale configuration data.

Review by age, then check the retention requirement

Open the IIS log review and start with an age range that makes sense for the server. The review can separate logs older than one month, three months, six months, one year, or two years. You can see the individual files and their combined size before selecting anything.

Old is not the same as safe to remove. IIS logs may be needed for troubleshooting, security investigations, auditing, compliance, usage reporting, or a customer agreement. Ask whoever owns the server what must be retained and whether the logs are archived elsewhere.

Fix the policy after the emergency

Clearing enough approved old data may get the server out of danger, but it does not prevent the next incident. Check the site's logging settings, log rollover, archival job, retention schedule, and the capacity of the volume that receives the logs.

A saved SizeTrend scan gives you a useful baseline. Compare it with a later scan to see how quickly the log location is growing and whether the change is normal traffic or a sudden jump.