LWA: How to measure web transfer on IIS per virtual WWW server using gawk for Windows?

One of servers administered by moi is the server for web shared hosting made on IIS 6.0. Recently I had this problem - one of my customers appeared to have really heavy transfer from his website. I needed a simple solution to measure it to get the values per month. There may be even simplest solution but I have used a gawk version for Windows - small and simple UNIX/Linux-born app you can get from here: http://gnuwin32.sourceforge.net/packages/gawk.htm. This neat little fellow can do tricks like read the csv-type file per line, find pointed columns and even sum what is in them. That is why I so much like those Linux-born stuff...

First thing is that IIS by default does not put transfers to logfiles. So I switched it on. In IIS right-click on the Virtual Site for which you want to expand the log, then choose Properties, again Properties next to Active Log Format, then Advanced and then mark Bytes Sent and Received.

How to create a proper command problem I solved within my typical LWA manner - I asked a UNIX admin friend to write it for me :-). In my case the new sc-bytes (Bytes Sent to client) column in IIS log is the 16-th one, the cs-bytes (Bytes Received by server) is the 17-th one. So the gawk.exe command look like:

gawk.exe "/^2007/ {D=D+$16; U=U+$17; L=L+1} END {print D/1048576, U/1048576, L}" ex0709*

Witch stands for: take all files that are named with ex0709* schema (IIS logs by default have filenames in format exYYMM... so here are only those created in2007-09 but check how it is in your system), then get only lines beginning with "2007" string (every significant line of my log begins with date so this way I put the rest of headers etc. lines aside since we have year 2007 now) and go to it's 16-th and 17-th column and add values found there respectively to D and U variables. Then add 1 to L variable (to count processed lines - not really needed) and then display D, U and L dividing D and U by 1048576 to have the output in MB instead of bytes. You can of course skip this ex0709* and add more narrow value to gawk command itself but this way you will browse through all the log files instead of only those you want to count. My logs for this particular site have average size of 8MB per day and the site is several months old so it would not be wise. Anyway this runed on the logs of this particular client gave me:

305130 910.002 1928590

Yeah - about 305GB downloaded within the month from one site on the web shared hosting server running IIS. Gotcha!

BTW - the server being a standard one processor 2U solution does not really feel abused - there are about 50 sites there, some FTP sites too and not a sign of low performance and lots of resources for more customers :-).