IIS6 log file reporting chunks as completed downloads for pdf files when mapped to process all request through the asp.net engine

Question

On a Windows 2003 SP2 server with IIS 6, we configured IIS to process all request through the ASP.NET engine using aspnet_isapi.dll as outlined here http://professionalaspnet.com/archive/2007/07/27/Configure-IIS-for-Wildcard-Extensions-in-ASP.NET.aspx After the change, we noticed a huge increase in hits for pdf files.

For example, before we made the change, a 7Mb file was "hit" 78 times in a day as indicated by an HTTP status of 200 . After the change, that same file reported 22,000 "hits" in a single day.

In looking at the logs, it seems that the http status of 200 is being returned on every chunk, instead of for a completed download. This is an extract from the log file before the change

cs-method sc-status sc-substatus    sc-win32-status sc-bytes
GET       200   0       0       7452463     
HEAD      200   0       0       259         
GET       200   0       0       7452463     
HEAD      200   0       0       259

the first and second line represent a request from one ip address, the third and fourth are from a second IP address

and here is a similar extract from a log file created after we made the change

cs-method   sc-status  sc-substatus sc-win32-status sc-bytes
GET     200     0       0       7379092 
GET     200     0       0       102331  
GET     200     0       0       4249
GET     200     0       0       4212
GET     200     0       0       4521
GET     200     0       0       477
GET     200     0       0       4521
GET     200     0       64      196608
GET     200     0       0       6740403

The first request is from one IP Address, while the remaining lines are from a second IP address.

My question is this. Is there a way for me to cause the download of a pdf file to be recorded as a single hit, as it seemed to before I made the change?

Answer 1

It seems to me that the log is logging the actual requests, and it's the client's browser which decided to split it into chucks for more efficient downloading.

If the purpose of this project is for reporting, I would recommend creating a parser app/service to count PDF hits by IP address within a certain timeframe, rather than trying to hack the logging mechanism.