{"id":471,"date":"2013-07-29T15:09:01","date_gmt":"2013-07-29T20:09:01","guid":{"rendered":"http:\/\/www.poweradmin.com\/blog\/?p=471"},"modified":"2015-04-27T08:45:08","modified_gmt":"2015-04-27T13:45:08","slug":"how-to-monitor-iis","status":"publish","type":"post","link":"https:\/\/www.poweradmin.com\/blog\/how-to-monitor-iis\/","title":{"rendered":"How to Monitor IIS"},"content":{"rendered":"<p><span style=\"font-family: verdana,geneva,sans-serif;\"><a href=\"\/blog\/wp-content\/uploads\/2013\/07\/IIS-e1375132528382.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignright size-medium wp-image-500\" src=\"\/blog\/wp-content\/uploads\/2013\/07\/IIS-e1375132528382-300x181.png\" alt=\"IIS\" width=\"300\" height=\"181\"><\/a>This will be the first in a series of three blog posts on monitoring. In this article we\u2019ll discuss<strong> monitoring Internet Information Services (IIS)<\/strong>, the web hosting platform available in Windows Server editions. IIS is very popular in part because it provides such a compact service with lots of features and configurations. Most enterprises that use Windows Server editions are hosting their websites using IIS. When hosting critical applications, many companies use monitoring software to keep their system administrators informed about the overall behavior of their systems. Such software provides configurable alerts for performance counters, services and applications. We will talk about how to monitor IIS, what the most important performance counters are, and what services should be monitored when talking about Internet Information services.<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">IIS can send information about its application pools and worker processes, active requests, sites and applications, services that depend on it, logging information, abnormal behavior and so on. You should configure your <a href=\"\/servermonitor\/\">monitoring software<\/a> to measure the amount of CPU and memory percentage that IIS is using. Worker processes are responsible for executing code for web applications, sending and responding to requests and so on. Each worker process should be monitored carefully so that the following parameters are working as desired:<\/span><\/p>\n<h2><span style=\"color: #ff6600; font-family: verdana,geneva,sans-serif;\"><span style=\"font-size: 16px;\">Application Pool Name<\/span><\/span><\/h2>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">Responsible for the worker processes behavior. By default, any app pool will host only one worker process. You should monitor each app pool so that you know exactly what pool is responsible for memory leaking or abnormal CPU usage. Each app pool is identified by its <strong>Process ID<\/strong> so you should also take care of monitoring its associated ID.<\/span><\/p>\n<h2><span style=\"font-size: 16px; font-family: verdana,geneva,sans-serif;\"><span style=\"color: #ff6600;\">Percent of CPU Usage<\/span><\/span><\/h2>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">Each worker process reserves a percentage of CPU to execute its active requests. In the field, this counter value is regarded as one of the more important counters to monitor. Poorly written code using too much of the CPU\u2019s resources or bad requests can block applications from using the CPU, which will cause the CPU to run at a very high rate or even at 100% continually. Other counters to monitor include Processor: % Idle Time or Processor: Interrupts\/sec.<\/span><\/p>\n<h2><span style=\"font-size: 16px; font-family: verdana,geneva,sans-serif;\"><span style=\"color: #ff6600;\">Disk Space Used by Apps<\/span><\/span><\/h2>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">This is another important aspect that should be considered when monitoring IIS performance. Any application should have enough space to run in normal parameters. Situations in which disk space is limited or close to 0, can pose a real threat to an application\u2019s performance especially when talking about production environments. Logging too much information can cause log files to grow excessively fast and cause the disk space to be depleted causing poor performance. The overall disk performance may include performance counters like Disk Read Bytes\/sec, Disk Reads\/sec, Disk Write Bytes\/sec or Disk Writes\/sec.<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">Monitoring the Process State is another important item; a process can be in one of three states: starting, running, or stopping. Other applications, viruses and even human interaction may interfere with the normal operation of processes, so you should always check out the state of each one.<\/span><\/p>\n<p><span style=\"font-size: 14px; font-family: verdana,geneva,sans-serif;\">The amount of memory used by a process should always be monitored carefully. Worker processes must reserve an amount of memory for their normal performance. Here are some memory values to consider:<\/span><\/p>\n<h2><span style=\"font-size: 16px; font-family: verdana,geneva,sans-serif;\"><span style=\"color: #ff6600;\">Private Bytes (KB)<\/span><\/span><\/h2>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">The amount of physical memory used by each process, this value can be seen when opening task manager. A worker process is named W3wp.exe so you should take a look at each one when there is abnormal memory usage. Task manager can indicate several W3wp.exe processes running at the same time so it may be hard to differentiate between them. Remember that the process ID is unique and you can see the requests of each worker process along with its ID from IIS management console.<\/span><\/p>\n<h2><span style=\"font-size: 16px; font-family: verdana,geneva,sans-serif;\"><span style=\"color: #ff6600;\">Virtual Bytes (KB)<\/span><\/span><\/h2>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">The amount of virtual memory that is used by worker processes. This value cannot be seen in task manager but, there are many tools with which you can view the amount of virtual memory consumed by each worker process.<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">Two of the most common counters for Memory are % Committed Bytes in Use and Page Faults\/sec<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">Remember that here are many IIS performance counters that can be monitored. As a system administrator you are able to choose and configure the ones that you desire. Among the performance counters that worth mentioning are:<\/span><\/p>\n<ul>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>Web Services<\/strong> \u2013 performance counters for the World Wide Web Publishing Service.<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Counters for the <strong>FTP <\/strong>Service<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Performance counters for <strong>ASP<\/strong> applications and scripts<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Many monitoring software do not use local installed clients instead they use the<strong> SNMP<\/strong> protocol. If you use such software make sure to monitor this service also.<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Performance counters for<strong> Indexing<\/strong> services for web applications and queries.<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">In case your applications use <strong>SMTP or NNTP <\/strong>services make sure the overall performance of this services are monitored.<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>Global IIS counters<\/strong> for all Internet services like WWW, SMTP, FTP, NNTP, etc.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">Windows is equipped with monitoring tools such as performance monitor, IIS applications logs for each web app, event viewer and so on. You can configure event viewer tracing for some of the IIS services and applications. Make sure that only the desired logs are sent and notified by your monitoring tools. You can use an event repository that collects all IIS events in a centralized location and from there only specific events are forwarded to the monitoring software for alert triggering and so on. Among the IIS event sources are the following: NNTP Service\u2014NNTPSVC, WWW Service\u2014W3SVC, FTP Service\u2014MSFTPSVC, SMTP Service\u2014SMTPSVC, Active Server Pages, Microsoft COM+ MSDTC, Certificate Services CERTSVC.<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">The values of performance counters can be chosen and customized by the sys admins. This depends on the overall load of your servers and the desired performance of your Web apps and services. Some ideal values of the most important performance counters are:<\/span><\/p>\n<h2><span style=\"font-size: 16px; font-family: verdana,geneva,sans-serif;\"><span style=\"color: #ff6600;\">Processor<\/span> <\/span><\/h2>\n<ul>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">percent of processor time \u2013 should be less than 75%<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">system processor queue length \u2013 less than 2%<\/span><\/li>\n<\/ul>\n<h2><span style=\"font-size: 16px; font-family: verdana,geneva,sans-serif;\"><span style=\"color: #ff6600;\">Memory<\/span> <\/span><\/h2>\n<ul>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Available bytes \u2013 this depends on your expectations. I\u2019ve read an article that mentioned 4 MB as the desired value.<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Pages per second \u2013 less than 20%, if this value increases it may indicate poor app performance.<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Committed bytes \u2013 less than 75% of your physical memory. You should always have at least 25% free of your physical memory that can be used by other system resources.<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">pool nongpaged bytes \u2013 should be a constant value, if this value fluctuates it may indicate a memory leak<\/span><\/li>\n<\/ul>\n<h2><span style=\"font-size: 16px; font-family: verdana,geneva,sans-serif;\"><span style=\"color: #ff6600;\">Disk<\/span> <\/span><\/h2>\n<ul>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Percent disk time \u2013 0 or a value that is close to 0 is ideal. In any case this value should be as low as possible<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Queue length \u2013 a value that is less than 2<\/span><\/li>\n<li><span style=\"font-family: verdana,geneva,sans-serif;\">Average disk bytes per transfer \u2013 a high value is an ideal<\/span><\/li>\n<\/ul>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\"><span style=\"font-size: 16px;\"><span style=\"color: #ff6600;\">Web service or bytes total per second<\/span><\/span> \u2013 As high as possible<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\"><span style=\"font-size: 16px;\"><span style=\"color: #ff6600;\">IIS global or cache hits percent<\/span><\/span> \u2013 A high value is ideal<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">These are the values that are recommended by Microsoft, I\u2019ve read about them in one of their articles.<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">There are hundreds of IIS performance counters that can be monitored. You will have to choose and customize the desired alerts for each counter. Most monitoring tools have some default Counters configured so a lot of this work can be done easily. Of course, you will have to choose monitoring software that satisfies all your needs. If you work on Microsoft Systems, you probably know that tools like this should always incorporate Powershell scripting. With this powerful scripting language you can create customized alerts, values and results. Another aspect that you should consider when choosing this type of tool is the price and the support that you can receive from the provider. Freeware monitoring tools many times don\u2019t provide support, which can make the work of system administrators much more painful.<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">These are the most important aspects we feel should be considered when talking about monitoring Internet Information Services behavior. We know there are many more counters that you may believe to be very important. Are there any you feel important enough to add here? Please add your comments below!<\/span><\/p>\n<p><span style=\"font-family: verdana,geneva,sans-serif;\">We hope this post has helped give you a good idea on how you can monitor IIS. Stay tuned next week for next blog post in this series from Network Wrangler: \u201c<a href=\"\/blog\/monitoring-asp-net\/\">How to Monitor ASP.NET<\/a>\u201c<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This will be the first in a series of three blog posts on monitoring. In this article we\u2019ll discuss monitoring Internet Information Services (IIS), the web hosting platform available in Windows Server editions. IIS is very popular in part because it provides such a compact service with lots of features and configurations. Most enterprises that [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":500,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,5,10,6,9,8],"tags":[],"class_list":["post-471","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general-it","category-how-to","category-power-admin","category-tech","category-technical","category-windows"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/comments?post=471"}],"version-history":[{"count":5,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/471\/revisions"}],"predecessor-version":[{"id":3586,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/471\/revisions\/3586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/media\/500"}],"wp:attachment":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/media?parent=471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/categories?post=471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/tags?post=471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}