Javascript must be enabled to download our products and perform other essential functions on the website.

Buy Now Download Free Trial

How to monitor Internet Information Services (IIS)

Listed below are some of the recommendations for monitoring the Internet Information Services (IIS) counters and services.


Watch the training video How to monitor Internet Information Services (IIS).

IIS Services to Monitor

ServicesService Name
Application Host Helper ServiceAppHostSvc
Windows Process Activation Service*WAS
World Wide Web Publishing ServiceW3SVC

Events to Monitor

The Windows Process Activation Service also has some Event IDs that should be monitored as well. The Event Source for the following Event IDs is the Microsoft-Windows-WAS log file. The Event Log Monitor is ideal for this task.

  • 5144 - (Error): WAS is not able to enable application pool.
  • 5002 - (Error): Application pool is being automatically disabled.
  • 5059 - (Error): WAS encountered a failure when it started a worker process to save the application pool. The application pool has been disabled.
  • 5117 - (Warning): A worker process serving application pool has requested a recycle because it reached its private bytes memory limit.
  • 5077 - (Warning): A worker process serving application pool has requested a recycle because it reached its virtual memory limit.
  • 5009 - (Warning): A process serving application pool terminated unexpectedly.

IIS Performance Counters to Watch

Object\CounterDefault Threshold
Memory\Pages/sec0 - 20
Memory\Available Bytes10% of physical memory
Memory\Committed Bytes75% of physical memory
Memory\PoolNonpaged Bytes A steady value. (A slow rise might indicate a memory leak.)
Processor\% Processor Time< 75%
Processor\System Processor Queue Length< 2
LogicalDisk\% Disk TimeAs low as possible
LogicalDisk\Avg. Disk Queue Length< 2
LogicalDisk\Avg. Disk Bytes/TransferAs high as possible
Web Service\Bytes Total/secAs high as possible

Monitor IIS Application Pools

There are performance counters on the APP_POOL_WAS object that you can monitor using the Performance Monitor. One counter in particular, Current Application Pool State that has the following definition (pulled from Windows Perfmon description)

Current Status of the Application Pool from APP_POOL_WAS\Current Application Pool State

  • 1 - Uninitialized
  • 2 - Initialized
  • 3 - Running
  • 4 - Disabling
  • 5 - Disabled
  • 6 - Shutdown Pending
  • 7 - Delete Pending


PA Server Monitor

Help Map