Monitoring Internet Information Services

How to

Monitor IIS

What Will I Learn Here?

What is IIS?

Counters to
Monitor

Performance
Counter Values

Most enterprises using Windows Server editions host their websites using IIS

How To Monitor IIS

This will be the first in a series of three
blog posts on monitoring. In this article
well discuss monitoring Internet
Information Services (IIS), the web
hosting platform available in Windows
Server editions. IIS is very popular in
part because it provides such a
compact service with lots of features
and configurations. Most enterprises
that use Windows Server editions are
hosting their websites using IIS. When hosting critical applications, many
companies use monitoring software to keep their system administrators
informed about the overall behavior of their systems. Such software provides
configurable alerts for performance counters, services and applications. We
will talk about how to monitor IIS, what the most important performance
counters are, and what services should be monitored when talking about
Internet Information services.

How To Monitor IIS

IIS can send information about its application pools and worker
processes, active requests, sites and applications, services that depend
on it, logging information, abnormal behavior and so on. You should
configure your monitoring software to measure the amount of CPU and
memory percentage that IIS is using.
Worker processes are responsible for executing code for web
applications, sending and responding to requests and so on. Each
worker process should be monitored carefully so that the following
parameters are working as desired:

Application Pool Name

Responsible for the

worker processes
behavior. By default,
any app pool will host
only one worker
process. You should
monitor each app
pool so that you know exactly what pool is responsible for memory
leaking or abnormal CPU usage. Each app pool is identified by its
Process ID so you should also take care of monitoring its
associated ID.

Percent of CPU Usage

Each worker process reserves a percentage of CPU to execute its active
requests. In the field, this counter value is regarded as one of the more
important counters to monitor.
Poorly written code using too much of the CPUs resources or bad
requests can block applications from using the CPU, which will cause
the CPU to run at a very high rate or even at 100% continually.
Other counters to monitor include Processor: % Idle Time or Processor:
Interrupts/sec.

Disk Space Used by Apps

This is another important aspect that should be considered when
monitoring IIS performance. Any application should have enough space
to run in normal parameters.
Situations in which disk space is limited or close to 0, can pose a real
threat to an applications performance especially when talking about
production environments. Logging too much information can cause log
files to grow excessively fast and cause the disk space to be depleted
causing poor performance.
The overall disk performance may include performance counters like Disk
Read Bytes/sec, Disk Reads/sec, Disk Write Bytes/sec or Disk
Writes/sec.

Disk Space Used by Apps Contd

Monitoring the Process State is another important item; a process can be
in one of three states: starting, running, or stopping. Other applications,
viruses and even human interaction may interfere with the normal
operation of processes, so you should always check out the state of each
one.
The amount of memory used by a process should always be monitored
carefully. Worker processes must reserve an amount of memory for their
normal performance.
Next are some memory values to consider:

Private Bytes (KB)

The amount of physical memory used by each process, this value can be
seen when opening task manager. A worker process is named W3wp.exe
so you should take a look at each one when there is abnormal memory
usage.
Task manager can indicate several W3wp.exe processes running at the
same time so it may be hard to differentiate between them.
Remember that the process ID is unique and you can see the requests of
each worker process along with its ID from IIS management console.

Virtual Bytes (KB)

The amount of virtual memory that is used by worker processes. This
value cannot be seen in task manager but, there are many tools with
which you can view the amount of virtual memory consumed by each
worker process.
Two of the most common counters for Memory are % Committed Bytes in
Use and Page Faults/sec
Remember that here are many IIS performance counters that can be
monitored. As a system administrator you are able to choose and
configure the ones that you desire.

Among the performance counters that worth mentioning are:

Virtual Bytes (KB) Contd

Web Services performance counters for the World Wide Web
Publishing Service.
Counters for the FTP Service
Performance counters for ASP applications and scripts
Many monitoring software do not use local installed clients instead
they use the SNMP protocol. If you use such software make sure to
monitor this service also.
Performance counters for Indexing services for web applications and
queries.
In case your applications use SMTP or NNTP services make sure the
overall performance of this services are monitored.
Global IIS counters for all Internet services like WWW, SMTP, FTP,
NNTP, etc.

Virtual Bytes (KB) Contd

Windows is equipped with monitoring tools such as performance monitor,
IIS applications logs for each web app, event viewer and so on. You can
configure event viewer tracing for some of the IIS services and
applications.
Make sure that only the desired logs are sent and notified by your
monitoring tools. You can use an event repository that collects all IIS
events in a centralized location and from there only specific events are
forwarded to the monitoring software for alert triggering and so on.

Virtual Bytes (KB) Contd

Among the IIS event sources are the following: NNTP Service
NNTPSVC, WWW ServiceW3SVC, FTP ServiceMSFTPSVC, SMTP
ServiceSMTPSVC, Active Server Pages, Microsoft COM+ MSDTC,
Certificate Services CERTSVC.
The values of performance counters can be chosen and customized by
the sys admins. This depends on the overall load of your servers and the
desired performance of your Web apps and services.
Some ideal values of the most important performance counters are:

Processor

Percent of processor time should be less than 75%

System processor queue length less than 2%

Memory

Available bytes this depends on your expectations. Ive read an

article that mentioned 4 MB as the desired value.
Pages per second less than 20%, if this value increases it may
indicate poor app performance.
Committed bytes less than 75% of your physical memory. You
should always have at least 25% free of your physical memory that
can be used by other system resources.
Pool nongpaged bytes should be a constant value, if this value
fluctuates it may indicate a memory leak

Disk

Percent disk time 0 or a value that is close to 0 is ideal. In any case

this value should be as low as possible
Queue length a value that is less than 2
Average disk bytes per transfer a high value is an ideal

Web service or bytes total per second As high as possible

IIS global or cache hits percent A high value is ideal

Conclusion
These are the values weve found that are recommended by Microsoft.
There are hundreds of IIS performance counters that can be monitored.
You will have to choose and customize the desired alerts for each
counter.
Most monitoring tools have some default Counters configured so a lot of
this work can be done easily. Of course, you will have to choose
monitoring software that satisfies all your needs.

Conclusion Contd
If you work on Microsoft Systems, you probably know that tools like this
should always incorporate Powershell scripting. With this powerful
scripting language you can create customized alerts, values and results.
Another aspect that you should consider when choosing this type of tool
is the price and the support that you can receive from the provider.

Freeware monitoring tools many times dont provide support, which can
make the work of system administrators much more painful.

Conclusion Contd
These are the most important aspects we feel should be considered
when talking about monitoring Internet Information Services behavior.
We know there are many more counters that you may believe to be very
important. Are there any you feel important enough to add here? Please
add your comments below!

We hope this post has helped give you a good idea on how you can
monitor IIS.
Stay tuned the next article, "How to Monitor ASP.NET" in this series
from Network Wrangler.
Author: Popescu Dan-Alexandru

Brought to you by:

POWERADMIN.COM
Whats Your Message?