This will be the first in a series of three blog posts on monitoring. In this article we’ll discuss monitoring Internet Information Services (IIS), the web hosting platform available in Windows Server editions. IIS is very popular in part because it provides such a compact service with lots of features and configurations. Most enterprises that use Windows Server editions are hosting their websites using IIS. When hosting critical applications, many companies use monitoring software to keep their system administrators informed about the overall behavior of their systems. Such software provides configurable alerts for performance counters, services and applications. We will talk about how to monitor IIS, what the most important performance counters are, and what services should be monitored when talking about Internet Information services.
IIS can send information about its application pools and worker processes, active requests, sites and applications, services that depend on it, logging information, abnormal behavior and so on. You should configure your monitoring software to measure the amount of CPU and memory percentage that IIS is using. Worker processes are responsible for executing code for web applications, sending and responding to requests and so on. Each worker process should be monitored carefully so that the following parameters are working as desired:
Application Pool Name
Responsible for the worker processes behavior. By default, any app pool will host only one worker process. You should monitor each app pool so that you know exactly what pool is responsible for memory leaking or abnormal CPU usage. Each app pool is identified by its Process ID so you should also take care of monitoring its associated ID.
Percent of CPU Usage
Each worker process reserves a percentage of CPU to execute its active requests. In the field, this counter value is regarded as one of the more important counters to monitor. Poorly written code using too much of the CPU’s resources or bad requests can block applications from using the CPU, which will cause the CPU to run at a very high rate or even at 100% continually. Other counters to monitor include Processor: % Idle Time or Processor: Interrupts/sec.
Disk Space Used by Apps
This is another important aspect that should be considered when monitoring IIS performance. Any application should have enough space to run in normal parameters. Situations in which disk space is limited or close to 0, can pose a real threat to an application’s performance especially when talking about production environments. Logging too much information can cause log files to grow excessively fast and cause the disk space to be depleted causing poor performance. The overall disk performance may include performance counters like Disk Read Bytes/sec, Disk Reads/sec, Disk Write Bytes/sec or Disk Writes/sec.
Monitoring the Process State is another important item; a process can be in one of three states: starting, running, or stopping. Other applications, viruses and even human interaction may interfere with the normal operation of processes, so you should always check out the state of each one.
The amount of memory used by a process should always be monitored carefully. Worker processes must reserve an amount of memory for their normal performance. Here are some memory values to consider:
Private Bytes (KB)
The amount of physical memory used by each process, this value can be seen when opening task manager. A worker process is named W3wp.exe so you should take a look at each one when there is abnormal memory usage. Task manager can indicate several W3wp.exe processes running at the same time so it may be hard to differentiate between them. Remember that the process ID is unique and you can see the requests of each worker process along with its ID from IIS management console.
Virtual Bytes (KB)
The amount of virtual memory that is used by worker processes. This value cannot be seen in task manager but, there are many tools with which you can view the amount of virtual memory consumed by each worker process.
Two of the most common counters for Memory are % Committed Bytes in Use and Page Faults/sec
Remember that here are many IIS performance counters that can be monitored. As a system administrator you are able to choose and configure the ones that you desire. Among the performance counters that worth mentioning are:
- Web Services – performance counters for the World Wide Web Publishing Service.
- Counters for the FTP Service
- Performance counters for ASP applications and scripts
- Many monitoring software do not use local installed clients instead they use the SNMP protocol. If you use such software make sure to monitor this service also.
- Performance counters for Indexing services for web applications and queries.
- In case your applications use SMTP or NNTP services make sure the overall performance of this services are monitored.
- Global IIS counters for all Internet services like WWW, SMTP, FTP, NNTP, etc.
Windows is equipped with monitoring tools such as performance monitor, IIS applications logs for each web app, event viewer and so on. You can configure event viewer tracing for some of the IIS services and applications. Make sure that only the desired logs are sent and notified by your monitoring tools. You can use an event repository that collects all IIS events in a centralized location and from there only specific events are forwarded to the monitoring software for alert triggering and so on. Among the IIS event sources are the following: NNTP Service—NNTPSVC, WWW Service—W3SVC, FTP Service—MSFTPSVC, SMTP Service—SMTPSVC, Active Server Pages, Microsoft COM+ MSDTC, Certificate Services CERTSVC.
The values of performance counters can be chosen and customized by the sys admins. This depends on the overall load of your servers and the desired performance of your Web apps and services. Some ideal values of the most important performance counters are:
Processor
- percent of processor time – should be less than 75%
- system processor queue length – less than 2%
Memory
- Available bytes – this depends on your expectations. I’ve read an article that mentioned 4 MB as the desired value.
- Pages per second – less than 20%, if this value increases it may indicate poor app performance.
- Committed bytes – less than 75% of your physical memory. You should always have at least 25% free of your physical memory that can be used by other system resources.
- pool nongpaged bytes – should be a constant value, if this value fluctuates it may indicate a memory leak
Disk
- Percent disk time – 0 or a value that is close to 0 is ideal. In any case this value should be as low as possible
- Queue length – a value that is less than 2
- Average disk bytes per transfer – a high value is an ideal
Web service or bytes total per second – As high as possible
IIS global or cache hits percent – A high value is ideal
These are the values that are recommended by Microsoft, I’ve read about them in one of their articles.
There are hundreds of IIS performance counters that can be monitored. You will have to choose and customize the desired alerts for each counter. Most monitoring tools have some default Counters configured so a lot of this work can be done easily. Of course, you will have to choose monitoring software that satisfies all your needs. If you work on Microsoft Systems, you probably know that tools like this should always incorporate Powershell scripting. With this powerful scripting language you can create customized alerts, values and results. Another aspect that you should consider when choosing this type of tool is the price and the support that you can receive from the provider. Freeware monitoring tools many times don’t provide support, which can make the work of system administrators much more painful.
These are the most important aspects we feel should be considered when talking about monitoring Internet Information Services behavior. We know there are many more counters that you may believe to be very important. Are there any you feel important enough to add here? Please add your comments below!
We hope this post has helped give you a good idea on how you can monitor IIS. Stay tuned next week for next blog post in this series from Network Wrangler: “How to Monitor ASP.NET“
