How to monitor Internet Information Services (IIS)

Listed below are some of the recommendations for monitoring the Internet Information Services (IIS) counters and services.

IIS Services to Monitor

Services	Service Name
Application Host Helper Service	AppHostSvc
Windows Process Activation Service*	WAS
World Wide Web Publishing Service	W3SVC

Events to Monitor

The Windows Process Activation Service also has some Event IDs that should be monitored as well. The Event Source for the following Event IDs is the Microsoft-Windows-WAS log file. The Event Log Monitor is ideal for this task.

• 5144 - (Error): WAS is not able to enable application pool.
• 5002 - (Error): Application pool is being automatically disabled.
• 5059 - (Error): WAS encountered a failure when it started a worker process to save the application pool. The application pool has been disabled.
• 5117 - (Warning): A worker process serving application pool has requested a recycle because it reached its private bytes memory limit.
• 5077 - (Warning): A worker process serving application pool has requested a recycle because it reached its virtual memory limit.
• 5009 - (Warning): A process serving application pool terminated unexpectedly.

IIS Performance Counters to Watch

Object\Counter	Default Threshold
Memory\Pages/sec	0 - 20
Memory\Available Bytes	10% of physical memory
Memory\Committed Bytes	75% of physical memory
Memory\Pool	Nonpaged Bytes A steady value. (A slow rise might indicate a memory leak.)
Processor\% Processor Time	< 75%
Processor\System Processor Queue Length	< 2
LogicalDisk\% Disk Time	As low as possible
LogicalDisk\Avg. Disk Queue Length	< 2
LogicalDisk\Avg. Disk Bytes/Transfer	As high as possible
Web Service\Bytes Total/sec	As high as possible

Monitor IIS Application Pools

There are performance counters on the APP_POOL_WAS object that you can monitor using the Performance Monitor. One counter in particular, Current Application Pool State that has the following definition (pulled from Windows Perfmon description)

Current Status of the Application Pool from APP_POOL_WAS\Current Application Pool State

• 1 - Uninitialized
• 2 - Initialized
• 3 - Running
• 4 - Disabling
• 5 - Disabled
• 6 - Shutdown Pending
• 7 - Delete Pending

References

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/7898b860-462c-4846-a3a8-1179f287ad88.mspx?mfr=true
http://technet.microsoft.com/en-us/library/bb727100.aspx
http://letitknow.wordpress.com/2012/07/27/what-services-should-be-monitored-in-case-of-iis/