Overview

The IIS Event Monitor watches several key performance counters for your IIS web servers. It can also check the status of sites and application pools.

Use Cases

• Making sure IIS websites are operational
• Making sure IIS application pools are operational
• Monitoring common IIS performance counters

Monitoring Options

This event monitor provides the following options:

Alert with [Info/Warning/Error/Critical] if IIS can't be contacted

Use this option to get alerts when the event monitor cannot contact the web server.

Sites and Application Pools

Alert with [Info/Warning/Error/Critical] if sites are stopped

Use this option to get alerts if any site is marked as stopped in the IIS manager.

Start any sites that are not running

This option, when selected, will start any site that is found to be stopped.

Only check selected sites

This option can be used to tell the event monitor to only check a selected set of sites.

Alert with [Info/Warning/Error/Critical] if any listed site is not found

This option tells the event monitor what to do if it was instructed to check specified sites but one or more of them were not found.

Alert with [Info/Warning/Error/Critical] if application pools are stopped

Use this option to get alerts if any application pool is marked as stopped in the IIS manager.

Start any application pools that are not running

This option, when selected, will start any application pool that is found to be stopped.

Only check selected application pools

This option can be used to tell the event monitor to only check a selected set of application pools.

Alert with [Info/Warning/Error/Critical] if any listed application pool is not found

This option tells the event monitor what to do if it was instructed to check specified application pools but one or more of them were not found.

Protocol

Select the protocol that will be used to collect site and application pool data. We recommend using "Windows Remote Management (WinRM)" whenever possible as it is generally more reliable than WMI.

When using the WMI protocol to monitor sites and application pools, use the Windows Server Manager to make sure the "IIS Management Scripts and Tools" role services is installed on the systems to be monitored.

When using the WinRM protocol, a configuration change is required to retrieve Windows updates on systems added using their IP address. To connect to systems using their IP address, open an administrative command line window on your monitoring server (and remote nodes in a multi-site configuration) and run the following command:

Performance Counters

Alert based on "Bytes Sent/sec: _Total"

This counter tracks the total number of bytes per second being delivered by IIS.

Alert based on "Bytes Received/sec: _Total"

This counter tracks the total number of bytes per second being received by IIS.

Alert based on "Bytes Total/sec: _Total"

Use this option to watch the total bandwidth for the IIS server. This value is the sum of bytes sent/sec and bytes received/sec.

Alert based on "CGI Requests/sec: _Total"

CGI requests use an older protocol designed to extend web server functionality. CGI requests are expensive in terms of resources like CPU and memory. This option allows you to alert based on the observed number of CPU requests per second.

Alert based on "Current CGI Requests: _Total"

This option is similar to the previous one but instead of measuring the number of CGI requests per second, it counts how many CGI requests are currently in progress and being handled by IIS.

Alert based on "Current Connections: _Total"

Use this option to monitor the number of open connections being handled by IIS.

Alert based on "Current ISAPI Extension Requests: _Total"

ISAPI extension requests are another way to extend web server functionality. They were designed to replace CGI and require fewer resources than CGI requests but still more than static web content. This option lets you monitor the current number of ISAPI extension requests that are in progress.

Alert based on "Files Sent/sec: _Total"

This counter tracks the number of files sent per second by the IIS web server.

Alert based on "Get Requests/sec: _Total"

Use this option to monitor the number of GET requests/sec being received by IIS. GET requests are used to retrieve web pages, images, and other content.

Alert based on "Head Requests/sec: _Total"

Use this option to monitor the number of HEAD requests/sec being received by IIS. HEAD requests are used by web browsers to get metadata about web content before deciding whether or not to download it.

Alert based on "ISAPI Extension Requests/sec: _Total"

This option monitors the number of ISAPI extension requests per second being handled by IIS for all sites.

Alert based on "Maximum CGI Requests: _Total"

IIS keeps a counter of the highest number of concurrent CGI requests that it has ever seen since it was last restarted. This option allows you to watch this value and get alerts based on its value.

Alert based on "Maximum Connections: _Total"

IIS keeps a counter of the highest number of concurrent connections that it has ever seen since it was last restarted. This option allows you to watch this value and get alerts based on its value.

Alert based on "Maximum ISAPI Extension Requests: _Total"

This option is similar to the previous two options but focuses on the maximum observed number of ISAPI extension requests.

Alert based on "Not Found Errors/sec: _Total"

This option tracks the number of 404 Not Found errors recorded by IIS. If a web browser requests page, image, or any other content but IIS cannot find it then it responds with a 404 error.

Alert based on "Post Requests/sec: _Total"

POST requests are used to submit data to the web server. They are used for login forms, uploading files, and other similar operations. This counter records the rate of POST requests per second.

Alert based on "Service Uptime: _Total"

IIS keeps a counter that records how long it has been running. You can use this option to detect when IIS has been restarted.

Authentication and Security

PDH: The account used for authentication must be a member of the Performance Monitor Users group or have admin rights.

WinRM: The account used for authentication must have admin rights.

WMI: The account used for authentication must be a member of the Performance Monitor Users group and the Distributed COM Users group or have admin rights.

Protocols

WinRM

WMI

Click on a protocol to learn more.

Data Points

Each performance counter you choose to monitor will appear as a data point in the data point chooser.

Sample Output

Tutorial

To view the tutorial for this event monitor, click here.