Documentation forHybrid Cloud Observability Essentialsand Server & Application Monitor

AppInsight for IIS

Assign this SAM application monitor template to nodes to monitor the health of your IIS instances, as described in Monitor with AppInsight for IIS.

For a quick overview, watch AppInsight for IIS.

To set up target servers, see AppInsight for IIS requirements and permissions.

Note the following details about AppInsight templates, in general:

  • Starting in SAM 2020.2.6, you can disable dynamic AppInsight component monitors if a known issue in your environment (for example, a web server outage) will increase false-positive alerts and logs. You can also turn off non-critical components to reduce polling loads. See the SAM Administrator Guide for details.
  • Component monitors

    You can edit most component monitors (for example, to adjust thresholds).

    The first three component monitors — Application Pools, Sites, and Site Bindings Monitor — use Microsoft PowerShell scripts to collect data from target IIS servers. To learn more, see:

    Application Pools

    Collects the status of all monitored application pools for the IIS application.

    This key component monitor cannot be disabled.

    Sites

    Collects the status of all monitored sites that host the IIS application.

    Site Bindings Monitor

    Collects data for site bindings, such as protocol type (HTTP or HTTPS), IP address, and ports.

    Worker Process Statistic Monitor

    Collects data and status for the worker process activation service for an application pool, including the number of processes running in the application pool, recent failures of the process in the pool, total pool recycles since the service was started, total ping failures, total shutdown failures, and total startup failures.

    Log Parsing Monitor

    Displays log data for the AppInsight for IIS log.

    Total Connection Attempts

    The total number of connections to the Web or FTP service attempted since service startup. The count is the total for all websites or FTP sites combined, regardless of what you choose for Instance. This number does not include connection attempts that failed at the TCP (transport) or IP (network) layer.

    Total Logon Attempts

    The total number of successful logons to the Web or FTP service since the service started. Value does not include failed logon attempts.

    Current Connections

    The current number of connections established with the Web service. This is the sum of both non-anonymous (authenticated) and anonymous (unauthenticated) users.

    If this number is at or near the maximum connections allowable, the Web service is at full capacity.

    If the value is too high for a particular IIS server, then load balancing or clustering technologies can be applied to lower the burden of the server in question. Also check the Web Site property page for maximum connection limit.

    Current Anonymous users

    The number of users who currently have an anonymous connection using the Web service. If anonymous connections are not permitted on the server, the value of all anonymous user counters is always zero.

    Current NonAnonymous Users

    The number of users who currently have a non-anonymous connection using the Web service. If authentication is not enabled on the server, and none of the applications that run on the server request or require authentication, then the value of all non-anonymous user counters is always zero.

    Total Connection Attempts

    The total number of connections to the Web or FTP service that were attempted since service startup. The count is the total for all websites or FTP sites combined, regardless of what you choose for Instance. This number does not include connection attempts that failed at the TCP (transport) or IP (network) layer.

    Total Logon Attempts

    The total number of successful logons to the Web or FTP service since the service started. Value does not include failed logon attempts.

    Total Bytes Received

    The total bytes of data received by the WWW service since the service started. This information can be used to determine network load on a specific website.

    Total Bytes Sent

    The number of data bytes sent by the WWW service since the service started. This information can be used to determine network load on a specific website.

    Total Bytes Transferred

    The total number of bytes of data sent and received by the WWW service since the service started. This information can be used to determine network load on a specific website.

    HTTP Bindings Monitor/HTTPS Bindings Monitor

    Depending on how bindings are configured for a website in IIS, AppInsight attempts to create either an HTTP Monitor or HTTPS Monitor that sends a simple GET request to the website hosted on the IIS server to determine if the server is Up or Down. They also track response time in milliseconds.

    SSL Certificate Monitor

    Tests a web server's ability to accept incoming sessions over a secure channel and then test the security certificate.

    Site Directory Info Monitor

    Provides site directory information for the web server.

    Site Log Directory Monitor

    Provides site log directory information for the web server.

    Windows Process Activation Service

    Collects data from the Windows process activation service.

    World Wide Web Publishing Service

    Collects data and status from the W3Svc service. This is used for Internet access.

    Web Management Service

    Collects data and status from the Web Management Service. This is used for authentication.

    ASP.NET State Service

    Collects and provides status data for all ASP.NET IIS application requests that contain all the websites for the current application.

    Application Host Helper Service

    Collects configuration history and application pool account mapping data from the Microsoft ApplicationHost Helper Service. The ApplicationHost.config file is saved to separate configuration history subdirectories at set intervals.

    IIS Event Log Monitor

    Collects and displays IIS events.

    Current File Cache Memory Usage

    Current number of bytes used for the user-mode file cache.

    Output Cache Current Memory Usage

    Current memory usage by output cache.

    File Cache Hits %

    The ratio of user-mode file cache hits compared to the total number of cache requests since the service started.

    This counter reflects how well the settings for the IIS file cache are working. A site with mostly static files should have a very high cache hit percentage, from 70 to 85%.

    This counter does not include dynamic content, only static files. If static files are not being cached, consider lengthening the activity period for this cache.

    Kernel: URI Cache Hits %

    The ratio of kernel URI cache hits to the total number of cache requests since the service started.

    Metadata Cache Hits %

    The ratio of user-mode metadata cache hits to total number of cache request since the service started.

    Output Cache Current Hits %

    Output cache current hit ratio. The ratio is calculated as (H)/(H+M), where H and M represent Hits and Misses in previous sample intervals, respectively.

    URI Cache Hits %

    The ratio of user-mode URI Cache Hits to the total number of cache requests since the service started.

    If content cannot be cached in the HTTP.sys response cache, the value of this counter should be as high as possible. If content can be stored in the HTTP.sys response cache, the value of this counter should be low.

    Active Requests

    Current number of requests being processed by the worker process.

    Requests / Sec

    HTTP requests/sec being processed by the worker process.

    Active Threads Count

    Number of threads actively processing requests in the worker process.

    Current Worker Processes

    The current number of worker processes that are running in the application pool.

    Recent Worker Process Failures

    The number of times that the worker process for the application pool failed during the rapid-fail protection interval. Value should be count as difference with threshold greater than 0.

    Total Application Pool Recycles

    The number of times that the application pool was recycled since the Windows Process Activation Service (WAS) started. Value should be count as difference with threshold greater than 0.

    Total Worker Process Failures

    The number of times that worker processes have crashed since the application pool was started. Value should be count as difference with threshold greater than 0.

    Total Worker Process Ping Failures

    The number of times that the Windows Process Activation Service (WAS) did not receive a response to ping messages sent to a worker process. Value should be count as difference with threshold greater than 0.

    Total Worker Process Shutdown Failures

    The number of times that the WAS service failed to shut down a worker process. Value should be count as difference with threshold greater than 0.

    Total Worker Process Startup Failures

    The number of times that the WAS service failed to start a worker process. Value should be count as difference with threshold greater than 0.

    Maximum File Cache Memory Usage

    Maximum number of bytes used by the user-mode file cache since service startup. The value of this counter and the value of Web Service Cache\Current File Cache Memory Usage should be the same.

    If the numbers are different, the cache was flushed. If this counter is significantly higher than Web Service Cache\Current File Cache Memory Usage, you might consider recycling the worker process because the application may have a memory leak.

    File Cache Hits

    Total number of successful lookups in the user-mode file cache since service startup. This value depends on content. If the content files cannot be cached by HTTP.sys, a high value is good.

    File Cache Misses

    Total number of unsuccessful lookups in the user-mode file cache since service startup. A file cache miss means the request for the file must go to the hard disk.

    File cache misses negatively impact performance and scalability. This value should be as low as possible. Also note that kernel cache hits will cause this value to be low.

    Metadata Cache Hits

    Total number of successful lookups in the user-mode metadata cache since service startup.

    Metadata Cache Misses

    Total number of unsuccessful lookups in the user-mode metadata cache since service startup. Value should be as low as possible.

    Output Cache Total Hits

    Total number of successful lookups in the output cache since service startup.

    Output Cache Total Misses

    Total number of unsuccessful lookups in the output cache since service startup.

    URI Cache Hits

    Total number of successful lookups in the user-mode URI cache since service startup. Value depends on content. If content cannot be cached in the HTTP.sys response cache, the value of this counter should be as high as possible. If your content can be stored in the HTTP.sys response cache, the value of this counter should be low.

    URI Cache Misses

    Total number of unsuccessful lookups in the user-mode URI cache since service startup.

    A high value for this counter IIS cannot locate requested content in either the HTTP.sys response cache or the IIS file cache, which can impact overall performance. Low is better.

    Total Method Requests

    The number of HTTP requests that were made since the WWW service started.

    Delete Requests

    The number of HTTP requests that have used the DELETE method since the WWW service started.

    Get Requests

    The number of HTTP requests that have used the GET method since the WWW service started. GET requests are generally used for basic file retrievals or image maps, though they can be used with forms.

    If the value is too high for a particular IIS server, then load balancing or clustering technologies can be applied to lower the burden of the server in question.

    Head Requests

    The number of HTTP requests that used the HEAD method since the WWW service started. HEAD requests typically indicate that a client is querying the state of a document to determine if that file needs to be refreshed on the client.

    CGI Requests

    The number of custom gateway executable (CGI) requests that occurred after the WWW service started. CGI requests are .exe files that can be installed to add forms processing or other dynamic data sources. CGI requests spawn a process on the server which can be a large drain on server resources.

    ISAPI Extension Requests

    The number of ISAPI extension requests that were made since the WWW service started. ISAPI Extension Requests are custom gateway DLLs, which the administrator can install to add forms processing or other dynamic data sources.

    Put Requests

    The number of HTTP requests that used the PUT method since the WWW service started.

    Post Requests

    The number of HTTP requests that used the POST method since the WWW service started. Post requests are generally used for forms or gateway requests.

    If the value is too high for a particular IIS server, then load balancing or clustering technologies can be applied to lower the burden of the server in question.

    Files Received

    The number of files received by the WWW service since the service started.

    Files Sent

    The number of user-mode files sent by the WWW service since the service started. This counter does not include cache hits. Note that this counter does not increment when files are being served from the kernel-mode cache.

    Files Transferred

    The sum of Total Files Sent and Total Files Received by the WWW service since the service started. Note that this counter does not increment when files are being served from the kernel-mode cache.

    Locked Errors

    The number of requests made since the service started that could not be satisfied by the server because the requested document was locked. This is usually reported as HTTP error 423. Baseline required.

    Not Found Errors

    The number of requests made since the service started that were not satisfied by the server because the requested document was not found. This is usually reported as HTTP error 404.

    Request Execution Time

    The number of milliseconds that it took to execute the most recent request.

    The execution time begins when the HttpContext for the request is created, and stops before the response is sent to IIS. Assuming that user code does not call HttpResponse.Flush, this implies that execution time stops before sending any bytes to IIS, or to the client. When the process model is enabled, the request execution time includes the time required to write the response to the client, and therefore depends upon the bandwidth of the client's connection.

    There is no threshold for this counter. The value of this counter should be stable. Experience will help you set a threshold for a particular site.

    Request Wait Time

    The number of milliseconds that the most recent request waited in the queue. This does not include any time spent waiting in application queues. The threshold for this counter is 1,000. The average request should spend 0 milliseconds waiting in the queue.

    A value over 1,000 ms may indicate slow IIS server performance.

    Requests Queued

    The number of requests waiting to be processed.

    The Aspnet_wp process queue is a named pipe through which the request is sent from one process to the other. The number of requests in this queue increases if there is a shortage of available I/O threads in the Aspnet_wp process. When the limit specified by <processModel requestQueueLimit=/> is exceeded, requests are rejected with a 503 error (Service Unavailable). That usually only occurs on servers with very heavy loads.

    If a request is rejected, related data does not reach managed code so error handlers are not notified.

    Virtual directory queues maintain the availability of worker and I/O threads. The number of requests in these queues increases if the number of available worker threads or available I/O threads falls below the limit specified by <httpRuntime minFreeThreads=/>. When the limit specified by <httpRuntime appRequestQueueLimit=/> is exceeded, the request is rejected with a 503 error and the client is sent an HTTP exception with the message, Service Unavailable.

    Possible issues: When this value starts to increment linearly with increased client load, the web server computer has reached the limit of concurrent requests that it can process.

    Resolution: The default maximum value for this counter is 5,000. You can change this setting in the Machine.config file.

    Requests Rejected

    The number of requests rejected because the request queue was full.

    Requests are rejected when one of the queue limits is exceeded. Back-end latency, such as that caused by a slow computer running SQL Server, is often preceded by a sudden increase in the number of pipeline instances and a decrease in % Processor Time and Requests/second. A server might be overwhelmed during times of heavy load due to processor or memory constraints that ultimately result in the rejection of requests.

    The value of this counter should be 0. Values greater than 0 should be investigated.