How to Monitor IIS Performance

Are you looking to monitor the performance of your IIS web server? This guide will break down everything you need to know about monitoring and troubleshooting Microsoft’s popular web server.

IIS performance monitoring helps you to proactively monitor the health of your IIS web server by collecting logs, traces, and metrics of the application performance and the underlying IT infrastructure. By correlating metrics together, you can troubleshoot the root-cause of the issue instead of the symptoms rippling out from it.

What is Microsoft IIS?

Microsoft’s Internet Information Server (IIS) plays a pivotal role in supporting web applications on Microsoft Windows operating systems. Using a thread-per-request processing model, Microsoft IIS offers a scalable way of supporting web sites and applications. While IIS is widely used to host ASP.NET web sites and applications, it can also be the front-end for other applications based on Java, PHP, etc.

In a multi-tier architecture, the front-end IIS web server handles all the information relating to user activity, accesses, errors, and security events. Any slowdown in the web server tier will adversely affect the entire application’s performance and ultimately, the user experience

Failures of web services and web sites can result in critical impacts for customers and employees relying on them. Such failures need to be proactively detected to avoid impacting the real users’ experience and access to information and services they rely on.

Monitoring Availability and Response Time

The most basic check an administrator can do to ensure a website is up and available is via a simple HTTP checker which checks the responses in the server HTTP headers.

An HTTP call is made to a website and the returned status is checked as to whether it is 200, which means it is OK. A well-functioning URL should always return 200. Beyond this, when the returned code is 200, the response time can also be measured and evaluated to check whether a site is not only up but whether it is responsive, and performance is adequate. Status codes other than 200 may give insight into problems with the site.

The response time associated with HTTP checking can indicate if your sites have a performance issue and/or slowdown. Often this is associated with resource limitation and bottlenecks on the server such as CPU, RAM or bandwidth. However, in practice HTTP checking alone will give you little insight into the root-cause and there are numerous other possible causes for website slowness.

In practice you will probably need to implement, or source, additional functionality around your basic HTTP checker to:

• Record results to analyze long-term trends
• Implement some sort of automated scheduling so checks do not require manual implementation
• Consider geographic testing if relevant to your users – testing from multiple locations e.g., different cities, from different devices, from within the corporate network and from outside firewalls etc.
• Implement automated alerting so that you know when checks have failed within short timescales to minimize disruption to users
• Collect data over a long period to assert the correct baseline performance of your sites and determine any thresholds needed to trigger alerts

Using Synthetic Monitoring to check IIS performance

Commercial monitoring platforms will usually implement the five additional features mentioned above and cover protocols beyond HTTP. This includes FTP and NTP requests to IIS, within a suite of “Synthetic Monitoring” functionality. Enterprise grade platforms such as eG Enterprise will incorporate AIOps (Artificial Intelligence for Operations) technologies including machine learning technologies to enable automated baselining and anomaly detection.

Essentially, robot users simulate users accessing web pages. This means that administrators can check the availability of their services even when there are no real users e.g., at 3 a.m. in the morning. If a problem is found it may be possible to resolve it before the bulk of users attempt to access the site when they wake up or arrive at 8:30am at their desks.

Synthetic monitoring offers a repeatable and consistent way to measure and quantify IIS performance to baseline performance and set SLAs (Service Level Agreements) and KPIs. eG Enterprise also includes a dedicated Web App Simulator.

Using Real User Monitoring (RUM) to go beyond Synthetic Monitoring

Synthetic Monitoring alone has limitations. It is considered the best practice to monitor web servers and web site delivery infrastructure using Synthetic monitoring in conjunction with RUM (Real User Monitoring). Synthetic monitoring is often called proactive monitoring, and by contrast, RUM is labeled as passive monitoring. RUM involves capturing metrics of real user requests to IIS servers or other resources.

Real user monitoring allows the performance of web sites and services delivered via IIS to be assessed against SLAs and KPIs. A detailed guide to RUM is available, here: What is Real User Monitoring (RUM)?.

Monitoring IIS Application Pools

An Application Pool is a mechanism used by IIS to isolate Web applications to prevent misbehaving applications from interfering with other applications. Generally, each Application Pool corresponds to one worker process. A worker process is a windows process (w3wp.exe) which runs Web Applications and is responsible for handling requests sent to a Web Server for a specific application pool.

If you have been using IIS, perhaps you have witnessed times when your website mysteriously stops working. After some troubleshooting, you may find that the Application Pool is stopped, or the worker process has crashed for some reason.

Often, the cause of this is unhandled errors or memory leaks in the application, or that the worker process (w3wp.exe) has hung. This in turn can cause the worker process to be killed and the Application Pool to stop. To alert on and diagnose these issues, it is important to monitor

• Application Pool Status.
• Resource utilization of worker processes.
• Code level instrumentation and monitor the application errors, exceptions, etc.,

eG Enterprise automatically finds all the application pools, monitors the status of each application pool and tracks the resource utilization of corresponding worker processes. eG Enterprise can also restart the application pool if it has stopped rectifying the issue.

With the help of a Code Level Instrumentation Profiler, eG Enterprise automatically tracks the business transaction URLs and dependencies with external applications like databases. It can track the SQL queries being executed, identify code contributing most of the CPU usage in the application and its stack trace, and report important IIS metrics and KPIs.

Monitoring IIS Logs

Like any web server, an IIS server produces logs. These logs provide information about each request made to the website such as:

• The date and time of the request
• The client IP address
• The (authenticated) username of the user visiting the site
• The HTTP status code returned by the website, and more.

When aggregated and analyzed, these logs can provide basic insights. The challenges of IIS logs are similar to those associated with analyzing log files for any web server: Busy websites make a seemingly endless amount of log records.

Manually searching and analyzing these logs is overwhelming and can become a full-time job for a DEVOPS team. Microsoft does provides a free GUI tool Log Parser Studio or Log Parser 2.2 to open and analyze the log files but the efficiency gains are marginal.

Sometimes, you might not find failed requests in IIS logs, even though IIS logging is enabled for the website. There is a significant chance that a request is rejected by HTTP.sys (Kernel mode driver for HTTP) before it is handed to the IIS worker process. This generally occurs when the request violates the HTTP protocol (the client will see HTTP 400: Bad Request) or there is a Windows Process Activation Service/the application pool failure (on the client-side this is seen as: HTTP 503: Service Unavailable).

If you are still unable to catch an error happening in your website, IIS provides a “IIS Failed Request Trace” feature. This will let you configure a rule to capture a detailed request trace for a specific URL, status code, or time elapsed.

If you are troubleshooting your website performance issues using IIS and event logs, you are likely to be in a difficult position and have limited insights. Most production errors go unreported because users are reluctant to speak up when they encounter problems on your site – how likely are you to email Amazon’s support team when you can’t add a product to your basket? You are more likely to go to Walmart or eBay.

Given the short attention spans and low tolerance for waiting these days, users are far more likely to stop using your site and try your competitors’ instead. By the time you find out you have errors, the damage has probably already been done.

For a modern enterprise, the viable and sustainable choice is to go proactive and continuously monitor all errors and exceptions for all their websites and services, and triage/fix those considered important before real users encounter issues and the business is impacted.

eG Enterprise continuously and proactively tracks all web sites and HTTP error logs and raises alerts reporting issues immediately to the administrator, as and when issues arise.

Monitoring and Tracking IIS Performance Counters

IIS provides a wide range of performance counters for IIS Web Service, ASP.NET and .NET frameworks. With the help of the Performance Monitor (PerfMon) console, you can monitor the following counters.

If the website restarts or the Application Pool recycles itself (recycling means the worker process that handles requests for that Application Pool is terminated and a new one is started), the PID (Process ID) of the worker process will change. This creates a challenge of tracking the above performance counters manually. Enterprise tools such as eG Enterprise remove the complexity of manually tracking and mapping PIDs.

With eG Enterprise, you can easily track the resource utilization of worker processes, application pool and all ASP.NET metrics proactively and send alerts when thresholds are crossed or something abnormal happens.

Free IIS monitoring tools, self-scripted monitoring tools and even native tools require manual setup and need you to enter thresholds for each metric. eG Enterprise helps users avoid tedious setup because all the manufacturer thresholds are automatically configured the moment you set it up. The platform has the ability to correlate application performance with that of the underlying IT infrastructure to pin-point the root-cause and separate the primary issue from the symptoms that ripple out from it.

The AIOps (Artificial Intelligence for IT Operations) engine within eG Enterprise also will learn your applications’ resource usage patterns and user demand cycles to avoid false alarms (false positives). Intelligent AIOps also will determine the root-cause from the symptoms to avoid alarm floods.

What to Look for in an IIS Performance Monitoring Tool

If you are providing a service via a website, you need to proactively monitor it and fix the problems before your end users are impacted and become aware of them. So, you need a performance monitoring tool with the following capabilities:

• Ability to report all critical metrics such as CPU & Memory utilization of the Operating System.
• Reporting for all the event log records of the ASP.NET (or other) application
• Tracking for any relevant Windows Services and Windows process resource utilization
• Tracking of the Application pool status and the ability to restart the application pool
• Tracking of IIS worker process resource utilization
• Automated tracking of business transactions and capabilities to group URLs

• Capabilities to map and visualize the transaction topology with the application dependencies
• Tracking of the performance of SQL calls and alerting capabilities for any slowdown or anomalous behavior
• Tracking of the status of transaction URLs and alerting and reporting for any slowness or errors
• The ability to capture exceptions that happen within the code and alerting to highlight such exceptions

If you found this blog useful, you may also find this recent article, Top 10 Metrics to Track when Monitoring Microsoft IIS Performance of interest. We also have a comprehensive guide to IIS monitoring and administration available which covers deep architectural details underpinning IIS functionality, see: White Paper | The IIS Administrator’s Troubleshooting Guide (eginnovations.com).

Further information:

• Microsoft IIS Monitoring | eG Innovations
• Monitoring Microsoft IIS Performance 
• White Paper | The IIS Administrator’s Troubleshooting Guide (eginnovations.com)
• To learn more support for eG Enterprise support for Web Servers including Microsoft IIS, Nginx and Apache, see: Web Server Monitoring & Performance Monitoring Tools | eG Innovations
• How to Monitor the Performance of Microsoft .NET Applications
• Learn about: Synthetic vs. Real User Monitoring
• Modern Web Application Performance Monitoring (APM) (eginnovations.com)