IIS
Introduction
Internet Information Services, also known as IIS, is a Microsoft web server that runs on Windows operating system and is used to exchange static and dynamic web content with internet users.
Getting Started
Compatibility
The IIS O11ySource is compatible with all version greater than or equal to Microsoft IIS 10.0. vuSmartMaps supports the monitoring of your IIS Application Pools, IIS Website and IIS Webserver statistics and traffic trends.
Data Collection Method
vuSmartMaps collects health and performance data for IIS server using VuNet's Healthbeat agent. This agent collects data based on the source configuration. IIS logs are collected using VuNet's Logbeat agent.
Prerequisites
Inputs for Configuring Data Source
- IIS Server: The IP Address/FQDN of the Apache server. This field is the key to identify each server you add here.
- Period [in seconds]: How frequently data is gathered. The period should be between 60 seconds – 3000 seconds.
- IIS Log Path: Enter the IIS logfile's entire path
Firewall Requirement
To collect data from this O11ySource, ensure the following ports are opened:
| Source IP | Destination IP | Destination Port | Protocol | Direction |
|---|---|---|---|---|
| IP address of the IIS Server | vuSmartMaps Data Collector End Point | 9092* | TCP | Inbound |
*Before providing the firewall requirements, please update the port based on the customer environment.
Configuring the Target
In order to gather your IIS Performance metrics and logs, ensure that the default website is enabled in IIS web server. Configure Application Pools in IIS, if not already done. Setup the IIS Logging format to collect additional telemetry from logs.
Configure Logs Collection from IIS Server
The Logbeat agent is used to collect logs from IIS Web Server for log analysis. The log path for the IIS Web Server should be configured in the Logbeat agent configuration for the agent to start collecting the logs. For example, if the log path for the IIS Web Server is "-C:\inetpub\logs\LogFiles\W3SVC1\", this path must be configured in the logbeat agent configuration. This path will contain both access logs and Error Logs. IIS Web Server should be configured to generate logs in W3C format. This format centralizes all URL logs for a session in a single log file and logs each field with a space. In Logging section windows ,select "W3C Extended Log File Format" as the log file format. Click OK.
Configuration Steps
Enablethe IIS O11ySource.- Select the Sources tab and press the
+button to add a new IIS host to be monitored. - Add the required details to configure metrics and logs. Then click on
Next. - The following packages will be available for download:Download Windows Healthbeat Installation Binary - Downloads the full Healthbeat package with required configurations for a fresh installationDownload Windows Healthbeat Update Configuration Binary - Downloads the agent configuration package to update an existing Healthbeat installationDownload Windows Logbeat Installation Binary - Downloads the full Logbeat package with required configurations for a fresh installationDownload Windows Logbeat Update Configuration Binary - Downloads the agent configuration package to update an existing Logbeat installation
- Download the agent installation or update package, then click
Finishto close the data source window.
Metrics Collected
| Name | Description | Data Type |
|---|---|---|
| @timestamp | The timestamp in string format, likely when the event was logged. | String |
| timestamp | The timestamp in DateTime64 format for precise time logging. | DateTime64 |
| iis_webserver_process_cpu_usage_perc | Percentage of CPU usage by the IIS webserver process. | Float64 |
| iis_application_pool_process_cpu_usage_perc | Percentage of CPU usage by the IIS application pool process. | Float64 |
| iis_webserver_network_current_anonymous_users | The current number of anonymous users accessing the webserver. | UInt32 |
| iis_webserver_network_current_non_anonymous_users | The current number of authenticated (non-anonymous) users accessing the webserver. | UInt32 |
| iis_webserver_asp_net_application_restarts | Total number of ASP.NET application restarts. | UInt32 |
| iis_webserver_asp_net_request_wait_time | The wait time for ASP.NET requests in the queue. | UInt32 |
| iis_webserver_asp_net_application_pipeline_instance_count | Number of ASP.NET pipeline instances for the application. | Float64 |
| iis_webserver_asp_net_application_errors_total_pec | Total number of errors in the ASP.NET application. | Float64 |
| iis_webserver_asp_net_application_requests_in_application_queue | Number of requests waiting in the ASP.NET application queue. | Float64 |
| iis_website_network_current_connections | Number of current connections to the website. | UInt32 |
| iis_website_network_maximum_connections | Maximum number of connections to the website. | UInt32 |
| iis_website_network_bytes_received_per_sec | Number of bytes received per second by the website. | Float64 |
| iis_website_network_bytes_sent_per_sec | Number of bytes sent per second by the website. | Float64 |
| iis_website_name | The name of the IIS website. | String |
| beat_hostname | The hostname of the machine sending the metric data. | String |
| iis_application_pool_name | The name of the IIS application pool. | String |
| iis_application_pool_state | The current state of the application pool (e.g., running, stopped). | UInt32 |
| iis_website_network_total_connection_attempts | Total number of connection attempts made to the website. | UInt32 |
| iis_application_pool_worker_processes | Number of worker processes in the application pool. | Float64 |
| iis_webserver_network_get_requests_per_sec | Number of GET requests received per second by the webserver. | Float64 |
| iis_application_pool_total_startup_failed_worker_processes | Total number of worker processes that failed to start in the application pool. | Float64 |
| iis_application_pool_total_ping_failed_worker_processes | Total number of worker processes that failed ping checks. | Float64 |
| iis_application_pool_total_failed_worker_processes | Total number of failed worker processes in the application pool. | Float64 |
| iis_application_pool_total_shutdown_failed_worker_processes | Total number of worker processes that failed during shutdown. | Float64 |
| iis_application_pool_total_application_pool_recycles | Total number of application pool recycles (restarts). | Float64 |
| iis_application_pool_total_startup_failed_worker_processes_diff | Difference in failed worker processes during startup since last check. | Float64 |
| iis_application_pool_total_ping_failed_worker_processes_diff | Difference in failed worker processes due to ping failure since last check. | Float64 |
| iis_application_pool_total_failed_worker_processes_diff | Difference in total failed worker processes since last check. | Float64 |
| iis_application_pool_total_shutdown_failed_worker_processes_diff | Difference in failed worker processes during shutdown since last check. | Float64 |
| iis_application_pool_total_application_pool_recycles_diff | Difference in the number of application pool recycles since last check. | Float64 |
| iis_application_pool_rejected_requests | Total number of rejected requests in the application pool. | Float64 |
| iis_application_pool_current_queue_size | The current size of the application pool request queue. | Float64 |
| host | The host from which the data is collected. | String |
| target | The target system or environment for the metric data. | String |
| iis_webserver_network_post_requests_per_sec | Number of POST requests received per second by the webserver. | Float64 |
| iis_webserver_network_put_requests_per_sec | Number of PUT requests received per second by the webserver. | Float64 |
| iis_application_pool_uptime | The uptime of the IIS application pool in seconds. | Float64 |
| iis_website_network_post_requests_per_sec | Number of POST requests received per second by the website. | UInt64 |
| iis_website_network_put_requests_per_sec | Number of PUT requests received per second by the website. | UInt64 |
| iis_website_network_get_requests_per_sec | Number of GET requests received per second by the website. | Float64 |
| iis_website_network_service_uptime | The uptime of the IIS website service in seconds. | Float64 |
| topic_name | The topic or category associated with the metric data. | String |
| metricset_name | The name of the metric set being collected. | String |
| iis_webserver_cache_current_file_cache_memory_usage | The amount of memory used by the current file cache in the webserver. | UInt32 |
| iis_webserver_cache_output_cache_current_memory_usage | The amount of memory used by the output cache in the webserver. | UInt32 |
| iis_webserver_network_total_non_anonymous_users | The total number of non-anonymous users accessing the webserver. | UInt32 |
| iis_webserver_network_service_uptime | The uptime of the webserver network service in seconds. | Float64 |
| iis_webserver_process_page_faults_per_sec | The number of page faults per second in the IIS webserver process. | Float64 |
| iis_webserver_process_virtual_bytes | The amount of virtual memory used by the IIS webserver process. | Float64 |
| iis_webserver_process_handle_count | The number of handles used by the IIS webserver process. | Float64 |
| iis_webserver_process_working_set | The amount of physical memory used by the IIS webserver process. | Float64 |
| iis_webserver_process_io_write_operations_per_sec | The number of I/O write operations per second in the IIS webserver process. | Float64 |
| iis_webserver_process_io_read_operations_per_sec | The number of I/O read operations per second in the IIS webserver process. | Float64 |
| iis_webserver_asp_net_application_requests_executing | The number of ASP.NET application requests currently being executed. | Float64 |
| iis_webserver_asp_net_application_errors_total_per_sec | The total number of ASP.NET application errors per second. | Float64 |
| iis_webserver_network_total_post_requests | The total number of POST requests received by the webserver. | Float64 |
| iis_webserver_network_total_bytes_received | The total number of bytes received by the webserver. | Float64 |
| iis_webserver_network_total_anonymous_users | The total number of anonymous users accessing the webserver. | Float64 |
| message | The logged message or event details. | String |
| timestamp | The exact time when the event occurred, with high precision. | DateTime64 |
| host | The hostname of the server where the event was logged. | String |
| time_taken | The time taken to process the request, in milliseconds. | UInt32 |
| sc_status | The HTTP status code returned by the server (e.g., 200, 404, 500). | UInt16 |
| cs_Referer | The URL of the referring web page that linked to the requested page. | String |
| cs_method | The HTTP method used for the request (e.g., GET, POST). | String |
| cs_uri_stem | The URI of the requested resource on the server. | String |
| c_ip | The IP address of the client making the request. | String |
| cs_username | The username of the client (if authenticated) making the request. | String |
| http-response | The content of the HTTP response sent back to the client. | String |
| hostname | The specific server or machine where the event originated. | String |
| target | The target environment or application for the logged event. | String |
| geo_city_name | The name of the city from which the request originated. | String |
| geo_country_name | The name of the country from which the request originated. | String |
| geo_timezone | The timezone of the client's geographical location. | String |
| s_ip | The server’s IP address responding to the request. | String |
| s_port | The port on the server used for the response. | String |
| sc_substatus | The substatus code for the HTTP response, providing more detailed status. | UInt16 |
| sc_win32_status | The Win32 status code, which is specific to Windows systems. | UInt16 |
| EventTime | The event timestamp for tracking when the event was recorded. | DateTime64 |
| doc_type | The document or content type associated with the request (e.g., HTML, JSON). | String |
| @timestamp | The timestamp in string format, likely when the event was logged. | String |
