Microsoft IIS 4.0 Monitoring & Performance

Introduction

With the massive proliferation of web servers in the enterprise, it is important to maintain a monitoring strategy for monitoring those web sites for downtime and other potential problems…

With the massive proliferation of web servers in the enterprise,
it is important to maintain a monitoring strategy for monitoring
those web sites for downtime and other potential problems. The
Internet is revolutionizing the way business is conducted and web
sites and web servers play a key role in that revolution. Companies
that use their web servers to conduct e-business (such as
Amazon.com, E*Trade.com, etc.) rely on their web servers as much as
they rely on any other machine that provides the information to
conduct business.

This reliance on web servers demands a monitoring and management
strategy for the companies’ key web servers. Microsoft’s Internet
Information Server 4.0 is one web server technology that is popular
in the business. This document will give an overview and some
specific details about how to monitor and manage a Microsoft IIS 4.0
web server.

Prerequisites and Assumptions

Several prerequisites and assumptions should be met in order to
proceed with the monitoring.

1. The SNMP service must be installed and configured on each
   server. The SNMP trap destination must be configured to point to a
   network management console where traps can be viewed, sort or
   acted upon by the support organization.
2. To track any disk performance monitors, be sure that disk
   monitoring is enabled by executing “diskperf -y” on the target
   machine.
3. The IIS-specific counters should be installed on all IIS
   Servers. This is normally done through product installation.
4. This document covers “what” to monitor, but does not describe
   “how” or “by what means.” Therefore, a monitoring or management
   tool (of your choice) to monitor and alert on the events of the
   IIS will be necessary if a more sophisticated solution is desired.
   This will allow for the coordination and collaboration of events
   in order to be more proactive and response to the events. Simply
   monitoring events without the need for automation can be achieved
   with built-in operating system or (such as Windows NT Performance
   Monitor counters).
5. Some events state “Need Baseline.” This indicates that a
   baseline of normal activity is necessary to help determine what is
   above or below normal or what would be considered an error. For
   example, CPU utilization should be baselined to determine what is
   the normal utilization of the CPU. From this number, you can
   determine what is abnormal.

 Key

The key to the table is as follows:

– This column defines the problem or
error.

– This column defines how the problem
or error can be detected. Most of the time the method of detection
will be an entry in the Windows NT Event Log or a SNMP trap that is
generated by the machine.

– This column defines what to do when
the problem or error occurs. In order to turn “monitoring” efforts
into “management” efforts, the recommended actions should be
automated to occur when the problem occurs.

– This column defines how often the
monitoring sample should take place. Most monitors need to scan the
system every 30 or 60 minutes, while others may need to scan every 5
minutes, such as a health check of a service.

1 = High priority, notify immediately

2 = Medium priority, notify within 1 hour

3 = Low priority, notify within 24 hours.

– This column defines the thresholds that need
to be monitored. For events, the threshold will always be one. Other
monitors such as cache hit ratio will have a specific
value.

Internet Information Server – Operations

This section details what services and processes need to be
monitored in order to keep the IIS web server operational and
available.

Internet Information Server – Performance