Microsoft IIS

Microsoft IIS

Internet Information Services is an extensible web server software created by Microsoft for use with the Windows NT family. IIS supports HTTP, HTTP/2, HTTPS, FTP, FTPS, SMTP and NNTP.

Available solutions




Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/app/iis_agent


Template App IIS by Zabbix agent

Overview

For Zabbix version: 5.0
The template to monitor IIS (Internet Information Services) by Zabbix that works without any external scripts.
Your server must have the following roles:

Web Server
IIS Management Scripts and Tools

This template was tested on:

  • Windows Server, version 2012R2
  • Zabbix, version 5.0

Setup

1. Import the template (template_app_iis_agent.xml or template_app_iis_agent_active.xml) into Zabbix.

2. Link the imported template to a host with IIS.

3. Optionally, it is possible to customize the template:

  • Set value for the macro {$IIS.QUEUE.MAX.WARN}, if you want to receive alerts when a number of requests in the application pool queue exceeds the threshold.
  • If you use a non-standard port for the IIS, don't forget to update the macros {$IIS.SERVICE} and {$IIS.PORT}.
  • Change the value of macro {$IIS.APPPOOL.MONITORED} to "0", if you want to disable all notifications about application pools state.
    You can also add additional context macro {$IIS.APPPOOL.MONITORED:} for excluding specific application pools from monitoring.
  • Change regexp in the marcos {$IIS.APPPOOL.MATCHES} and {$IIS.APPPOOL.NOT_MATCHES} used for filtering application pools discovery results.

Zabbix configuration

No specific Zabbix configuration is required.

Macros used

Name Description Default
{$IIS.APPPOOL.MATCHES}

This macro is used in application pools discovery. Can be overridden on the host or linked template level.

.+
{$IIS.APPPOOL.MONITORED}

Monitoring status for discovered application pools. Use context to avoid trigger firing for specific application pools. "1" - enabled, "0" - disabled.

1
{$IIS.APPPOOL.NOT_MATCHES}

This macro is used in application pools discovery. Can be overridden on the host or linked template level.

<CHANGE_IF_NEEDED>
{$IIS.PORT}

Listening port.

80
{$IIS.QUEUE.MAX.TIME}

The time during which the queue length may exceed the threshold.

5m
{$IIS.QUEUE.MAX.WARN}

Maximum application pool's request queue length for trigger expression.

``
{$IIS.SERVICE}

The service (http/https/etc) for port check. See "net.tcp.service" documentation page for more information: https://www.zabbix.com/documentation/current/ru/manual/config/items/itemtypes/simple_checks

http

Template links

There are no template links in this template.

Discovery rules

Name Description Type Key and additional info
Application pools discovery

-

ZABBIX_PASSIVE wmi.getall[root\webAdministration, select Name from ApplicationPool]

Filter:

AND

- A: {#APPPOOL} NOT_MATCHES_REGEX {$IIS.APPPOOL.NOT_MATCHES}

- B: {#APPPOOL} MATCHES_REGEX {$IIS.APPPOOL.MATCHES}

Items collected

Group Name Description Type Key and additional info
IIS IIS: World Wide Web Publishing Service (W3SVC) state

The World Wide Web Publishing Service (W3SVC) provides web connectivity and administration of websites through the IIS snap-in. If the World Wide Web Publishing Service stops, the operating system cannot serve any form of web request. This service was dependent on "Windows Process Activation Service".

ZABBIX_PASSIVE service_state[W3SVC]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Windows Process Activation Service (WAS) state

Windows Process Activation Service (WAS) is a tool for managing worker processes that contain applications that host Windows Communication Foundation (WCF) services. Worker processes handle requests that are sent to a Web Server for specific application pools. Each application pool sets boundaries for the applications it contains.

ZABBIX_PASSIVE service_state[WAS]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: {$IIS.PORT} port ping

-

SIMPLE net.tcp.service[{$IIS.SERVICE},,{$IIS.PORT}]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Uptime

Service uptime in seconds.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Service Uptime"]
IIS IIS: Bytes Received per second

The average rate per minute at which data bytes are received by the service at the Application Layer. Does not include protocol headers or control bytes.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Bytes Received/sec", 60]
IIS IIS: Bytes Sent per second

The average rate per minute at which data bytes are sent by the service.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Bytes Sent/sec", 60]
IIS IIS: Bytes Total per second

The average rate per minute of total bytes/sec transferred by the Web service (sum of bytes sent/sec and bytes received/sec).

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Bytes Total/Sec", 60]
IIS IIS: Current connections

The number of active connections.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Current Connections"]
IIS IIS: Total connection attempts

The total number of connections to the Web or FTP service that have been attempted since service startup. The count is the total for all Web sites or FTP sites combined.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Total Connection Attempts (all instances)"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Connection attempts per second

The average rate per minute that connections using the Web service are being attempted. The count is the average for all Web sites combined.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Connection Attempts/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Anonymous users per second

The number of requests from users over an anonymous connection per second. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Anonymous Users/sec", 60]
IIS IIS: NonAnonymous users per second

The number of requests from users over a non-anonymous connection per second. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\NonAnonymous Users/sec", 60]
IIS IIS: Method Method GET requests per second

The rate of HTTP requests made using the GET method. GET requests are generally used for basic file retrievals or image maps, though they can be used with forms. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Get Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method COPY requests per second

The rate of HTTP requests made using the COPY method. Copy requests are used for copying files and directories. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Copy Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method CGI requests per second

The rate of CGI requests that are simultaneously being processed by the Web service. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\CGI Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method DELETE requests per second

The rate of HTTP requests using the DELETE method made. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Delete Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method HEAD requests per second

The rate of HTTP requests using the HEAD method made. HEAD requests generally indicate a client is querying the state of a document they already have to see if it needs to be refreshed. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Head Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method ISAPI requests per second

The rate of ISAPI Extension requests that are simultaneously being processed by the Web service. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\ISAPI Extension Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method LOCK requests per second

The rate of HTTP requests made using the LOCK method. Lock requests are used to lock a file for one user so that only that user can modify the file. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Lock Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method MKCOL requests per second

The rate of HTTP requests using the MKCOL method made. Mkcol requests are used to create directories on the server. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Mkcol Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method MOVE requests per second

The rate of HTTP requests using the MOVE method made. Move requests are used for moving files and directories. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Move Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method OPTIONS requests per second

The rate of HTTP requests using the OPTIONS method made. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Options Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method POST requests per second

Rate of HTTP requests using POST method. Generally used for forms or gateway requests. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Post Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method PROPFIND requests per second

The rate of HTTP requests using the PROPFIND method made. Propfind requests retrieve property values on files and directories. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Propfind Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method PROPPATCH requests per second

The rate of HTTP requests using the PROPPATCH method made. Proppatch requests set property values on files and directories. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Proppatch Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method PUT requests per second

The rate of HTTP requests using the PUT method made. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Put Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method MS-SEARCH requests per second

The rate of HTTP requests using the MS-SEARCH method made. Search requests are used to query the server to find resources that match a set of conditions provided by the client. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Search Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method TRACE requests per second

The rate of HTTP requests using the TRACE method made. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Trace Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method TRACE requests per second

The rate of HTTP requests using the UNLOCK method made. Unlock requests are used to remove locks from files. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Unlock Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method Total requests per second

The rate of all HTTP requests received. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Total Method Requests/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Method Total Other requests per second

Total Other Request Methods is the number of HTTP requests that are not OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, MOVE, COPY, MKCOL, PROPFIND, PROPPATCH, SEARCH, LOCK or UNLOCK methods (since service startup). Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Other Request Methods/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Locked errors per second

The rate of errors due to requests that couldn't be satisfied by the server because the requested document was locked. These are generally reported as an HTTP 423 error code to the client. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Locked Errors/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Not Found errors per second

The rate of errors due to requests that couldn't be satisfied by the server because the requested document could not be found. These are generally reported to the client with HTTP error code 404. Average per minute.

ZABBIX_PASSIVE perf_counter_en["\Web Service(_Total)\Not Found Errors/Sec", 60]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: Files cache hits percentage

The ratio of user-mode file cache hits to total cache requests (since service startup). Note: This value might be low if the Kernel URI cache hits percentage is high.

ZABBIX_PASSIVE perf_counter_en["\Web Service Cache\File Cache Hits %"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: URIs cache hits percentage

The ratio of user-mode URI Cache Hits to total cache requests (since service startup)

ZABBIX_PASSIVE perf_counter_en["\Web Service Cache\URI Cache Hits %"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: File cache misses

The total number of unsuccessful lookups in the user-mode file cache since service startup.

ZABBIX_PASSIVE perf_counter_en["\Web Service Cache\File Cache Misses"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: URI cache misses

The total number of unsuccessful lookups in the user-mode URI cache since service startup.

ZABBIX_PASSIVE perf_counter_en["\Web Service Cache\URI Cache Misses"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: {#APPPOOL} Uptime

The web application uptime period since the last restart.

ZABBIX_PASSIVE perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool Uptime"]
IIS IIS: AppPool {#APPPOOL} state

The state of the application pool.

ZABBIX_PASSIVE perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: AppPool {#APPPOOL} recycles

The number of times the application pool has been recycled since Windows Process Activation Service (WAS) started.

ZABBIX_PASSIVE perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Total Application Pool Recycles"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

IIS IIS: AppPool {#APPPOOL} current queue size

The number of requests in the queue.

ZABBIX_PASSIVE perf_counter_en["\HTTP Service Request Queues({#APPPOOL})\CurrentQueueSize"]

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 10m

Triggers

Name Description Expression Severity Dependencies and additional info
IIS: The World Wide Web Publishing Service (W3SVC) is not running

The World Wide Web Publishing Service (W3SVC) is not in running state. IIS cannot start.

{TEMPLATE_NAME:service_state[W3SVC].last()}<>0 HIGH

Depends on:

- IIS: Windows process Activation Service (WAS) is not the running

IIS: Windows process Activation Service (WAS) is not the running

Windows Process Activation Service (WAS) is not in the running state. IIS cannot start.

{TEMPLATE_NAME:service_state[WAS].last()}<>0 HIGH
IIS: Port {$IIS.PORT} is down

-

{TEMPLATE_NAME:net.tcp.service[{$IIS.SERVICE},,{$IIS.PORT}].last()}=0 AVERAGE

Manual close: YES

Depends on:

- IIS: The World Wide Web Publishing Service (W3SVC) is not running

IIS: has been restarted (uptime < 10m)

Uptime is less than 10 minutes

{TEMPLATE_NAME:perf_counter_en["\Web Service(_Total)\Service Uptime"].last()}<10m INFO

Manual close: YES

IIS: {#APPPOOL} has been restarted (uptime < 10m)

Uptime is less than 10 minutes

{TEMPLATE_NAME:perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool Uptime"].last()}<10m INFO

Manual close: YES

IIS: Application pool {#APPPOOL} is not in Running state

-

{TEMPLATE_NAME:perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"].last()}<>3 and {$IIS.APPPOOL.MONITORED:"{#APPPOOL}"}=1 HIGH
IIS: Application pool {#APPPOOL} has been recycled

-

{TEMPLATE_NAME:perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Total Application Pool Recycles"].diff()}=1 and {$IIS.APPPOOL.MONITORED:"{#APPPOOL}"}=1 INFO
IIS: Request queue of {#APPPOOL} is too large (over {$IIS.QUEUE.MAX.WARN})

-

{TEMPLATE_NAME:perf_counter_en["\HTTP Service Request Queues({#APPPOOL})\CurrentQueueSize"].min({$IIS.QUEUE.MAX.TIME})}>{$IIS.QUEUE.MAX.WARN} WARNING

Depends on:

- IIS: Application pool {#APPPOOL} is not in Running state

Feedback

Please report any issues with the template at https://support.zabbix.com

You can also provide feedback, discuss the template or ask for help with it at ZABBIX forums.

Articles and documentation

+ Propose new article
Add your solution