Monitor IIS Server on Windows
IIS monitoring uses WMI query to fetch metrics aggregated across all of the sites, or on a per-site basis. IIS plugin collects metrics for active connections, bytes sent and received, request count by HTTP method, access-log and more.
- Web IIS Server 8.0 or above
- Performance counters should be enabled in IIS manager
Add the plugin configuration in config.yaml file under "C:\Program Files (x86)\Sfagent\" directory as follows to enable this plugin.
sfAgent section provides steps to install and automatically generate plugin configurations. User can also manually add the configuration shown below to config.yaml under "C:/Program Files (x86)/Sfagent/" directory.
key: <profile key>
Name: <unique instance name or will be generated from IP>
appName: <add application name>
projectName: <add project name>
- name: iis
- name: iis-access
IIS Access Log Options
- Geo-IP: Useful to find geographical location of the client using the IP address. To enable, set the option "geo_info" to true in the above configuration.
- User-Agent Analysis: To get the host machine details like browser, Operating system and device by analysis the user-agent. To enable, set the option "ua_parser" to true in the above configuration. If enabled, by default it runs on port 8586.
- URL Normalizer (not supported in container deployment): Normalize incoming URL paths. To enable, set the option "url_normalizer" to true in the above configuration. If enabled, by default it runs on port 8587.
Normalization specific configuration is available in
/opt/sfagent/normalization/config.yaml which resonate the following:
Config Field Description
interval: Normalization algorithm runtime interval.
enabled: Rely on normalization feature for rule generation.
rules_length_limit: Limit over size of generated rules. set the value to -1 for specifying no limit.
log_volume: Limit over number of logs processed. set the value to -1 for specifying no limit.
rules: Rules Generated.
Recommended approach is to run sfagent with dynamic_rule_generation enabled over a period of time. Observe whether rules generated reflect all the web app requests intended to be normalized and if its a true reflection, set enabled flag to false , indicating no further rules will be generated
Default ports used by user-agent analysis and URL Normalizer can be changed respectively with the inclusion of following in config.yaml
Enhance URL Normalization
Refer the following document for comprehensive instructions and guidelines for setting up and developing rules to enhance URL normalization.
Viewing data and dashboards
Dashboard for this data can be instantiated by Importing dashboard template
IIS to the application dashboard.