Monitoring IIS

On a Windows host that runs IIS the agent finds the web publishing service and starts asking IIS about its sites, application pools and worker processes every minute. Nothing is installed into IIS and no site is touched. Each site becomes a monitored site the same way an nginx server block does, and an ASP.NET Core application in a pool can get method-level traces through the same staged mechanism as PHP.

How IIS is recognised

The iis definition matches a Windows host with the W3SVC service (World Wide Web Publishing Service) registered. Every minute, with a 15-second budget, the agent runs appcmd.exe from %windir%\system32\inetsrv:

• appcmd list sites for every site, its state and its bindings,
• appcmd list apppools for every application pool and its state,
• appcmd list wps for the running worker processes,
• appcmd list site "<name>" /text:logFile.directory per site, to locate its W3C log directory (W3SVC<id> under the configured folder) for the log shipping below.

A host without appcmd.exe in that folder gets a check that says exactly that instead of silence.

What is collected

Sites and pools. Totals and how many are started, plus a 0/1 started flag per site and per pool, and the started share of each as a percentage computed on the host, so one number can drive a rule.

Worker processes. The number of w3wp processes alive.

Sites as inventory. Every binding hostname (lowercased) becomes a site entry, which is the same unit an nginx or Apache virtual host lands in. A site whose bindings carry no hostname (* or an address only) is recorded under its own name.

Facts shown on the host page: the per-site log directories.

Signal	Metric
Sites total and started	svc.iis.sites, svc.iis.sites_started
Pools total and started	svc.iis.pools, svc.iis.pools_started
Started share, sites and pools	svc.iis.sites_started_pct, svc.iis.pools_started_pct
Worker processes	svc.iis.worker_processes
Per-site state	svc.iis.site.started tagged by site
Per-pool state	svc.iis.pool.started tagged by pool

Names, tags and units are in the metrics reference.

Logs. The logs-iis definition covers the per-site W3C access logs at the directories found above. Access lines are informational by nature, so they are not read until you switch the service to full depth in the console; the default stream ships nothing from them. See Logs.

Alerts out of the box

Rule	Fires when	Severity	Ships
IIS site is stopped	a site reads Stopped for 5 minutes	warning	on
IIS application pool is stopped	an application pool reads Stopped for 5 minutes	warning	on

Both rules split per site and per pool, so one stopped site is one incident that names it. Five minutes clears a recycle and a quick stop-and-start during a deployment. A pool whose worker process has been idled out by IIS still reads Started, so idle pools never fire; only a pool or site someone stopped does, which also means a site you keep stopped on purpose will raise an incident until you disable the rule for that host. Thresholds and hysteresis for each rule are in the rules catalog.

Going deeper

• APM for .NET. The apm-dotnet-iis definition matches the same W3SVC service and provisions the .NET instrumentation for an application pool. The change is staged and reported as an action for you; a human applies it with a pool recycle when it suits them, the agent never recycles a pool itself. Once active, requests, their SQL calls and outbound HTTP show up as traces. A CPU flame graph of the application is sampled every five minutes through the runtime's own EventPipe, with no change to the pool. See APM: how it works.
• SQL Server on the same box is covered by Monitoring SQL Server, and the host's Event Log ships alongside.

When a path is not where IIS says it is

The log directories come from each site's logFile.directory. To point the agent elsewhere, in PowerShell run as Administrator:

wakora --set iis.access-log=D:\Logs\W3SVC1,D:\Logs\W3SVC2

A comma-separated list names several directories. Keys are listed in Agent configuration.

Limitations

• Request rates and latency are not counted from the W3C logs, and there is no eBPF on Windows, so those numbers arrive only through the .NET instrumentation once it is active.
• IIS sites are inventoried and counted as sites, but the per-site HTTP, certificate and DNS checks described on Websites and domains run for nginx and Apache sites only.
• Log directories are resolved for the first 20 sites, and only directories that exist are recorded.
• The probe depends on appcmd.exe. A host where the IIS management tools are absent gets a failing check that names the missing path.

Related

• Monitoring the Windows Event Log
• Monitoring SQL Server and Monitoring Hyper-V
• Installing the agent on Windows
• Features on the main site