Is there a way to see current connections on IIS servers?

[eziemer]

Hello,

I am trying to create a dashboard or a search to be able to view the current connections on our IIS servers. The way I am currently doing this is by using Windows Performance monitor adding a counter for Web Service > Current Connections.

But what I am hoping to do is to consolidate this into Splunk so I can have historical data of connections as well as a way to alert via email every morning to show the current number of connections.

Some information that may help:
Currently using Splunk 6.0.3 Build 204106
IIS Servers are Windows Server 2012 R2
IIS version is IIS8
Splunk Forwarder version is 6.2.0-237341-x64

Any help would be appreciated. Thanks in advance!

[hagjos43]

Run this in a real time search (5 minute window or so):

sourcetype="iis" |dedup JSESSIONID| stats count(JSESSIONID)

Found here: http://gosplunk.com/real-time-iis-web-site-connections/

NOTE I'm assuming you are talking about user initiated web-sessions.

[martin_mueller]

This should be faster: sourcetype="iis" | stats dc(JSESSIONID)

[hagjos43]

Martin is correct! (as always) 🙂

[martin_mueller]

You can read Windows Performance Monitor data into Splunk: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Real-timeWindowsperformancemonitoring

[martin_mueller]

You will need to add this to inputs.conf on your forwarder, either locally or through a deployment server - the universal forwarder doesn't have a UI.

[eziemer]

So I have manually edited the inputs.conf file but still no luck on seeing it appear in splunk. What I added to the inputs.conf file is:

[perfmon://CurrentConnections]
interval = 60
object = Web Service
counters = Current Connections
instances = *
disabled = 0
index = perfmon

[somesoni2]

Did you restarted the forwarder after this?

[eziemer]

Yes, I restarted the service called SplunkForwarder on the IIS server that I edited the inputs.conf file on.

[martin_mueller]

You shouldn't even need to do remote monitoring as long as the UF is installed on the machine you want to monitor. Did you try out the paragraph on local monitoring?

[eziemer]

Martin,

I did read through the local monitoring but it seems to be only for the splunk server not the IIS servers I need to monitor.

So when I go to add Local Performance Monitoring I choose web services but I only see the instances on the splunk server rather then the IIS servers. Any ideas?

Thanks again for the help.

[eziemer]

Hey Martin,

I read through that but I still may be missing something, I am using the Universal forwarder and am attempting to add a remote performance monitor data input but when I put in the Host name or IP address it states that WMI is not configured correctly. I thought because I am using the universal forwarder I don't need to use WMI, am I mistaken?