EventSentry Best Practices

IIS Web sites can be monitored with a VBScript (Windows 2003 and earlier), or monitoring through the Microsoft-IIS-Configuration operational event log (Windows 2008 and later). EventSentry can then issue email (or other) alerts whenever an IIS site is stopped or changes its status.

 

Windows 2008 and later

Windows 2008 and later can log all status change of IIS sites to the Microsoft-Windows-IIS-Configuration event log. By monitoring this event log, we can detect a stopped site in real-time.

 

1. In the Windows event viewer, navigate to the Microsoft-Windows-IIS-Configuration-Operational event log

2. Right-click the log and select "Enable Log"

3. In EventSentry, create a new include filter which looks for the following event properties:

•Custom event log "Microsoft-IIS-Configuration/Operational"

•Event Severity: Information

•Event ID: 29

•Event Source: Microsoft-Windows-IIS-Configuration

 

To further restrict the include filter to only alert when the site is stopped, we add a content filter (in the "Content Filter & Notes" section) with the following condition:

Insertion String #4 matches "*@state"
Insertion String #7 matches "Stopped"

 

The content filters should be chained using AND.

The email subject can optionally also be changed (when using email notifications) to something like "IIS Site Stopped" as well. The previously created filter can also be cloned by copying and pasting the filter, and replacing "Stopped" with "Started", to get a proper notification whenever a site is being started or stopped as well.

To determine which insertion string to filter against, simply open the event in question in the Windows event viewer, switch to the "Friendly" view and view the insertion strings under EventData. The insertion strings are parsed sequentially, with the first entry ("PhysicalPath") being insertion string #1.

 

 

 

Windows Server 2003 and earlier

Follow the steps below to setup IIS monitoring on Windows Server 2003 and earlier.

 

Create the embedded script

 

1.Navigate to the embedded scripts (Tools -> Embedded Scripts) dialog, so that the script to monitor IIS web sites is automatically copied to the target computers.

 

2.Create a new embedded script, and name it "iis_monitor_sites.vbs". Make sure that you set the "Interpreter" to cscript.exe, which ensures that we can capture the return code (%ERRORLEVEL%) correctly.

 

3.Paste the contents of the iis_list_stopped_w3svc_sites.vbs file into the "Script Content" field.

 

Create a system health package with the application scheduler

 

1.Create a new System Health package (right-click "System Health Packages"), and add the "Application Scheduler" object to it.

 

2.In the Application Scheduler object, make sure that Log application return code > 0 to event log as "Error" is checked. This ensures that the EventSentry will log an error to the application event log when the script returns an %ERRORLEVEL% that is not zero.

 

3.Click the plus icon and select the script we created earlier (@iis_monitor_sites.vbs) from the drop-down list. Set the schedule up as recurring and configure the desired interval (e.g. every 5 minutes).

 

4.Assign this package to all computers running IIS. Alternatively, you can also make this package global, and use the "Auto-Detection" feature to only activate the package on computers that have the w3svc service running.