topic Re: Is there a way to see current connections on IIS servers? in Getting Data In

Is there a way to see current connections on IIS servers?

eziemer — Tue, 18 Nov 2014 17:51:14 GMT

Hello,

I am trying to create a dashboard or a search to be able to view the current connections on our IIS servers. The way I am currently doing this is by using Windows Performance monitor adding a counter for Web Service > Current Connections.

But what I am hoping to do is to consolidate this into Splunk so I can have historical data of connections as well as a way to alert via email every morning to show the current number of connections.

Some information that may help:
Currently using Splunk 6.0.3 Build 204106
IIS Servers are Windows Server 2012 R2
IIS version is IIS8
Splunk Forwarder version is 6.2.0-237341-x64

Any help would be appreciated. Thanks in advance!

Re: Is there a way to see current connections on IIS servers?

martin_mueller — Tue, 18 Nov 2014 18:35:46 GMT

You can read Windows Performance Monitor data into Splunk: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Real-timeWindowsperformancemonitoring

Re: Is there a way to see current connections on IIS servers?

hagjos43 — Tue, 18 Nov 2014 21:08:14 GMT

Run this in a real time search (5 minute window or so):

sourcetype="iis" |dedup JSESSIONID| stats count(JSESSIONID)

Found here: http://gosplunk.com/real-time-iis-web-site-connections/

NOTE I'm assuming you are talking about user initiated web-sessions.

Re: Is there a way to see current connections on IIS servers?

martin_mueller — Tue, 18 Nov 2014 21:15:41 GMT

This should be faster: sourcetype="iis" | stats dc(JSESSIONID)

Re: Is there a way to see current connections on IIS servers?

hagjos43 — Tue, 18 Nov 2014 21:26:23 GMT

Martin is correct! (as always) 🙂

Re: Is there a way to see current connections on IIS servers?

eziemer — Tue, 18 Nov 2014 22:30:32 GMT

Hey Martin,

I read through that but I still may be missing something, I am using the Universal forwarder and am attempting to add a remote performance monitor data input but when I put in the Host name or IP address it states that WMI is not configured correctly. I thought because I am using the universal forwarder I don't need to use WMI, am I mistaken?

Re: Is there a way to see current connections on IIS servers?

martin_mueller — Tue, 18 Nov 2014 22:51:58 GMT

You shouldn't even need to do remote monitoring as long as the UF is installed on the machine you want to monitor. Did you try out the paragraph on local monitoring?

Re: Is there a way to see current connections on IIS servers?

eziemer — Wed, 19 Nov 2014 15:42:05 GMT

Martin,

I did read through the local monitoring but it seems to be only for the splunk server not the IIS servers I need to monitor.

So when I go to add Local Performance Monitoring I choose web services but I only see the instances on the splunk server rather then the IIS servers. Any ideas?

Thanks again for the help.

Re: Is there a way to see current connections on IIS servers?

martin_mueller — Wed, 19 Nov 2014 18:43:14 GMT

You will need to add this to inputs.conf on your forwarder, either locally or through a deployment server - the universal forwarder doesn't have a UI.

Re: Is there a way to see current connections on IIS servers?

eziemer — Fri, 21 Nov 2014 20:54:01 GMT

So I have manually edited the inputs.conf file but still no luck on seeing it appear in splunk. What I added to the inputs.conf file is:

[perfmon://CurrentConnections]
interval = 60
object = Web Service
counters = Current Connections
instances = *
disabled = 0
index = perfmon

Re: Is there a way to see current connections on IIS servers?

somesoni2 — Fri, 21 Nov 2014 21:07:36 GMT

Did you restarted the forwarder after this?

Re: Is there a way to see current connections on IIS servers?

eziemer — Fri, 21 Nov 2014 21:25:25 GMT

Yes, I restarted the service called SplunkForwarder on the IIS server that I edited the inputs.conf file on.