Pandora FMS: IIS Enterprise Plugin
0 likes1,805 views
The document is a comprehensive administrator manual for monitoring ISS servers using Pandora FMS, detailing installation, configuration, and the various monitoring capabilities available via PowerShell. It covers topics including performance counter monitoring, IIS status and events verification, and the necessary documentation and permissions for effective plugin operation. Additionally, it outlines compatibility requirements and provides examples of command line usage for monitoring distinct IIS components.
Pandora FMS: IIS Enterprise Plugin
- 1. Pandora FMS Administrator Manual ISS Servers Monitoring
- 2. Administrator Manual ISS Servers Monitoring © Artica Soluciones Tecnológicas 20052012 Index 1Changelog...........................................................................................................................................3 2Introduction........................................................................................................................................4 3Compatibility Matrix..........................................................................................................................5 4Documentation provided by the requesting area................................................................................6 5Modules provided by the plugin.........................................................................................................7 6Installing...........................................................................................................................................11 7Default monitoring...........................................................................................................................12 7.1.General Monitoring..................................................................................................................12 7.2.Additional Configuration Fixes...............................................................................................12 7.2.1.Monitoring via Powershell...............................................................................................12 7.2.2.Monitoring the IIS register...............................................................................................16 7.2.3.IIS Events Monitoring......................................................................................................18 7.2.4.Monitoring the IIS status..................................................................................................18 8File explanation................................................................................................................................20 9Software Agent Modules classification by default ..........................................................................21 9.1.Disk space verification and Resources....................................................................................21 9.2.Services Verification ...............................................................................................................21 9.3.Status Verification in IIS.........................................................................................................21 9.4.Event Verification in IIS..........................................................................................................22 9.5.Logs Verification en IIS..........................................................................................................22 9.6. Performance Counters Verification........................................................................................22
- 3. 1 CHANGELOG Date Author Change Version 17/03/12 Dario First version v1r1 27/11/12 Mario_P Change code v1r3 Page 3
- 4. 2 INTRODUCTION This document has as main objective the description of the massive monitoring of performance counters in Windows environments with a II service integrated, and also the monitoring of the status of Sites, Application Pools, URLs and the events and registers of this service. To extract the information we use these: • Powershell 2.0 Console(installed by default in Windows Server 2008 R2 and Windows 7). Available from Windows XP SP2 and forward. • An “open” interface (the one from Pandora, as extension of the administration section) to specify free SQL queries. • The system, that is integrated with the Windows agent, and has the capacity to distribute file collections, so it is possible to distribute the plugin and also the file collections in an individual way by agentand/or by policy . • The SnapIn or the “WebAdministration” Powershell module, this is, the IIS administration console for Powershell It is important to mention that the Performance Counters monitoring plugin could be used to collect information kind numeric (to do performance management), whereas the IIS register monitoring plugin is more aimed to the troubleshooting and the execution as the log analysis tool, than to the synchronous monitoring. Page 4
- 5. 3 COMPATIBILITY MATRIX The plugin compatibility matrix is the following: Systems where it has been tested • Windows Server 2008 Systems where it should work • Same system or higher Depending on the system language, the format of the counters to monitor could change, so it will be necessary to adapt the counters.txt file according to those circunstances. Page 5
- 6. 4 DOCUMENTATION PROVIDED BY THE REQUESTING AREA The requesting area must send the following information: • Device requirements: ◦ Pandora FMS agents installed • A Powershell 2.0 console to execute the plugin. By default it comes installed in Windows Server 2008 R2 and Windows 7 systems, but it should be downloaded for previous Windows versions. Powershell is not compatible with Windows XP SP1 and lower. • It is necessary that the user with which the Pandora FMS agent is executed, who is the user that will execute the plugin has available the following system permissions: ◦ Local administration • Poweshell scripts execution policy should be fixed as RemoteSigned or lower: Set-ExecutionPolicy RemoteSigned • The different plugins will automatically get the information about all the counters that we have specified to them in a list in the file counters.txt and will generate one module by each one in Pandora Plugin PerfCounter). And they also will get information about the status of the critical elements for the IIS (Plugin IIS Status) server and also about the IIS registers and the generated events that are related to it(Plugin IIS Logs e IIS Events) Page 6
- 7. 5 MODULES PROVIDED BY THE PLUGIN • Service verification ◦ Serv_IISADMIN ◦ Serv_MSFTPSVC ◦ Serv_NntpSvc ◦ Serv_SMTPSVC ◦ Serv_W3SVC ◦ Serv_HTTPFilter • IIS status verification ◦ AppPool Status – AppPoolName ◦ Site Status – SiteName ◦ WebURL Status – URL • IIS events verification ◦ Event ID • IIS logs verification ◦ Error 404 – IIS Hostname ◦ Error 500 – IIS Hostname ◦ Error 503 – IIS Hostname ◦ Error 504 – IIS Hostname ◦ Error 505 – IIS Hostname • Performance counter verification ◦ Web Service(*)Total Bytes Sent ◦ Web Service(*)Bytes Sent/sec ◦ Web Service(*)Total Bytes Received ◦ Web Service(*)Bytes Received/sec ◦ Web Service(*)Total Bytes Transferred ◦ Web Service(*)Bytes Total/sec Page 7
- 8. ◦ Web Service(*)Total Files Sent ◦ Web Service(*)Files Sent/sec ◦ Web Service(*)Total Files Received ◦ Web Service(*)Files Received/sec ◦ Web Service(*)Total Files Transferred ◦ Web Service(*)Files/sec ◦ Web Service(*)Current Anonymous Users ◦ Web Service(*)Current NonAnonymous Users ◦ Web Service(*)Total Anonymous Users ◦ Web Service(*)Anonymous Users/sec ◦ Web Service(*)Total NonAnonymous Users ◦ Web Service(*)NonAnonymous Users/sec ◦ Web Service(*)Maximum Anonymous Users ◦ Web Service(*)Maximum NonAnonymous Users ◦ Web Service(*)Current Connections ◦ Web Service(*)Maximum Connections ◦ Web Service(*)Total Connection Attempts (all instances) ◦ Web Service(*)Connection Attempts/sec ◦ Web Service(*)Total Logon Attempts ◦ Web Service(*)Logon Attempts/sec ◦ Web Service(*)Total Options Requests ◦ Web Service(*)Options Requests/sec ◦ Web Service(*)Total Get Requests ◦ Web Service(*)Get Requests/sec ◦ Web Service(*)Total Post Requests ◦ Web Service(*)Post Requests/sec ◦ Web Service(*)Total Head Requests ◦ Web Service(*)Head Requests/sec Page 8
- 9. ◦ Web Service(*)Total Put Requests ◦ Web Service(*)Put Requests/sec ◦ Web Service(*)Total Delete Requests ◦ Web Service(*)Delete Requests/sec ◦ Web Service(*)Total Trace Requests ◦ Web Service(*)Trace Requests/sec ◦ Web Service(*)Total Move Requests ◦ Web Service(*)Move Requests/sec ◦ Web Service(*)Total Copy Requests ◦ Web Service(*)Copy Requests/sec ◦ Web Service(*)Total Mkcol Requests ◦ Web Service(*)Mkcol Requests/sec ◦ Web Service(*)Total Propfind Requests ◦ Web Service(*)Propfind Requests/sec ◦ Web Service(*)Total Proppatch Requests ◦ Web Service(*)Proppatch Requests/sec ◦ Web Service(*)Total Search Requests ◦ Web Service(*)Search Requests/sec ◦ Web Service(*)Total Lock Requests ◦ Web Service(*)Lock Requests/sec ◦ Web Service(*)Total Unlock Requests ◦ Web Service(*)Unlock Requests/sec ◦ Web Service(*)Total Other Request Methods ◦ Web Service(*)Other Request Methods/sec ◦ Web Service(*)Total Method Requests ◦ Web Service(*)Total Method Requests/sec ◦ Web Service(*)Total CGI Requests ◦ Web Service(*)CGI Requests/sec Page 9
- 10. ◦ Web Service(*)Total ISAPI Extension Requests ◦ Web Service(*)ISAPI Extension Requests/sec ◦ Web Service(*)Total Not Found Errors ◦ Web Service(*)Not Found Errors/sec ◦ Web Service(*)Total Locked Errors ◦ Web Service(*)Locked Errors/sec ◦ Web Service(*)Current CGI Requests ◦ Web Service(*)Current ISAPI Extension Requests ◦ Web Service(*)Maximum CGI Requests ◦ Web Service(*)Maximum ISAPI Extension Requests ◦ Web Service(*)Current CAL count for authenticated users ◦ Web Service(*)Maximum CAL count for authenticated users ◦ Web Service(*)Total count of failed CAL requests for authenticated users ◦ Web Service(*)Current CAL count for SSL connections ◦ Web Service(*)Maximum CAL count for SSL connections ◦ Web Service(*)Total count of failed CAL requests for SSL connections ◦ Web Service(*)Total Blocked Async I/O Requests ◦ Web Service(*)Total Allowed Async I/O Requests ◦ Web Service(*)Total Rejected Async I/O Requests ◦ Web Service(*)Current Blocked Async I/O Requests ◦ Web Service(*)Measured Async I/O Bandwidth Usage ◦ Web Service(*)Total blocked bandwidth bytes. ◦ Web Service(*)Current blocked bandwidth bytes. ◦ Web Service(*)Service Uptime Page 10
- 11. 6 INSTALLING Copy the plugins to the agent plugin directory, distributing it through file collections. Do the same with the additional files that it requires. The call from the agent will be similar to this, but using the paths where the plugin and the list are installed. For example: module_plugin "<ruta-powershell>powershell.exe" -command C:'<ruta- plugin>Pandora_Plugin_PerfCounter_vx.y.ps1' -list C:'<ruta-listado>counters.txt' 2> counter_plugin.error Page 11
- 12. 7 DEFAULT MONITORING The Windows systems default monitoring includes: • System resources monitoring • Service monitoring • System log and events monitoring • Performance counters monitoring 7.1. General Monitoring As we have lot of experience with Windows environments, we have considered that some modules are interesting for a monitoring, and because of this they come installed by default in the pandora_agent.conf. There are several templates of configuration and plugins, with diferent modules by default in each case, for each technology, apart from the default template. 7.2. Additional Configuration Fixes NOTE: It is very important to consider that the configuration files thought for the plugin in WINDOWS should be edited and saved with carriage returns type “WINDOWS” and that if we use “UNIX” type carriage returns, the plugin won't work correctly . There are some specific checks that have their own configuration “tokens”, that are described next: 7.2.1. Monitoring via Powershell Considering that we have already installed and configured both Pandora and the system to monitor, we are going to explain how to get information about the IIS server status in general, from the activity of the different services to specific Powershell counters that through different cmdlets will be in charge of checking critical elements of our systems In this case, we will install both a Pandora software agent and the different plugins of the Powershell agent in that machine. Summarizing, an agent plugin is one script that is executed in the local machine where the software agent is installed and that extract an useful information in XML format that the agent is going to send after to the Pandora server in order to be procesed). To do that the Pandora software agent that we have installed in our server to monitor execute that scritp, we should edit the agent configuration file and do the call to the plugin through the module_plugin configuration token. Page 12
- 13. We are going to edit the Pandora agent configuration file from the Pandora FMS administration console. To do this, we have first to activate the remote_config option in the same file to 1. This file is located by default at: C:Archivos de programapandora_agentpandora_agent.conf As we could edit the configuration by remote, we go to the Administration>Agent management and click on the remote configuration of the agent that we want to configure, List of agents in the Pandora FMS management view We introduce the following at the end of the configuration file, for example: # Agent Plugins for IIS Monitoring module_plugin "<ruta-powershell>powershell.exe" -command C:'<ruta- plugin>Pandora_Plugin_IIS_Log_v1.0.ps1' -format W3C -offset 1 -i 300 -path C:'<ruta-logs>' 2> regplugin_error.log module_plugin "<ruta-powershell>powershell.exe" -command C:'<ruta- plugin>Pandora_Plugin_IIS_Events_v1.0.ps1' -i 300 2> eventplugin_error.log module_plugin "<ruta-powershell>powershell.exe" -command "C:'<ruta- plugin>Pandora_Plugin_IIS_Status_v1.0.ps1' -select all -list C:'<ruta- listado>URLs.txt'" module_plugin "<ruta-powershell>powershell.exe" -command C:'<ruta- plugin>Pandora_Plugin_PerfCounter_vx.y.ps1' -list C:'<ruta-listado>counters.txt' 2> counter_plugin.error Page 13
- 15. This process will be explained in detail through this document. One of the most powerfull characteristics of the plugin in Powershell, is the possibility of specifying instead of create one by one modules for each performance counter, select all the counters that are specified in one list, as the plugin will do a single check and generate automatically one module for all these counters, optimizing at maximum the time to extract the information. Those list should be located in the same folder where the plugin is, with the name counters.txt. Lets see an example of its content: Web Service(*)Total Bytes Sent Web Service(*)Bytes Sent/sec Web Service(*)Total Bytes Received Web Service(*)Bytes Received/sec As these counters have counters.txt, the plugin will do one module for each one of them. If one counter has several instances, as in the case of (*), the plugin will do one module for each one of the instaces of the counter. For the development of any other plugin that gets information via Powershell it is important to consider the cmdlet use: select-object -property * In base to this cmdlet, we could add it after any other cmdlet that give us statistics, preceded by (|), and it will give us information about all the properties that this cmdlet has, though when executing the first cmdlet in a general way without using parameters, it will only return a default info list. This way, our monitoring posibilities using Powershell are considerably extended. In case that we want to add new modules to our plugin, before doing anything, try to execute the cmdlet from which we want to get information together with the previousy mentioned to could get all the information posible. An example of the use of this command would be this: Get-Service | Select-Object -Property * Usually, the result of the GetService cmdlet would be a list in table format of all the services with their description and status. Though, when applying this second cmdlet, we will get, for each service, information of all the properties that this service has: Page 15
- 16. Name : service RequiredServices : {service1, service2} CanPauseAndContinue : False CanShutdown : True CanStop : True DisplayName : This is a Windows Service DependentServices : {service3} MachineName : . ServiceName : service ServicesDependedOn : {service1, service2} ServiceHandle : SafeServiceHandle Status : Stopped ServiceType : Win32ShareProcess Site : Container : 7.2.2. Monitoring the IIS registe r It is possible to activate, if it isn't, the IIS register, to store one log with all these connections and its status code, in the server side, as it is specified in the Microsoft articles: http://support.microsoft.com/kb/318380/es http://support.microsoft.com/kb/313437/es It is possible to define modules that check the content of this register and that reports and generate event any time that it founds information of these error codes that implies a service stop. With this aim, we have developped a Powershell plugin to which, showing the store path of the IIS logs or the path of one specific log file, will search in the selected log or in the current log in use, in all the try of connection against the IIS, those which HTTP status code results to be one of the following ones: – 404: Not Found – 500: Internal Server Error – 503: Service Unavailable – 504: Gateway Timeout – 505: HTTP Version Not Supported Page 16
- 17. This plugin parameters are the following: -i Interval in seconds to look for new events -offset Timezone difference (W3C Format Only - Timestamp in W3C log entries is displayed in GMT zone) -format IIS Log Format (W3C, IIS, NCSA) -file Path to a specific IIS log file (not to be used with the path parameter) -path Path to the IIS logs directory (not to be used with the file paramenter) Usage example for a server with a local time of GMT+1: .Pandora_Plugin_IIS_Log_v1.0.ps1 -format W3C -i 300 -offset 1 -path L:ExchangeLogsIISW3SVC1 2> plugin_error.log For the correct work of the plugin, it is important to consider that: – The intervale to use should be the same that the agent intervale. – In case of using the W3C log format (by default), you should use the offset parameter to fix the different schedule from GMT to GMT+1(1). – If you use the W3C log format, you should use the default log fields. The contrary will mean a modification of the plugin in a code level. – In case that the logs would not be created daily (by default) but that there would be a single log, it will be advisable to use the file parameter instead of path. – If the logs are created daily( by default), schedule, weekly or monthy, you should used the path parameter instead of file. In any case, it will be better the creation by default or the schedule to have more speed in the presentation of the data extracted of the log. The problem consist in that the specific HTTP (xxx.x) status codes will be only shown to the client in the navigator, as that IIS register store only simple state code, so additionaly and both for the case of the control of thes specific codes and also to check the connectivity on the client side correctly. To this we can add that the fact that in same specific implementations, the number of daily or schedule connections is that, in the IIS connection register is so big that the plugin is not able to process quick enough to define a synchronous monitoring, so its use is more oriented to the troubleshooting than to the monitoring. Page 17
- 19. Although, this plugin doesn't support the use of POST against those URLs, only GET requests. To simulate the autentication process and the mail sending/reception it is necessary the implementation of the Goliat checks previously commented. The parameters of this plugin are these: -select all All operations are executed -select server-status Only operations to check sites and application pools are executed -select web-status Only operations to check HTTP status codes from an URL list are executed -list Provides a path for a list with URLs to check (to use with all and webstatus only) Usage example: .Pandora_Plugin_IIS_v1.0.ps1 -select all -list URLs.txt 2> plugin_error.log We can choose between executing all the operations or check only the status of Websites and Application Pools, or only the web checks. Modules generated by the IIS status plugin Page 19
- 20. 8 FILE EXPLANATION – IIS Monitoring – Powershell.exe – counters.txt: Contains the list of performance counters to monitor. This file should be located in the same path where the Powershell plugin is executed. – URLs.txt: Contains the list of URLs to monitor.This file should be located in the same path of the Powershell plugin. – Pandora_Plugin_PerfCounter_vx.y.ps1: Plugin for the complete monitoring of performance counters. – Pandora_Plugin_IIS_Status_vx.y.ps1: Plugin to monitor the status of IIS WebSites, ApplicationPools and URLs. – Pandora_Plugin_IIS_Logs_vx.y.ps1: Plugin to monitor the error codes in the IIS registers. – Pandora_Plugin_IIS_Events_vx.y.ps1: plugin to monitor the event system that are related with IIS. Page 20
- 21. 9 SOFTWARE AGENT MODULES CLASSIFICATION BY DEFAULT 9.1. Disk space verification and Resources The disk space verification is done through the plugin Pandora_Plugin_Win32Volume.ps1 and is applied in the Windows general policy. The resource verification is done through modules in the Windows policy itself. 9.2. Services Verification Next is shown a list with some of the most important service to monitor int a system with IIS server incorporated.There is other serie of necessary services that are included in the Windows operative systems general monitoring policy: – IIS Monitoring – Serv_IISADMIN – Serv_MSFTPSVC – Serv_NntpSvc – Serv_SMTPSVC – Serv_W3SVC – Serv_HTTPFilter 9.3. Status Verification in IIS The verification of the status of the IIS servers is done through the Pandora_Plugin_IIS_Status.ps1 plugin, and could be applied in the IIS specific technology in a generic way or adding different URL list for different agents when doing simple web checks. Generated modules: – IIS Monitoring – AppPool Status – AppPoolName – Site Status – SiteName – WebURL Status – URL Page 21
- 22. 9.4. Event Verification in IIS The IIS server events verification is done through the Pandora_Plugin_IIS_Events.ps1 plugin and could be applied in the IIS specific technology, in a general way. Generated modules: – IIS Monitoring – Event ID Other option is to create software agent modules to monitor some of the more important Event IDS of this technology. 9.5. Logs Verification en IIS The verification of connection logs of the IIS servers is done through the Pandora_Plugin_IIS_Logs.ps1 and could be applied in the IIS specific technology in a general way for each server and for each site. Generated modules: – IIS Monitoring – Error 404 – IIS Hostname – Error 500 – IIS Hostname – Error 503 – IIS Hostname – Error 504 – IIS Hostname – Error 505 – IIS Hostname 9.6. Performance Counters Verification The verification of performance counters is done through the Pandora_Plugin_PerfCounter.ps1 plugin and could be applied in different policies for different technologies, each of them with different list of counters, depending on which we want to monito of each one of those technologies. Page 22
- 23. We show here the list of counters that can be monitor in the IIS case: – IIS Monitoring – Web Service(*)Total Bytes Sent – Web Service(*)Bytes Sent/sec – Web Service(*)Total Bytes Received – Web Service(*)Bytes Received/sec – Web Service(*)Total Bytes Transferred – Web Service(*)Bytes Total/sec – Web Service(*)Total Files Sent – Web Service(*)Files Sent/sec – Web Service(*)Total Files Received – Web Service(*)Files Received/sec – Web Service(*)Total Files Transferred – Web Service(*)Files/sec – Web Service(*)Current Anonymous Users – Web Service(*)Current NonAnonymous Users – Web Service(*)Total Anonymous Users – Web Service(*)Anonymous Users/sec – Web Service(*)Total NonAnonymous Users – Web Service(*)NonAnonymous Users/sec – Web Service(*)Maximum Anonymous Users – Web Service(*)Maximum NonAnonymous Users – Web Service(*)Current Connections – Web Service(*)Maximum Connections – Web Service(*)Total Connection Attempts (all instances) – Web Service(*)Connection Attempts/sec – Web Service(*)Total Logon Attempts – Web Service(*)Logon Attempts/sec – Web Service(*)Total Options Requests – Web Service(*)Options Requests/sec – Web Service(*)Total Get Requests – Web Service(*)Get Requests/sec – Web Service(*)Total Post Requests – Web Service(*)Post Requests/sec – Web Service(*)Total Head Requests – Web Service(*)Head Requests/sec – Web Service(*)Total Put Requests – Web Service(*)Put Requests/sec – Web Service(*)Total Delete Requests – Web Service(*)Delete Requests/sec – Web Service(*)Total Trace Requests – Web Service(*)Trace Requests/sec – Web Service(*)Total Move Requests – Web Service(*)Move Requests/sec Page 23
- 24. – Web Service(*)Total Copy Requests – Web Service(*)Copy Requests/sec – Web Service(*)Total Mkcol Requests – Web Service(*)Mkcol Requests/sec – Web Service(*)Total Propfind Requests – Web Service(*)Propfind Requests/sec – Web Service(*)Total Proppatch Requests – Web Service(*)Proppatch Requests/sec – Web Service(*)Total Search Requests – Web Service(*)Search Requests/sec – Web Service(*)Total Lock Requests – Web Service(*)Lock Requests/sec – Web Service(*)Total Unlock Requests – Web Service(*)Unlock Requests/sec – Web Service(*)Total Other Request Methods – Web Service(*)Other Request Methods/sec – Web Service(*)Total Method Requests – Web Service(*)Total Method Requests/sec – Web Service(*)Total CGI Requests – Web Service(*)CGI Requests/sec – Web Service(*)Total ISAPI Extension Requests – Web Service(*)ISAPI Extension Requests/sec – Web Service(*)Total Not Found Errors – Web Service(*)Not Found Errors/sec – Web Service(*)Total Locked Errors – Web Service(*)Locked Errors/sec – Web Service(*)Current CGI Requests – Web Service(*)Current ISAPI Extension Requests – Web Service(*)Maximum CGI Requests – Web Service(*)Maximum ISAPI Extension Requests – Web Service(*)Current CAL count for authenticated users – Web Service(*)Maximum CAL count for authenticated users – Web Service(*)Total count of failed CAL requests for authenticated users – Web Service(*)Current CAL count for SSL connections – Web Service(*)Maximum CAL count for SSL connections – Web Service(*)Total count of failed CAL requests for SSL connections – Web Service(*)Total Blocked Async I/O Requests – Web Service(*)Total Allowed Async I/O Requests – Web Service(*)Total Rejected Async I/O Requests – Web Service(*)Current Blocked Async I/O Requests – Web Service(*)Measured Async I/O Bandwidth Usage – Web Service(*)Total blocked bandwidth bytes. – Web Service(*)Current blocked bandwidth bytes. – Web Service(*)Service Uptime Page 24