Microsoft KB Archive/323312

= HOW TO: Create an IIS Baseline by Using Performance Log Analysis =

Article ID: 323312

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Internet Information Server 4.0
 * Microsoft Internet Information Services 5.0
 * Microsoft Internet Information Services 6.0

-



This article was previously published under Q323312



We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx



IN THIS TASK

 * SUMMARY
 * IIS 4.0
 * Open the Log File
 * Add Counters in High or Low Logs
 * Review Data from Counters in High or Low Logs
 * IIS 5.0 and 6.0
 * Open the Log File
 * Add Counters in High or Low Logs
 * Review Data from Counters in High or Low Logs
 * REFERENCES



SUMMARY
This step-by-step article describes how to open and analyze performance data that has been gathered by using performance logging. This data can help you to analyze the performance of your Microsoft Windows NT 4.0 Server computer that is running Internet Information Server (IIS) 4.0, your Microsoft Windows 2000 Server computer that is running Internet Information Services (IIS) 5.0, or your Microsoft Windows Server 2003 computer that is running IIS 6.0.

NOTE: It is extremely difficult to pinpoint exact baselines for each server. This article provides help in understanding how to review this data, but it is not intended to review all aspects of server performance. For more information, see the &quot;References&quot; section.

Open the Log File
 Click Start, point to Programs, open the Administrative Tools, and then click Performance Monitor. With the Performance Monitor Microsoft Management Console (MMC) open, click Options, and then click Choose Data From. On the Data From menu, click to select Log File, and then click the ellipsis button (...).  Locate the log file, click to select the file, and then click Open.NOTE: To confirm that the data log file has been opened, view the lower left of the Performance Monitor screen. You see the following: Data: C:\MyLog.Log For example, if the log file is saved to C:\Mylogs\ and the file name is ProcessHigh, you open the C:\Mylogs\ProcessHigh.log file (note that the file name extension may vary based on the type of file that was saved.) 

back to the top

Add Counters in High or Low Logs

 * 1) After you open the file, open the appropriate counter. To do this, click the plus sign (+) in Performance Monitor. Alternatively, on the Edit menu, click Add to Chart to add the counter to the chart.
 * 2) In the Object list, click to select the appropriate object (such as Web Service).
 * 3) In the counter list, click to select the counter. In the instance list, make sure that _Total is selected, and then click Add.
 * 4) Click Done.

back to the top

Review Data from Counters in High or Low Logs
Performance Monitor shows the behavior of the counters in the form of a single line in relation to a scale from 0 to 100. After you determine the time the log ran for (such as four hours), the next step is to determine the average from the Average box in Performance Monitor.

After you run performance baseline logs over the course of one week, a baseline average can be obtained by adding the average of each log and then dividing it by the number of logs that were taken. For example, if the average Anonymous Users\Sec (_Total) in a four-hour time period over five days is an average of the following logs, you can assume that the average Anonymous Users\Sec for your Web applications is 27.4 users during this four-hour period: Day 1 = 22 Day 2 = 28 Day 3 = 23 Day 4 = 35 Day 5 = 29 If this information comes from the WebServiceHigh log, a number that is greater than this can be considered above the maximum norm.

You can follow the same steps for the WebServiceLow log to determine the minimum average over a four-hour period. This produces data such as:

Baseline Averages: WebService\AnonymousUsers\Sec

Minimum = 27.4

back to the top

Open the Log File

 * 1) Open the System Monitor. To do this, click Start, open Control Panel, double-click Administrative Tools, and then double-click Performance.
 * 2) In the left pane of the MMC, click System Monitor.
 * 3) Right-click anywhere in the right pane of the MMC, and then click Properties.
 * 4) In the System Monitor properties, click the Source tab, select Log files, and then click Add.
 * 5) Locate the log file. For example, if the log file is saved to C:\Mylogs\ and the file name is ProcessHigh, you open the C:\Mylogs\Processhigh.blg file (the extension may vary based on saved type.)

back to the top

Add Counters in High or Low Logs
Note Microsoft recommends that you select multiple counters from multiple objects for review for true performance baseline analysis. However, for simplicity, this example only uses one counter.
 * 1) With the System Monitor properties open, click the Data tab to see the counters that are loaded.
 * 2) Click Add, and then click Active Server Pages in the Performance object list.
 * 3) Select Select counters from list.
 * 4) Click Requests Executing, and then click Add.
 * 5) Click Close.

back to the top

Review Data from Counters in High or Low Logs
Performance Monitor shows the behavior of the counters in the form of a single line in relation to a scale from 0 to 100. After you determine the time the log ran for (such as four hours), the next step is to determine the average from the Average box in Performance Monitor.

After you run performance baseline logs over the course of one week, a baseline average can be obtained by adding the average of each log and then dividing it by the number of logs that were taken. For example, if the average Anonymous Users\Sec (_Total) in a four-hour time period over five days was an average of the following logs, you can assume that the average Anonymous Users\Sec for your Web applications is 11.8 users during this four-hour period: Day 1 = 12 Day 2 = 14 Day 3 = 9 Day 4 = 14 Day 5 = 10 If this information comes from the WebServiceHigh log, a number that is greater than this can be considered above the maximum norm.

You can follow the same steps for the WebServiceLow log to determine the minimum average over a four-hour period. This produces data such as:

Baseline Averages: WebService\AnonymousUsers\Sec

Minimum = 11.8

back to the top

