Troubleshooting IIS with IISKeeper: Common Issues and Fixes

IISKeeper: The Complete Guide to Monitoring and Securing IIS Servers

Overview

IISKeeper is a tool designed to monitor, harden, and secure Microsoft Internet Information Services (IIS) web servers. This guide explains how IISKeeper works, what it monitors, how to set it up, and practical steps to use it for ongoing security and performance management.

Key features

• Real-time monitoring: Tracks server health, application pools, CPU, memory, and request queues.
• Alerting: Configurable notifications for service failures, resource thresholds, and suspicious activity.
• Log analysis: Centralized collection and parsing of IIS logs to surface errors, slow requests, and anomalous patterns.
• Configuration hardening: Automated checks for insecure IIS settings and recommendations to remediate them.
• Access controls: Monitors authentication modes, TLS versions, and certificate status.
• Integration: Works with SIEMs and notification channels (email, Slack, webhooks).

Pre-deployment checklist

1. Inventory servers: List all IIS instances, OS versions, and hosted applications.
2. Backup configuration: Export IIS configuration and site bindings.
3. Permissions: Ensure an account with read access to IIS configuration, logs, and performance counters.
4. Network access: Allow the monitoring host to reach each server’s management ports and log locations.
5. Plan alerts: Define thresholds for CPU, memory, app pool recycles, failed requests, and SSL expiry.

Installation and initial configuration

1. Install IISKeeper on a dedicated monitoring server or as an agent on each IIS host.
2. Provide credentials (least privilege) for accessing WMI/WinRM and log directories.
3. Configure collection intervals (default 60–300 seconds for metrics; longer for logs).
4. Connect IISKeeper to your notification channels and SIEM.
5. Run an initial discovery to populate sites, application pools, and certificates.

What to monitor (recommended metrics)

• Application pools: uptime, recycle count, worker process crash rate.
• CPU & memory: per-process and system-level usage.
• Request metrics: requests/sec, average request duration, max latency.
• Error rates: HTTP 4xx/5xx counts and trends.
• Failed Request Tracing (FREB): capture high-latency and failing requests.
• Event logs: System, Application, Security entries correlated with IIS events.
• SSL/TLS: certificate expirations, weak ciphers, protocol versions.
• File integrity: changes to web.config, application binaries, and critical folders.

Alert tuning and thresholds

• Set conservative thresholds initially (e.g., CPU > 80% for 5 minutes) and iterate.
• Use rate-based alerts for error spikes (e.g., 500 errors > 50 in 10 minutes) rather than single events.
• Suppress noisy alerts by excluding known maintenance windows and health-check traffic.
• Implement escalation: paged alerts for critical outages, email for warnings.

Hardening recommendations via IISKeeper

• Disable uncommon or legacy IIS modules.
• Enforce TLS 1.2+ and disable SSLv2/3 and TLS 1.0/1.1.
• Remove weak ciphers and prefer ECDHE suites.
• Use HSTS and secure cookie flags for web applications.
• Lock down directory permissions; run app pools with least privilege.
• Block or rate-limit suspicious request patterns and brute-force attempts.
• Regularly rotate and monitor certificate validity.

Log analysis workflows

• Centralize IIS logs (W3C) and enable FREB for deep troubleshooting.
• Create dashboards for top URLs by latency, failed requests, and client IPs.
• Use pattern detection to surface credential stuffing, SQLi attempts, or scraping.
• Correlate IIS logs with Windows Event Logs and firewall logs for incident investigation.

Incident response playbook

1. Detect: Alert triggers (e.g., sudden error spike, app pool crashes).
2. Contain: Temporarily disable offending sites/app pools or apply WAF rules.
3. Investigate: Use FREB, IIS logs, and process dumps to identify root cause.
4. Remediate: Patch applications, adjust resource allocation, or revert recent deployments.
5. Recover: Bring services back incrementally and monitor for recurrence.
6. Post-incident: Perform a root-cause analysis and update thresholds/playbooks.

Performance tuning tips

• Optimize application pool recycling schedules to avoid simultaneous recycles.
• Use output caching and compression to reduce request load.
• Offload static content to a CDN or separate static site host.
• Tune worker process limits and thread pool settings for high-concurrency apps.
• Monitor and optimize database queries and external calls that increase request time.

Compliance and reporting

• Generate scheduled reports on uptime, error rates, SSL status, and config deviations.
• Maintain an audit trail of configuration changes and access to management interfaces.
• Use IISKeeper’s exports for compliance evidence (PCI, HIPAA, SOC) where applicable.

Ongoing maintenance

• Review alerts and dashboards weekly.
• Patch Windows and IIS regularly; test in staging before production rollout.
• Rotate credentials and review accounts with management access quarterly.
• Reassess thresholds after major traffic or application changes.

Appendix: Quick commands

• Export IIS config:

Code
Copy CodeCopied
appcmd list site /config /xml > sites.xml 

• View active worker processes:

Code
Copy CodeCopied
%windir%\system32\inetsrv\appcmd list wp 

Conclusion

IISKeeper centralizes visibility and enforcement for IIS servers, combining monitoring, alerting, log analysis, and automated hardening checks. Implementing the recommendations above will improve availability, detect attacks earlier, and reduce the mean time to recovery for IIS-hosted applications.