This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

IIS monitoring not seeing some performance counters

I am using the IIS template to monitor a couple of web servers.  The first server is an old 2003 server and it works fine.  The new server is 2012 R2, and SAM is not able to retrieve several perfmon counters, including all the "URI*" and "Web Service*" counters.

I have tried resetting the counters (lodctr /R).  And I can confirm that those counters exist and respond when I run perfmon locally on the server.  I know the credentials are correct.  In the App Monitor interface, the counters all have a status of "Unknown" and an error of:

Network connection failed. HResult: No data to return. Error: Unable to connect to the specified computer, or the computer is offline.

It obviously is able to connect to the computer, since other data is being returned fine.  Any suggestions?

iis-sam.jpg

  • Have you tried running Perfmon.exe from the Orion server itself, connecting to the remote host and seeing if those Windows Performance Counters are available? Trying it locally is helpful, but I have seen many instances where the performance counters appeared locally but not remotely.

  • No, that is definitely the problem--it can't connect remotely.  I just don't know why.  I've been using other servers for which SAM is successfully retrieving perfmon counters (for example, the "Windows Server 2003-2012 Services and Counters" template) to determine what "right" looks like.

    But your comment got me refocused on the real problem: "access", so I started looking at the firewall again.  I searched a bit on remote perfmon issues, and one recommendation was to enable the pre-defined "Performance Logs and Alerts (TCP-In)" rule.  This rule is not enabled on most of my servers--and they seem to work, but I enabled it just to test--and it worked!  I was able to remotely connect PerfMon from the SAM server to the web server, and every unknown counter on my web server came up in SAM except "URI Cache Flushes Counter".  I was ecstatic for about 2 minutes.  I was sitting in SAM, hitting "Poll Now", waiting patiently for that last counter to go green, when they ALL stopped working again!!!  The rule is still enabled, nothing else changed!  I can still connect and monitor those same counters from the SAM server, but SAM is back to "Unknown" on all of them.  So fricking confusing!

  • Have you tried stopping the Windows Firewall service on that machine and see if that resolves the problem?

  • As I am sure we both assumed, stopping the firewall did allow the counters to be retrieved.  However, that is not an acceptable solution for me.

    Is there a list of what ports the various app templates within SAM require for proper operation?

  • That did it.  I found the following in the document:

    Performance Counter Monitor- This monitor uses RPC, requiring the following ports:TCP/135; RPC/named pipes (NP) TCP 139, RPC/NP TCP

    445, RPC/NP UDP 137, RPC/NP UDP 138

    I created a custom GPO with those firewall inbound rules (TCP 135,139,445 and UDP 137,138).  Actually, all it needed were the first 2 ports, and my server is now all green.  Thanks!

  • I have the exact same scenario using the same IIS Template.  However, in my situation, we are not running any Firewall between the SolarWinds Server and the IIS Server.  I can successfully telnet to the ports list above.  I've also verified that the counters do exist on the IIS Server and have data.  Anymore ideas?

    Thanks

  • Have you tried restarting the Remote Registry service on the server being monitored to see if that resolves the issue?

  • Yes, I did attempt that with the same failed results.

  • My next recommendation would be to open perfmon.exe on the Orion Server, connecting to this remote host and attempting to monitor these performance counters remotely.

    URI Cache Flushes.png