How to monitor IIS app pools in Azure

%3CLINGO-SUB%20id%3D%22lingo-sub-902677%22%20slang%3D%22en-US%22%3EHow%20to%20monitor%20IIS%20app%20pools%20in%20Azure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-902677%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3Bsaw%20your%20other%20post%20on%20the%20same.%20But%20no%20logs%20or%20event%20IDs%20are%20showing%20in%20Log%20analytics.%3C%2FP%3E%3CP%3ECan%20someone%20please%20help%20with%20how%20to%20monitor%20the%20status%20of%20application%20pools%20in%20azure.%20I%26nbsp%3B%20am%20not%20seeing%20any%20events%20in%20my%20log%20analytics.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-902677%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECustom%20Logs%20and%20Custom%20Fields%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-903768%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20monitor%20IIS%20app%20pools%20in%20Azure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-903768%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F423031%22%20target%3D%22_blank%22%3E%40priyanka995%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20have%20no%20events%2C%20have%20you%20setup%20the%20collection%20at%20all%3F%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-windows-events%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-windows-events%3C%2FA%3E%26nbsp%3B%20you%20need%20to%20capture%20the%20SYSTEM%20log%20(3rd%20one%20you%20see%20on%20this%20link)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20run%20this%2C%20you%20get%20NO%20results%20at%20all%2C%20then%20that's%20your%20issue%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EEvent%20%7C%20summarize%20count()%20by%20EventID%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EE.g.%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EEvent%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(60d)%0A%7C%20parse%20RenderedDescription%20with%20*%22serving%20application%20pool%20'%22%20AppPoolName%20%22'%20was%22*%20%20%20%2F%2F%20parse%20the%20filed%20for%20the%20pool%20name%0A%7C%20where%20AppPoolName%20%3D%3D%20%22DefaultAppPool%22%20%20%20%2F%2F%20only%20show%20where%20the%20pool%20name%20matches%0A%7C%20summarize%20count()%20by%20AppPoolName%20%2C%20EventLog%20%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fms.portal.azure.com%23%4072f988bf-86f1-41af-91ab-2d7cd011db47%2Fblade%2FMicrosoft_Azure_Monitoring_Logs%2FLogsBlade%2FresourceId%2F%252Fsubscriptions%252F82931e73-05c6-4da8-a666-bc4a7dd1bd3e%252Fresourcegroups%252Ffabrikamltdprodrg%252Fproviders%252Fmicrosoft.operationalinsights%252Fworkspaces%252Ffabrikamltdprod%2Fsource%2FLogsBlade.AnalyticsShareLinkToQuery%2Fq%2FH4sIAAAAAAAAA1WQzYoCMRCE7wu%25252BQ5GLPwh62pvCgrKXRUR8gXamZxJI0iHJOCg%25252BvDPjwOqtf6q%25252Banp%25252FZZ8nXw%25252B0miPjbBz%25252FsudImUtsQbXMvtflvFcEiolxYl92ynLHqYgmZCMerckaC5U4Xo2vQSFYU9CwCiIWU4WfEI5deSDHUFO0lNQCwGo1YrNmVMZ2oZXEoRucvtP%25252FX%25252FcO2WygdlxRY%25252FM4Vi%25252BeeHtD0tKOpg8WHOVCc%25252BqZqXGOorkzCml8ns1xuX1ELLHvv%25252FMnNZ4%25252FIweEJwEAAA%25253D%25253D%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CDIV%3E%0A%3CTABLE%20cellspacing%3D%221%22%20cellpadding%3D%225%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTH%3EAppPoolName%3C%2FTH%3E%0A%3CTH%3EEventLog%3C%2FTH%3E%0A%3CTH%3Ecount_%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EDefaultAppPool%3C%2FTD%3E%0A%3CTD%3ESystem%3C%2FTD%3E%0A%3CTD%3E3%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

@Clive Watson saw your other post on the same. But no logs or event IDs are showing in Log analytics.

Can someone please help with how to monitor the status of application pools in azure. I  am not seeing any events in my log analytics.

1 Reply

@priyanka995 

 

If you have no events, have you setup the collection at all?  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events  you need to capture the SYSTEM log (3rd one you see on this link)

 

If you run this, you get NO results at all, then that's your issue

Event | summarize count() by EventID

 

E.g.

Event
| where TimeGenerated > ago(60d)
| parse RenderedDescription with *"serving application pool '" AppPoolName "' was"*   // parse the filed for the pool name
| where AppPoolName == "DefaultAppPool"   // only show where the pool name matches
| summarize count() by AppPoolName , EventLog 

 

Go to Log Analytics and Run Query

AppPoolName EventLog count_
DefaultAppPool System 3