User Profile
BartKos
Copper Contributor
Joined Aug 30, 2019
User Widgets
Recent Discussions
Find requests source - ASP.NET Apps v4.0.30319\Request/sec
Hello, I have an Alert Rule set based on Log Analytics query to check RPS for my SharePoint application VMs In last couple of days I have received a lot of emails from the alert rule that RPS>10, where in last months there were none. After quick check I have noticed that there are RPS between avg 10-15, but today there was RPS avg value of 30 and after searching all entries I found two entries with 6551 requests each. I am trying to determine the source of those request and I stuck as I cannot find or build any log query with information I need. Could you please help me?Re: Find requests source - ASP.NET Apps v4.0.30319\Request/sec
Hello CliveWatson I have used your query ( I just changed time bin to 15 minutes) Perf | where ( ObjectName == "ASP.NET Apps v4.0.30319" ) | where CounterName == "Requests/Sec" | project TimeGenerated, Computer, RPS=CounterValue | summarize AvgRpsLast15Minutes= avg(RPS) by bin(TimeGenerated, 15m), Computer | where AvgRpsLast15Minutes > 10 I have got below result (for last 48h): I have checked Event tab for entries in the time of the occurrence of the one of spikes(nothing suspicious in my opinion which may cause such amount of requests), below results: I have not noticed any patterns for last 7 days. Is there a possibility to check the source or details of all the requests from the spike like IP address or maybe the name of the internal process or computer name? I know there are hundreds of req/s and it will require some digging but I would like to determine if there is some attack from outside (SharePoint app is dedicated for public users) or it is just some internal issue.Re: Find requests source - ASP.NET Apps v4.0.30319\Request/sec
Hello CliveWatson Here is a query I am using to get avg requests: Perf | where ( ObjectName == "ASP.NET Apps v4.0.30319" ) | where CounterName == "Requests/Sec" | where TimeGenerated> ago(15m) | project TimeGenerated, Computer, RPS=CounterValue | summarize AvgRpsLast15Minutes= avg(RPS) by Computer | where AvgRpsLast15Minutes > 10 I am monitoring those request to SharePoint Servers (SHP2013 on WindowsServer 2012R2). I do not have Office in my LogManagement so I got syntax error for the query you suggested to check.
