How Can I Monitor an IIS 7.5 Application Pool with WMI?

Question

I currently have an application in a load balanced IIS cluster (NLB) on Server 2008 R2. This application leverages some legacy database access code which occasionally fails enough to disable the app pool.

I would like put a WMI event watcher in place to monitor the change in the status of the app pool (other suggestions welcome), that would restart the app pool if it goes into a stopped state.

This is for a temporary workaround until new code can be pushed, but that has to go through a Dev/QA/UAT cycle.

There is a WMI class for the ApplicationPool in the root\webadministration namespace, however to get the status, you have to call the GetState method on that object, so I'm not sure how to watch that with a WMI event.

Answer 1

You may be able to do this with built-in Event Log monitoring.

If the application pool is shutting down due to the rapid fail protection, there is probably an event id 5002 like the following in the System event log:

"Application pool 'AppPoolName' is being automatically disabled due to a series of failures in the process(es) serving that application pool."

Create a scheduled task for a custom event log trigger. A manual XML query would look something like this:

<QueryList>
 <Query Id="0" Path="System">
 <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-WAS'] and (EventID=5002)]] 
 and *[EventData[Data[@Name='AppPoolID'] and (Data='YourAppPoolFriendlyName')]]</Select>
 </Query>
</QueryList>

Your scheduled task action could be to run a script that runs appcmd to restart the specific application pool.

appcmd recycle apppool /?
Recycle application pool

APPCMD recycle APPPOOL <identifier> <-parameter1:value1 ...>

Recycles the specified application pool, recycling its the worker processes.
The exact application pool identifier must be provided and must resolve to an
existing application pool.

Supported parameters:

 identifier (required)

    Application pool name of the application pool to recycle

 /apppool.name

    Application pool name of the application pool to recycle (same as
    identifier)


Examples:

 appcmd recycle apppool "MyAppPool"

    Recycle the application pool "MyAppPool".

If you have multiple application pools on the same server, you may need to refine the XML filter to specify the application pool id. Here is a sample event XML text:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" /> 
  <EventID Qualifiers="49152">5002</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2012-10-01T19:41:43.000000000Z" /> 
  <EventRecordID>408764</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>System</Channel> 
  <Computer>WEBSERVERNAME.company.com</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="AppPoolID">YourAppPoolFriendlyName</Data> 
  <Binary /> 
  </EventData>
  </Event>

Info on Event Log Advanced Filtering:
https://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx

Use APPCMD to recycle an application pool:
http://technet.microsoft.com/en-us/library/cc770764%28v=ws.10%29.aspx

Answer 2

FYI, if it's failing because of rapid failover protection, you can disable that instead of tiptoeing around it:

https://stackoverflow.com/a/4802309/448129