1

Different times of day IIS (7, windows 2008) starts serving pages extremely slow. I checked through the LOG's of IIS and did not find anything...I disabled all the robots from scanning the site but to no avail.

Only thing that helps is...if I disallow ALL external IP addresses and only allow internal (office IP). which makes me think it could be a DDos Attack? however why IIS logs don't show any Attack IP's? Logs just look normal or AM i missing something?

Even other website hosted on the Same Box starts serving slow pages as well...but the second I turn on IP restrictions on Primary website everything starts working normally.

I checked SQL Server Queries as well with profiler and nothing suspicious.

even if I try to serve a simple HTML page it takes few seconds to load.

Where should I start from? any hints to resolve this issue?

0

Use Log Parser to analyze the logs. Find out which page is taking the longest, do only outside users request that page? Find out how many hits you are getting, is that what you expect?
http://blogs.msdn.com/b/friis/archive/2014/02/06/how-to-analyse-iis-logs-using-logparser-logparser-studio.aspx

Use perfmon or some monitoring software to monitor your CPU, memory, bandwidth and disk usage. See if you are hitting capacity somewhere.

  • I tried Logparser, and All I see is random IP's...there is no pattern which I can block, how are suppose to block random ips which involve DDos attack? – skhan Oct 27 '15 at 22:18
  • This is common with botnet attacks. Often there is a pattern to the user-agent. Another common pattern is requests with a legitimate user-agent that make no requests for assets (i.e. requests index.html but never requests the CSS or JS files on the page) – Steven Oct 28 '15 at 20:10
  • did you tried ASP.NET Performance Counters ? – Kiquenet Jul 7 '16 at 21:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.