Add support for IIS package #138

narph · 2020-06-30T13:13:00Z

Import the IIS package

IIS error logs:

{
        "_index" : ".ds-logs-iis.error-default-000001",
        "_id" : "DPvJ43IB_yPpbIdgP2Rz",
        "_score" : 1.0,
        "_source" : {
          "agent" : {
            "name" : "DESKTOP-RFOOE09",
            "id" : "db17f9fb-5bcb-4116-a009-79a1bb7d4820",
            "type" : "filebeat",
            "ephemeral_id" : "3f65b650-b6a3-4694-83b3-0c324a60809d",
            "version" : "8.0.0"
          },
          "log" : {
            "file" : {
              "path" : """c:\Windows\System32\LogFiles\HTTPERR\httperr1.log"""
            },
            "offset" : 199
          },
          "destination" : {
            "address" : "::1%0",
            "port" : 80,
            "ip" : "::1"
          },
          "source" : {
            "address" : "::1%0",
            "port" : 59827,
            "ip" : "::1"
          },
          "input" : {
            "type" : "log"
          },
          "iis" : {
            "error" : {
              "reason_phrase" : "Timer_ConnectionIdle"
            }
          },
          "@timestamp" : "2020-06-30T13:56:46.000Z",
          "ecs" : {
            "version" : "1.5.0"
          },
          "related" : {
            "ip" : [
              "::1",
              "::1"
            ]
          },
          "host" : {
            "hostname" : "DESKTOP-RFOOE09",
            "os" : {
              "build" : "18363.900",
              "kernel" : "10.0.18362.900 (WinBuild.160101.0800)",
              "name" : "Windows 10 Pro",
              "family" : "windows",
              "version" : "10.0",
              "platform" : "windows"
            },
            "ip" : [
              "fe80::31c1:8a71:5a2b:8b51",
              "169.254.139.81",
              "fe80::5d83:4428:eb69:6d47",
              "169.254.109.71",
              "fe80::d88d:d3cb:7338:7680",
              "192.168.21.104",
              "fe80::adc8:e8:c7c3:3f56",
              "169.254.63.86",
              "fe80::f157:f94b:8459:833",
              "192.168.121.33"
            ],
            "name" : "DESKTOP-RFOOE09",
            "id" : "1e50b6e1-9710-4164-a8f0-032b3c721dc3",
            "mac" : [
              "9e:b6:d0:de:97:a9",
              "ae:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:aa",
              "00:15:5d:77:d0:cd"
            ],
            "architecture" : "x86_64"
          },
          "event" : {
            "created" : "2020-07-08T11:40:13.768Z",
            "kind" : "event",
            "category" : [
              "web",
              "network"
            ],
            "type" : [
              "connection"
            ]
          },
          "dataset" : {
            "name" : "iis.error",
            "namespace" : "default",
            "type" : "logs"
          }
        }
      },

IIS access logs:

  {
        "_index" : ".ds-logs-iis.access-default-000001",
        "_id" : "IfvJ43IB_yPpbIdgP2Rz",
        "_score" : 1.0,
        "_source" : {
          "agent" : {
            "name" : "DESKTOP-RFOOE09",
            "id" : "db17f9fb-5bcb-4116-a009-79a1bb7d4820",
            "type" : "filebeat",
            "ephemeral_id" : "3f65b650-b6a3-4694-83b3-0c324a60809d",
            "version" : "8.0.0"
          },
          "temp" : { },
          "log" : {
            "file" : {
              "path" : """C:\inetpub\logs\LogFiles\W3SVC2\u_ex181119.log"""
            },
            "offset" : 261
          },
          "destination" : {
            "address" : "127.0.0.1",
            "port" : 80,
            "ip" : "127.0.0.1"
          },
          "source" : {
            "address" : "127.0.0.1",
            "ip" : "127.0.0.1"
          },
          "url" : {
            "path" : "/"
          },
          "input" : {
            "type" : "log"
          },
          "iis" : {
            "access" : {
              "sub_status" : 3,
              "win32_status" : 5
            }
          },
          "@timestamp" : "2018-11-19T15:24:54.000Z",
          "ecs" : {
            "version" : "1.5.0"
          },
          "related" : {
            "ip" : [
              "127.0.0.1",
              "127.0.0.1"
            ]
          },
          "host" : {
            "hostname" : "DESKTOP-RFOOE09",
            "os" : {
              "build" : "18363.900",
              "kernel" : "10.0.18362.900 (WinBuild.160101.0800)",
              "name" : "Windows 10 Pro",
              "family" : "windows",
              "version" : "10.0",
              "platform" : "windows"
            },
            "ip" : [
              "fe80::31c1:8a71:5a2b:8b51",
              "169.254.139.81",
              "fe80::5d83:4428:eb69:6d47",
              "169.254.109.71",
              "fe80::d88d:d3cb:7338:7680",
              "192.168.21.104",
              "fe80::adc8:e8:c7c3:3f56",
              "169.254.63.86",
              "fe80::f157:f94b:8459:833",
              "192.168.121.33"
            ],
            "name" : "DESKTOP-RFOOE09",
            "id" : "1e50b6e1-9710-4164-a8f0-032b3c721dc3",
            "mac" : [
              "9e:b6:d0:de:97:a9",
              "ae:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:aa",
              "00:15:5d:77:d0:cd"
            ],
            "architecture" : "x86_64"
          },
          "http" : {
            "request" : {
              "method" : "GET"
            },
            "response" : {
              "status_code" : 401
            }
          },
          "event" : {
            "duration" : 725000000,
            "created" : "2020-07-08T11:40:14.112Z",
            "kind" : "event",
            "category" : [
              "web",
              "network"
            ],
            "type" : [
              "connection"
            ],
            "outcome" : "failure"
          },
          "dataset" : {
            "name" : "iis.access",
            "namespace" : "default",
            "type" : "logs"
          },
          "user_agent" : {
            "original" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36",
            "os" : {
              "name" : "Windows",
              "version" : "10",
              "full" : "Windows 10"
            },
            "name" : "Chrome",
            "device" : {
              "name" : "Other"
            },
            "version" : "70.0.3538.102"
          }
        }
      },

IIS application pool metrics:

 {
        "_index" : ".ds-metrics-iis.application_pool-default-000001",
        "_id" : "rfvK43IB_yPpbIdgaZRb",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2020-07-08T11:41:31.048Z",
          "process" : {
            "pid" : 51224
          },
          "event" : {
            "dataset" : "iis.application_pool",
            "module" : "iis",
            "duration" : 397142600
          },
          "host" : {
            "hostname" : "DESKTOP-RFOOE09",
            "architecture" : "x86_64",
            "os" : {
              "kernel" : "10.0.18362.900 (WinBuild.160101.0800)",
              "build" : "18363.900",
              "platform" : "windows",
              "version" : "10.0",
              "family" : "windows",
              "name" : "Windows 10 Pro"
            },
            "id" : "1e50b6e1-9710-4164-a8f0-032b3c721dc3",
            "ip" : [
              "fe80::31c1:8a71:5a2b:8b51",
              "169.254.139.81",
              "fe80::5d83:4428:eb69:6d47",
              "169.254.109.71",
              "fe80::d88d:d3cb:7338:7680",
              "192.168.21.104",
              "fe80::adc8:e8:c7c3:3f56",
              "169.254.63.86",
              "fe80::f157:f94b:8459:833",
              "192.168.121.33"
            ],
            "name" : "DESKTOP-RFOOE09",
            "mac" : [
              "9e:b6:d0:de:97:a9",
              "ae:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:aa",
              "00:15:5d:77:d0:cd"
            ]
          },
          "agent" : {
            "name" : "DESKTOP-RFOOE09",
            "type" : "metricbeat",
            "version" : "8.0.0",
            "ephemeral_id" : "8ade3582-e6ab-4664-ba27-52b3d46953e3",
            "id" : "3b73ebb6-c6ea-4354-b1f3-240ac1aa072c"
          },
          "service" : {
            "type" : "iis"
          },
          "iis" : {
            "application_pool" : {
              "name" : "DefaultAppPool",
              "net_clr" : {
                "total_exceptions_thrown" : 0
              },
              "process" : {
                "thread_count" : 30,
                "handle_count" : 466,
                "private_bytes" : 7.151616E7
              }
            }
          },
          "ecs" : {
            "version" : "1.5.0"
          },
          "metricset" : {
            "period" : 10000,
            "name" : "application_pool"
          },
          "dataset" : {
            "namespace" : "default",
            "type" : "metrics",
            "name" : "iis.application_pool"
          }
        }
      },

IIS website metrics

{
        "_index" : ".ds-metrics-iis.website-default-000001",
        "_id" : "W_vJ43IB_yPpbIdgYmoX",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2020-07-08T11:40:22.114Z",
          "ecs" : {
            "version" : "1.5.0"
          },
          "host" : {
            "name" : "DESKTOP-RFOOE09",
            "hostname" : "DESKTOP-RFOOE09",
            "architecture" : "x86_64",
            "os" : {
              "kernel" : "10.0.18362.900 (WinBuild.160101.0800)",
              "build" : "18363.900",
              "platform" : "windows",
              "version" : "10.0",
              "family" : "windows",
              "name" : "Windows 10 Pro"
            },
            "id" : "1e50b6e1-9710-4164-a8f0-032b3c721dc3",
            "ip" : [
              "fe80::31c1:8a71:5a2b:8b51",
              "169.254.139.81",
              "fe80::5d83:4428:eb69:6d47",
              "169.254.109.71",
              "fe80::d88d:d3cb:7338:7680",
              "192.168.21.104",
              "fe80::adc8:e8:c7c3:3f56",
              "169.254.63.86",
              "fe80::f157:f94b:8459:833",
              "192.168.121.33"
            ],
            "mac" : [
              "9e:b6:d0:de:97:a9",
              "ae:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:aa",
              "00:15:5d:77:d0:cd"
            ]
          },
          "iis" : {
            "website" : {
              "name" : "test2.local",
              "network" : {
                "total_put_requests" : 0,
                "total_get_requests" : 11,
                "service_uptime" : 1721807.0,
                "total_bytes_sent" : 135739,
                "maximum_connections" : 4,
                "total_connection_attempts" : 7,
                "total_post_requests" : 0,
                "total_bytes_received" : 4250,
                "current_connections" : 0,
                "total_delete_requests" : 0
              }
            }
          },
          "event" : {
            "dataset" : "iis.website",
            "module" : "iis",
            "duration" : 5008200
          },
          "metricset" : {
            "name" : "website",
            "period" : 10000
          },
          "service" : {
            "type" : "iis"
          },
          "dataset" : {
            "name" : "iis.website",
            "namespace" : "default",
            "type" : "metrics"
          },
          "agent" : {
            "type" : "metricbeat",
            "version" : "8.0.0",
            "ephemeral_id" : "8ade3582-e6ab-4664-ba27-52b3d46953e3",
            "id" : "3b73ebb6-c6ea-4354-b1f3-240ac1aa072c",
            "name" : "DESKTOP-RFOOE09"
          }
        }
      },

IIS webserver metrics

{
        "_index" : ".ds-metrics-iis.webserver-default-000001",
        "_id" : "ofvK43IB_yPpbIdg9535",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2020-07-08T11:42:12.102Z",
          "service" : {
            "type" : "iis"
          },
          "dataset" : {
            "type" : "metrics",
            "name" : "iis.webserver",
            "namespace" : "default"
          },
          "ecs" : {
            "version" : "1.5.0"
          },
          "host" : {
            "mac" : [
              "9e:b6:d0:de:97:a9",
              "ae:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:a9",
              "9c:b6:d0:de:97:aa",
              "00:15:5d:77:d0:cd"
            ],
            "hostname" : "DESKTOP-RFOOE09",
            "architecture" : "x86_64",
            "name" : "DESKTOP-RFOOE09",
            "os" : {
              "kernel" : "10.0.18362.900 (WinBuild.160101.0800)",
              "build" : "18363.900",
              "platform" : "windows",
              "version" : "10.0",
              "family" : "windows",
              "name" : "Windows 10 Pro"
            },
            "id" : "1e50b6e1-9710-4164-a8f0-032b3c721dc3",
            "ip" : [
              "fe80::31c1:8a71:5a2b:8b51",
              "169.254.139.81",
              "fe80::5d83:4428:eb69:6d47",
              "169.254.109.71",
              "fe80::d88d:d3cb:7338:7680",
              "192.168.21.104",
              "fe80::adc8:e8:c7c3:3f56",
              "169.254.63.86",
              "fe80::f157:f94b:8459:833",
              "192.168.121.33"
            ]
          },
          "agent" : {
            "name" : "DESKTOP-RFOOE09",
            "type" : "metricbeat",
            "version" : "8.0.0",
            "ephemeral_id" : "8ade3582-e6ab-4664-ba27-52b3d46953e3",
            "id" : "3b73ebb6-c6ea-4354-b1f3-240ac1aa072c"
          },
          "iis" : {
            "webserver" : {
              "asp_net" : {
                "application_restarts" : 0,
                "request_wait_time" : 0
              },
              "asp_net_application" : {
                "requests_in_application_queue" : 0,
                "pipeline_instance_count" : 2,
                "requests/sec" : 0,
                "requests_executing" : 0,
                "errors_total/sec" : 0
              },
              "network" : {
                "total_get_requests" : 52,
                "total_anonymous_users" : 52,
                "current_connections" : 2,
                "anonymous_users_per_sec" : 0,
                "service_uptime" : 1721919.0,
                "total_post_requests" : 0,
                "total_non_anonymous_users" : 0,
                "bytes_received_per_sec" : 0,
                "total_delete_requests" : 0,
                "current_non_anonymous_users" : 0,
                "bytes_sent_per_sec" : 0,
                "total_bytes_received" : 33151,
                "current_anonymous_users" : 0,
                "post_requests_per_sec" : 0,
                "total_connection_attempts" : 23,
                "delete_requests_per_sec" : 0,
                "get_requests_per_sec" : 0,
                "maximum_connections" : 6,
                "total_bytes_sent" : 903338
              },
              "process" : {
                "io_write_operations_per_sec" : 5.7271735422265,
                "worker_process_count" : 2,
                "private_bytes" : 1.06692608E8,
                "page_faults_per_sec" : 1.0738450391674688,
                "virtual_bytes" : 2.222663852032E12,
                "io_read_operations_per_sec" : 5.7271735422265
              },
              "cache" : {
                "current_files_cached" : 2,
                "file_cache_misses" : 70,
                "total_files_cached" : 15,
                "output_cache_current_memory_usage" : 0,
                "file_cache_hits" : 18,
                "uri_cache_hits" : 14,
                "output_cache_total_hits" : 0,
                "output_cache_current_items" : 0,
                "current_file_cache_memory_usage" : 696,
                "current_uris_cached" : 1,
                "uri_cache_misses" : 62,
                "maximum_file_cache_memory_usage" : 99453,
                "output_cache_total_misses" : 76,
                "total_uris_cached" : 10
              }
            }
          },
          "event" : {
            "dataset" : "iis.webserver",
            "module" : "iis",
            "duration" : 1205854900
          },
          "metricset" : {
            "period" : 10000,
            "name" : "webserver"
          }
        }
      },

Dashboards look good

elasticmachine · 2020-06-30T13:16:03Z

💚 Build Succeeded

Expand to view the summary

Build stats

Build Cause: [Pull request #138 updated]
Start Time: 2020-07-09T15:07:08.467+0000
Duration: 3 min 45 sec

packages/iis/dataset/access/manifest.yml

packages/iis/dataset/error/manifest.yml

packages/iis/manifest.yml

elasticmachine · 2020-07-08T11:58:45Z

Pinging @elastic/integrations (Team:Integrations)

ChrsMark

Left some comments.
Also could you please post a screenshot with integration's configuration form in Kibana?

dev/import-beats-resources/iis/docs/README.md

packages/iis/dataset/access/manifest.yml

packages/iis/manifest.yml

ChrsMark · 2020-07-09T09:39:15Z

packages/iis/manifest.yml

+  type: image/svg+xml
+format_version: 1.0.0
+license: basic
+categories: []


Maybe to add some categories here from https://github.com/elastic/package-registry/blob/e93e801a6dfbfa6f83c8b69f6e9405603151f937/util/package.go#L27-L51?

this will come in a different PR

that's fine! just out of curiosity is there any particular reason for this? is anything missing from the list of categories?

packages/iis/dataset/webserver/manifest.yml

ChrsMark · 2020-07-09T09:41:40Z

packages/iis/dataset/webserver/manifest.yml

+    required: true
+    show_user: true
+    default: 10s
+  title: IIS webserver metrics


same as above

packages/iis/dataset/webserver/manifest.yml

packages/iis/dataset/website/manifest.yml

ChrsMark · 2020-07-09T14:45:05Z

packages/iis/manifest.yml

+  size: 1960x2820
+  type: image/png
+- src: /img/metricbeat-iis-application-pool-overview.png
+  title: Metricbeat IIS Application Pool overview


Suggested change

title: Metricbeat IIS Application Pool overview

title: Metricbeat IIS Application Pool Overview

ChrsMark · 2020-07-09T14:45:12Z

packages/iis/manifest.yml

+  size: 3785x1986
+  type: image/png
+- src: /img/metricbeat-iis-webserver-overview.png
+  title: Metricbeat IIS Webserver overview


Suggested change

title: Metricbeat IIS Webserver overview

title: Metricbeat IIS Webserver Overview

ChrsMark · 2020-07-09T14:45:23Z

packages/iis/manifest.yml

+  size: 3137x1366
+  type: image/png
+- src: /img/metricbeat-iis-webserver-process.png
+  title: Metricbeat IIS Webserver process


Suggested change

title: Metricbeat IIS Webserver process

title: Metricbeat IIS Webserver Process

ChrsMark · 2020-07-09T14:45:33Z

packages/iis/manifest.yml

+  size: 3108x1629
+  type: image/png
+- src: /img/metricbeat-iis-website-overview.png
+  title: Metricbeat IIS Website overview


Suggested change

title: Metricbeat IIS Website overview

title: Metricbeat IIS Website Overview

ChrsMark · 2020-07-09T14:46:24Z

packages/iis/manifest.yml

+  type: image/svg+xml
+format_version: 1.0.0
+license: basic
+categories: []


that's fine! just out of curiosity is there any particular reason for this? is anything missing from the list of categories?

packages/iis/docs/README.md

dev/import-beats-resources/iis/docs/README.md

ChrsMark

LGTM, thanks!

* temp * temp * manifest * work on iis * remove local chnages * test * fix * update * update * work on review * update docs * review * update * camelcase

narph added 4 commits June 29, 2020 17:07

temp

7fc8109

temp

76e4b11

manifest

6f5ae2e

work on iis

cb33e07

narph self-assigned this Jun 30, 2020

narph added the Team:Integrations Label for the Integrations team label Jun 30, 2020

remove local chnages

c48c8f9

narph mentioned this pull request Jun 30, 2020

Migrate IIS package #125

Closed

narph added 2 commits July 2, 2020 11:03

Merge branch 'master' into import-iis

959ae61

test

7712284

mtojek reviewed Jul 2, 2020

View reviewed changes

packages/iis/dataset/access/manifest.yml Outdated Show resolved Hide resolved

packages/iis/dataset/error/manifest.yml Outdated Show resolved Hide resolved

packages/iis/manifest.yml Outdated Show resolved Hide resolved

narph added 6 commits July 2, 2020 13:57

Merge branch 'master' of github.com:elastic/integrations into import-iis

3ffa89d

fix

0ece3e8

Merge branch 'master' into import-iis

72083aa

update

0aec012

Merge branch 'master' into import-iis

148b289

update

69e13b1

narph marked this pull request as ready for review July 8, 2020 11:58

narph requested a review from mtojek July 8, 2020 11:58

ChrsMark reviewed Jul 9, 2020

View reviewed changes

narph added 4 commits July 9, 2020 15:47

Merge branch 'master' into import-iis

672a6c4

work on review

7a923fe

update docs

9ca8afa

review

0df53fd

narph requested a review from ChrsMark July 9, 2020 14:40

ChrsMark reviewed Jul 9, 2020

View reviewed changes

narph added 2 commits July 9, 2020 16:57

update

98b1e02

camelcase

3a31f73

narph requested a review from ChrsMark July 9, 2020 15:10

ChrsMark approved these changes Jul 9, 2020

View reviewed changes

narph merged commit c4f6ee1 into elastic:master Jul 9, 2020

narph deleted the import-iis branch July 9, 2020 15:14

andrewkroh added Integration:iis IIS New Integration labels Aug 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for IIS package #138

Add support for IIS package #138

narph commented Jun 30, 2020 •

edited

Loading

elasticmachine commented Jun 30, 2020 •

edited

Loading

Build stats

elasticmachine commented Jul 8, 2020

ChrsMark left a comment

ChrsMark Jul 9, 2020

narph Jul 9, 2020

ChrsMark Jul 9, 2020

ChrsMark Jul 9, 2020

ChrsMark Jul 9, 2020

ChrsMark Jul 9, 2020

ChrsMark Jul 9, 2020

ChrsMark Jul 9, 2020

ChrsMark Jul 9, 2020

ChrsMark left a comment

	title: Metricbeat IIS Application Pool overview
	title: Metricbeat IIS Application Pool Overview

	title: Metricbeat IIS Webserver overview
	title: Metricbeat IIS Webserver Overview

	title: Metricbeat IIS Webserver process
	title: Metricbeat IIS Webserver Process

	title: Metricbeat IIS Website overview
	title: Metricbeat IIS Website Overview

Add support for IIS package #138

Add support for IIS package #138

Conversation

narph commented Jun 30, 2020 • edited Loading

elasticmachine commented Jun 30, 2020 • edited Loading

💚 Build Succeeded

Build stats

elasticmachine commented Jul 8, 2020

ChrsMark left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ChrsMark left a comment

Choose a reason for hiding this comment

narph commented Jun 30, 2020 •

edited

Loading

elasticmachine commented Jun 30, 2020 •

edited

Loading