IIS 6 AppPool Worker Process Monitoring and Recovery with SCOM and Orchestrator

Hi Everyone

Now IIS AppPool issues is something we have always had because of the amazing custom development and in-house applications we have :)

The issues we had were getting out of control and it was time to do something about it, just for my sanity.

The problem was that we had our worker processes running high CPU and there were a lot of them and the support teams needed a way to see which worker processes belonged to which application pool as well as have some way of recycling these automatically at the same time sending out a mail notification about which application pool was recycled and when.

So I created a custom SCOM management pack to collect the worker process CPU usage as well as which W3WP.exe ID was tied to which AppPool and then plot this in a performance view as well as create a consecutive samples monitor to alert when these worker processes were over 85% for 2 samples or more.

Below is a screen shot of one of the alerts:
What I also did, was create a "recovery" script to fire off a Orchestrator Runbook so that I could automatically recycle that specific application pool for them and then send them a mail with all the same details.

Below is the actual Runbook

Simple !

The Runbook "Initialize Data" accepts the 2 parameters "Server" and "AppPoolName" this is then passed to the "Recycle App Pools" activity which runs the PowerShell script that will recycle that specific application pool.

$Server = "ServerName"
$AppPoolName = "AppPoolName"
$iisVersion = Get-ItemProperty "HKLM:\software\microsoft\InetStp";
if ($iisVersion.MajorVersion -eq 7)
{
##IIS7

$Name = "W3SVC/APPPOOLS/$AppPoolName"
$Path = "IISApplicationPool.Name='$Name'"
Invoke-WMIMethod Recycle -Path $Path -Computer $Server -Namespace root\MicrosoftIISv2 -Authentication PacketPrivacy
}
else
{
##IIS6
$appPool = get-wmiobject -namespace "root\MicrosoftIISv2" -class "IIsApplicationPool" | Where-Object {$_.Name -eq "W3SVC/APPPOOLS/$AppPoolName"}
$appPool.Recycle()
}

Select all Open in new window

The normal things can be done to create your views in SCOM so that the guys can look at the performance view of their specific servers AppPools as well as Alerts as per the normal setup you would do.

If you would like any more info on this simple process or any questions, please feel free.

Thank you