基本流程
詳細步驟
- 監控工具發現IIS服務器CPU負載過高並持續報警
Server monitor show a CPU 100% issue , such as Nagios
- 進入指定服務器並打開資源管理器查找可疑進程並記錄進程ID
Go to server and open task manager and find out the high cpu usage process, and find out its Process ID
- 使用win+r打開運行控制器，輸入mstsc遠程到CPU 100%服務器
mstsc
- 進入服務器後同樣使用win+r打開運行控制器，輸入taskmgr打開任務管理器
taskmgr
- 在任務管理器/詳細信息，點擊CPU進行排序，根據以下IIS進程對照表查找可疑進程
| 進程名稱 | 開發語言 |
|---|---|
| w3wp.exe | asp asp.net netcore |
| phpcgi.exe | php |
- 進入命名行管理器使用IIS自帶工具appcmd查找進程ID和IIS Pool對應關係
Open command window and use tool appcmd to find out which application pool has cpu issue. And take down the App Pool Name
- 使用win+r打開運行控制器，輸入cmd打開命名行管理器，執行以下命令找到有問題的IIS Pool
cd C:\windows\system32\inetsrv
appcmd list wp
- 使用附件腳本工具監控所有IIS請求並將結果輸出到日誌文件，最後根據日誌文件找出可疑請求所對應的網站
Run the following script to tracert all request about the application pool. Such as ASPnet4Pool or DefaultAppPool. If you want to tracert all request on the server, the app pool name should be allpool
- 使用win+r打開運行控制器，輸入cmd打開命名行管理器，執行以下命令監控IIS請求
cscript IIStracer.vbs <pool_nam> <log_file>
- 檢查日誌文件查找可疑請求，如大量相同請求，可執行文件相關請求
- 將網站移到單獨的pool並重復以上4步
If can not find the problem site, move the sites in the problem pool to other application pools one by one(Move the sites to different application pools). Monitor on the application pools till the next CPU issue to see the new CPU issue was caused by which application pool. If still caused by the same application pool, move another site to another pool and then monitor. Use this method to check all the sites till you found out the problem site
福利中心
IIS請求監控腳本傳送門