We read allot of articles on how one can use MRTG as an Intrusion detection tool or to creating traffic graph for a particular network subnet or a single IP address on Linux platform with Apache web server. But we find very few that allow us to have graphs on Windows Dedicated server with IIS Web Server.

Here are some steps that can be used to create graphs on Windows Dedicated server with IIS as the web servers. And there is no need to take all the efforts to configure MRTG as we can simply have graphs with the use of logparser and the RRDtool from Tobias Oetiker and you can use the RRDtool perfectly without the rest of MRTG.

Logparser

Logparser is a great free tool from Microsoft. It is written by Gabriele Giuseppini a Software Design Engineer from the test department. The first version of logparser was an internal testing tool inside Microsoft. Version 2 was made publicly available at the website, version 2.1 was a part of the IIS resource tools kit and version 2.2 was made available in January 2005.

Here is a brief introduction how logparser works:

Logparser need three things, an input format, an output format and a sort of SQL query. The SQL query is a dialect of SQL.

There are few very interesting articles on Microsoft’s website, one written by the Author himself:
How to use Logparser
Another one from Scripting Guys:

The article from the scripting guys shows you how to use the logparser directly in a script with a com object.

You can download Logparser from the link below:
DOWNLOAD LOAGPARSER

The above download has portable help file in the application directory. This help file give you the parameters of all the properties of the logparser.
There is also an unofficial website specially for logparser:
www.logparser.com

About RRDtool.

What is the RRDtool:

The RRDtool or Round Robin Database tool is a tool that can store date in a database and create graphs with it. The really great thing about RDDTool is that the database does not growing. It will stay almost the same size as when it was created.

On the RRD website
RRDTool Website
there are some really good tutorials, and it is recommended to read them before you use the RRDtool.
From this website you can also download the RRDtool, the only problem is that you need to compile it but if you download it with the MRTGbundle from the link below, it has a completed version of the RRDtool in the packet. If you unpack the MRTGbundle, you can copy the RRDtool directory to your scripting directory or your application directory and start using it.
DOWNLOAD RDDTool Compiled Version

Create Database.

Before you can use the RRDtool you need to create the database.
The link below has all the information on how and why to create a database along with the parameters.
How to create a database
Parameters

You can also use a script to do that.


‘#start script.
Set WshShell = WScript.CreateObject("WScript.Shell")
strCMD = ".binrrdtool.exe create Eservicing.rrd"
strCMD = strCMD & " --start N "
strCMD = strCMD & " -s 300"
strCMD = strCMD & " DS:Hits:GAUGE:600:0:2000000"
strCMD = strCMD & " DS:Error400:GAUGE:600:0:2000000"
strCMD = strCMD & " DS:Error500:GAUGE:600:0:2000000"
strCMD = strCMD & " RRA:AVERAGE:0.5:1:288"
strCMD = strCMD & " RRA:AVERAGE:0.5:2:2016"
strCMD = strCMD & " RRA:AVERAGE:0.5:4:2232"
strCMD = strCMD & " RRA:AVERAGE:0.5:12:8760"

WshShell.Run strCMD
‘#end script.

Here is an explanation of every command in the script:

Set WshShell = WScript.CreateObject("WScript.Shell")
This line create a shell object you need to run the RRDtool .
In the next 10 lines I create the command line that I run in the last line.

strCMD = ".binrrdtool.exe create Eservicing.rrd"
this starts the RRDtool with the create function and give the name of the database.

strCMD = strCMD & " --start N "
–start set the start time of the database and N is the current time. The RRDtool works with Unixtime, this are the seconds from 1 January 1970.

strCMD = strCMD & " -s 300"
-s is the seconds between a database update.

strCMD = strCMD & " DS:Hits:GAUGE:600:0:2000000"
strCMD = strCMD & " DS:Error400:GAUGE:600:0:2000000"
strCMD = strCMD & " DS:Error500:GAUGE:600:0:2000000"
with this three lines I create three data sources. DS stands for data source, Hits is the name of the data source GAUGE is one of the four type’s of data sources, 600 are the seconds between the records if there is no input after 600 the value is NULL, 0 is the minimum value of the record and 200000 is the maximum value.

strCMD = strCMD & " RRA:AVERAGE:0.5:1:288"
strCMD = strCMD & " RRA:AVERAGE:0.5:2:2016"
strCMD = strCMD & " RRA:AVERAGE:0.5:4:2232"
strCMD = strCMD & " RRA:AVERAGE:0.5:12:8760"
this four lines create four Round Robin Archives. RRA stands for Round Robin Archive, AVERAGE is one of the four consolidation functions, 0.5 is the consolidation interval, 1 is the number of data sources that are consolidate in one record in the Round Robin Archive. If every 600 seconds a DS is created and the value is 4 instead of 1 every 2400 seconds there will be a record add to the archive, the last value is the number of records the archive contains.
The first line create a Round Robin Archive with a consolidation interval of 0.5. every data source gets a record in the archive and the archive is 288 records long.

WshShell.Run strCMD
And with this line the command is executed.

Update database.

With the next script we use logparser to evaluate the logfile from a IIS server. We can run this script every 5 minutes. To write the results in RRD database.

‘#start script
Const ForReading = 1, ForWriting = 2, ForAppending = 8
'-------------------------------------------------------------------------
LogDir = "serverd$logsyswwwsiteW3SVC1"
Set WSHShell = CreateObject("Wscript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
Set objLogParser = CreateObject("MSUtil.LogQuery")
Set objDictIISlogslist = CreateObject("Scripting.Dictionary")

Dim strDate
Dim count
Error400 = 0
Error500 = 0
‘————————————————————————-
Main
‘————————————————————————-
‘————————————————————————-
Sub Main
Call MakeStrDate
Call GetUniqueHits
Call GetStatus
Call UpdateRRD
End Sub
‘————————————————————————-
‘ —————————————————————————-
Sub MakeStrDate
strMonth = Month(Now)
If Len(strMonth) = 1 Then
strMonth = “0″ & CStr(strMonth)
End If
strDay = Day(Now)
If Len(strDay) = 1 Then
strDay = “0″ & CStr(strDay)
End If
strYear =Right(Year(Now),2)
strDate = strYear & strMonth & strDay
End Sub
‘ —————————————————————————-
‘————————————————————————-
Sub GetUniqueHits
Set objInputFormat = CreateObject(“MSUtil.LogQuery.IISW3CInputFormat”)
objInputFormat.recurse = -1
objInputFormat.iCheckPoint = strDate & “.lpc”
strQuery = “SELECT count(*) as UniqueHits FROM ‘” & _
LogDir & “ex” & strDate & “.log’”
Set objRecordSet = objLogParser.Execute(strQuery, objInputFormat)
Do While Not objRecordSet.AtEnd
Set objRecord = objRecordSet.GetRecord
count = objRecord.GetValue(“UniqueHits”)
objRecordSet.MoveNext
Loop
End Sub
‘————————————————————————-
‘————————————————————————-
Sub GetStatus
Set objInputFormat = CreateObject(“MSUtil.LogQuery.IISW3CInputFormat”)
objInputFormat.recurse = -1
objInputFormat.iCheckPoint = strDate & “Error.lpc”
strQuery = “SELECT sc-status , COUNT(*) as Hits FROM ‘” & LogDir & “ex” & strDate & “.log’ WHERE sc-status > 399 GROUP BY sc-status ORDER BY Hits DESC”
Set objRecordSet = objLogParser.Execute(strQuery, objInputFormat)
Do While Not objRecordSet.AtEnd
Set objRecord = objRecordSet.GetRecord
If objRecord.GetValue(“sc-status”) > 399 And objRecord.GetValue(“sc-status”) < 500 Then
Error400 = Error400 + objRecord.GetValue(“Hits”)
End If
If objRecord.GetValue(“sc-status”) > 499 And objRecord.GetValue(“sc-status”) < 600 Then
Error500 = Error500 + objRecord.GetValue(“Hits”)
End If
objRecordSet.MoveNext
Loop

End Sub
‘————————————————————————-
‘————————————————————————-
Sub UpdateRRD
strRun = “.binrrdtool update Eservicing.rrd N:” & count & “:” & Error400 & “:” & Error500
X = WshShell.Run(strRun,0,True)
End Sub
‘————————————————————————-
‘#end script

We will not explain this script line by line as it is a pretty simple script.

Creating a Graphic with the RRDtool.

With the next script I create a graphic with the RRDtool.

Set WshShell = WScript.CreateObject("WScript.Shell")

strCMD = “.binrrdtool graph .graphintranetNLweek.gif”
strCMD = strCMD & ” –start N-1w –end N”
strCMD = strCMD & ” –vertical-label ” & Chr(34) & “Hits ” & Chr(34)
strCMD = strCMD & ” –title INTRANET”
strCMD = strCMD & ” DEF:Xhits=.databaseintranetNL.rrd:Hits:AVERAGE”
strCMD = strCMD & ” DEF:Xerror400=.databaseintranetNL.rrd:Error400:AVERAGE”
strCMD = strCMD & ” DEF:Xerror500=.databaseintranetNL.rrd:Error500:AVERAGE”
strCMD = strCMD & ” LINE2:Xhits#FF0000:” & Chr(34) & “Hits” & Chr(34)
strCMD = strCMD & ” LINE2:Xerror400#00FF00:” & Chr(34) & “400 Errors” & Chr(34)
strCMD = strCMD & ” LINE2:Xerror500#0000FF:” & Chr(34) & “500 Errors” & Chr(34)

WshShell.Run strCMD

You will make a note of 2 important thing in this script:
1. The DEF line: this line defines the Data Sources you use.
2. The LINE2: This defines the line in the graphic.

Here is a very simple way to configure a DNS service on Windows Dedicated Server that hosts your website.

Requirements:

1. You should have one of the following Windows OS to install the DNS service:

– Windows XP Professional edition.
– Windows Vista.
– Windows 2003 Server Data center edition.
– Windows 2003 Server Enterprise edition.
– Windows 2003 Server Standard edition.

You cannot install DNS service on Windows 2008 Server with the steps below as it does not have an option to add remove Windows Components. You will have to use the Server Manager option to install Services on your Windows 2008 Server.

I have not specified Windows NT and Windows 2000 version as they are hardly used now a days. Also Windows XP Home edition and Windows 2003 Server Web edition does not support DNS service on them.

2. Windows OS installation CD or the i386 folder.

3. A user that will have Administrator rights on the Dedicated server on which you want to install DNS service.

Installation Steps:

1. Go to Control panel >> Add/Remove Programs >> Add/Remove Windows Components, it will open a windows below:

2. Click Next and you will get the screen,  see below:

3. Select the Networking Server (DO NOT CHECK THE BOX) and Click on Details (Highlighted in red) and you will get screen below:

4. Check Box on Domain Name System (DNS) and Click OK >> then Next. It will start the installation and will popup for the CD:

5. Browse to the i386 folder and then Click OK to complete the installation of DNS Service.

DNS Service and ZONE Configuration:

1. G oto Start >> Run and type the command below and hit enter:

dnsmgmt.msc

2. This will open DNS Management Console:

3. Before making any changes on the DNS server I will show you some steps that will make your life as well as the configuration very easy.
A. We will assume that we have to crate a DNS zone for the domain www.moosa.com. For that just go to C:WINDOWSsystem32dns directory (Path to WINDOWS may differ as per the OS you use, you can find it with %windir% or %SystemRoot% in the explorer)
B. Create an empty file as moosa.com.dns.
C. Insert the entire code into it:
——–

;
; Database file moosa.com.dns for moosa.com zone.
; Zone version: 1
;

@ IN SOA NS1.moosa.com. info.moosa.com. (
1 ; serial number
900 ; refresh
600 ; retry
86400 ; expire
3600 ) ; default TTL

;
; Zone NS records
;

@ IN NS NS1.moosa.com.
@ IN NS NS2.moosa.com.

;
; Zone records
;

@ IN A 192.168.5.52
mail IN A 192.168.5.72
www IN CNAME moosa.com.
ftp IN CNAME moosa.com.

;
; Zone Mail records
;

@ IN MX 10 mail.moosa.com.

——-
Let me explain each entry one by one briefly, you will have to change each of them as per your requirement:

– NS1.moosa.com. in SOA : This is the primary name server of my domain moosa.com. It is not compulsory that you too may have name server on your domain. But it should be the one from the set of name servers that you provide to your registrar to point your domain on your server.

– info.moosa.com. in SOA: This is actually an email address info @ moosa.com, it is provided for the DNS server to send notification of that is a problem within the zone.

– You can forget the rest in SOA as it will require a separate topic to explain those.

– NS1.moosa.com. in NS: This is again a primary name server that was provided to registrar.

– NS2.moosa.com. in NS: This a secondary name server of my domain moosa.com.
It is not over here, you can even have 3rd and 4th NS entry here. A zone will accept up to 13 NS entries for a single domain.

– ‘A’ records: ‘A’ record has the IP address that you want your domain to point at. This will probably the IP address of your web server or a mail server. I have 2 A records for moosa.com and mail.moosa.com, one for the IIS web server and other for the Exchange mail server.

– CNAME: CNAME are the canonical names for a domain or duplicate names. I have 2 CNAME so that www.moosa.com and ftp.moosa.com will point to the same IP of moosa.com.

– MX record: MX record will be required for your mails to work. It shows a path to your email server. If you do not have an email server and this record will not be required.

I will not go more deep in each of these settings or this topic will turn into a book.

4. Save the file and close it, make sure that each setting looks exactly the same as that has been defined above or the zone creation will fail.

5. Now go back to DNS Management Console, right click on SERVER NAME to make sure that the DNS service is running. If it is not running then click on Start option to start the service.

6. Right Click on “Forward Lookup Zone” >> New Zone:

7. It will Open the New Zone Wizard, click Next on first screen and then select “Primary zone” and then Next:

8. Put Domain name in “Zone Name” screen, without www in it. and click Next:

9. In the Zone File screen, Select the 2nd option “Use this existing file”. Make sure that the file name and path matches your name and path from the steps above. Then click Next:

10. In “Dynamic Update” screen, select “Do not allow dynamic updates” and click Next:

11. Click Finish on Next screen to create the new domain for your domain:

12. Your zone will appear in the screen below. You wil either double click the existing entries to update/edit/modify them or right click on the white screen to Add new Records as per your need.

DO NOT FORGET TO EITHER RELOAD THE ZONE OR RESTART THE DNS SERVICE FOR THE CHANGES YOU HAVE MADE TO REFLECT.

That is it.. now create another zone and so on..

Wasn’t that damn easy..!!!

There are 3 types of problems with site preview in Plesk:

1. Site Preview in Windows Plesk will show 404 Page Not Found error
2. Site Preview in Windows Plesk will show Plesk Default page.
3. SitePreview will ask for user name and password.

We will troubleshoot each problem with site preview one by one.

1. Site Preview in Plesk will show 404 Page Not Found error.

Cause: This happens if the sitepreview ISAPI DLL is not loaded correctly in IIS web server.

Troubleshoot steps:
a. First check if a the Virtual folder with the name sitepreview is create in IIS Default Web Site. If it is not created then create it without the application pool and map it to folder “%plesk_dir%isapi”, same as in image below.  Also Make sure that Executable Permissions are set to “Scripts And Executables”

b. Make sure that the Site preview ISAPI DDL is Allowed in Web Exteniosn and look like in image below, if not then Add it in Plesk Extensions.  

c. Also make sure that the Site Preview ISAPI DLL has been loaded with green Arrow in IIS >> Web Site >> Right click >> Properties >> ISAPI Tab. like in the figure below. If it is not loaded then just click on the Add button and browser through “%plesk_dir%isapisitepreview.dll” and restart IIS.

d. If you have IIS7 on Windows 2008 Server then make suer that you have Plesk Site Preview DLL added in IIS >> Click on Server >> IIS Group >> ISAPI Filters.

2. Site Preview in Plesk will show Plesk Default page.

Cause: Related to IP configuration on the server.

Troubleshoot steps:

a. Please fo through all the steps in problem one for this. However the only reason for this problem that I have found is main IP address of the server. Just make sure that you have alleast one site added on the main IP address of the server. To know the main IP address of the server Go to START >> Control Panel >> Network Connections >> Right click on main network adapter >> Click on Properties >> Select TCP IP >> Properties. The IP address list in this windows as IP address is the main IP address of the server. Just make sure that you have atleast one site hosted on this IP address.

The above solution will also apply is Plesk Site Preview option is working with https prefix butnot with http in URL browser.

3. SitePreview will ask for user name and password for all website.

Cause: Related to Permissions and Security Options.

Troubleshoot steps:

a. First check if the URL work fine with the IP address only:

http://192.168.1.52/

if not then there are permissions issue with the default site and if you are using a dedicated IP address instead of shared IP then the problem is with the permissions of the site that holds the dedicated IP.

b. If step “a” is working then try access the link below:
http://192.168.1.52/$sitepreview/

The above link should get redirected to the IP address and show Plesk default page or index.html page in Default Web site but it is is asking for password then permissions on sitepreview virtual directory is not correct. Make sure that IIS_WPG, NETWORK SERVICE, psaadm, psacln & psaserv has read an execute permissions on the virtual folder, do not forget to inherit the permissions to files in it.

c. If it asks password for only one site then the problem should be either with the website permissions or the file you are accessing it.

I think this should cover all the problems with Parallels Plesk Site Preview problems. But if you still face problem and don’t want to use Site Preview then you have try the HACK below.

WINDOWS HACK TO POINT YOUR SITE TO AN IP WITHOUT CHANGING THE NAME SERVERS.

2) On left pane, expand server name, then click “Web Sites“>>>right click on right pane>>>select  New>>>Web Site

3) Website Creation Wizard will open , here you have freedom to write absolutely anything (we will write – Testing) >>> Click Next

4)Under IP address and Port settings
Enter Ip address and port number (Default port – 80) and Host Header for the website >>> Click Next

5) Enter the path for Websites Home Directory and tick (check) “Allow anonymous access to this website” >>> Click Next

6) Under Website Access Permissions , necessary permissions for using ASP , Run Scripts can be used as per requirement. >>> Click Next

7) Click Finish and you’re done.

Windows Server 2003 provides improved alternatives to CDONTS. To make CDONTS
functioning on a Windows Server 2003-based computer, use one of the following

solution:

1. Obtain CDONTS.DLL and put it into %systemroot%\system32 folder
(C:\Windows\system32 by default).

2. Register the CDONTS.DLL component on your server using the following command:

regsvr32 “%systemroot%\system32\cdonts.dll”

For example:

C:\WINDOWS\system32>regsvr32.exe cdonts.dll

3. After you have registered your CDONTS.DLL component you need to check whether
your SMTP service is running. Go to Administrative tools > IIS and expand your local
machine. If SMTP service is listed then it is installed, else  it’s necessary to
install this service. To install SMTP perform the following operation:
Go to Control Panel > Add/Remove Programs > Add/Remove Windows Components >
Application Server > IIS > Mark SMTP service > Click OK.

4. Change the port number for SMTP service. Default port is 25. Use 25 only if you
don’t have another SMTP service running. If another SMTP service is already running
on your server you should switch IIS SMTP port to another, for example to 26. You
can do through IIS management console:
Control Panel > IIS > expand `local computer` > SMTP > Properties > General tab >
click on Advanced button > Edit.

5. Configure SMTP service. The main things are to set a valid full-qualified domain
name for SMTP service:
Control Panel > IIS > expand `local computer` > SMTP > Properties > Delivery tab >
click on Advanced button

6. Configure Security for SMTP service. It’s necessary to grant permissions to
IIS_WPG standard IIS Worker Process Group.

Control Panel > IIS > expand `local computer` > SMTP > Properties > Security tab >
click on Add button > Cick Object types… button > Mark Groups item > click OK >
Add IIS_WPG as object name to add > Click OK.

7. Additional setting:

Choose Authentication and tick Anonymous Access and Integrated Windows
Authentication. Click OK, then click CONNECTION. Configure RELAY settings as you
wish. Click the DELIVERY tab then click ADVANCED.

8. Stop SMTP service of IIS and start it again. Now IIS SMTP service as configured
and ready to work.

Here are some useful tools that help us in configuring IIS server to be more secure and less resource consuming:

1. IIS Passwords Sync:

IIS 6.0 web sites run under anonymous user accounts. It is IUSR_<machine name> (by default) or other user accounts created by your web hosting control panel. The users’ passwords are set automatically set and are never known. However, sometimes for some reason the passwords get out of sync or corrupted and need to be reset. The easiest way to reset these passwords is to use IIS Passwords Sync program. It extracts the passwords that Microsoft IIS 6.0 has in its metabase and updates the accounts in “Local Users and Groups” to use that passwords.

DOWNLOAD LINK

2. IIS Pool:

With IIS Pool tool we can easily search the problematic sites which have default application pool.

IIS Application Pools Monitoring and Analysis:

This program allows monitoring of IIS 6 application pools. All the monitoring data is stored in log files. It is possible to analyze a pool to find a website (or a virtual application) using too much resources. …

Overview -

IIS Application Pools Monitoring and Analysis:

* This program allows monitoring of IIS 6 application pools.

* All the monitoring data is stored in log files.

* It is possible to analyze a pool to find a website (or a virtual application) using too much resources.

Features -

* IIS application pools monitoring

* IIS application pools analysis

* Find websites using too much resources

DOWNLOAD LINK

3. IIS Report:

Overview -

IIS Report is a command line tool. It allows us to create different IIS related reports. For example it can get the list of all SSL websites and sort it by IP address, or get the list of all websites and sort it by application pool name and then by website name, …

There is no installation required. Just download and unrar the archive file. Then start the program with:

C:\>iisreport.exe /?

to get more information and see all the parameters available.

Benefits -

* Easy-to-use

* Fast

* It is possible to import the reports with Excel

* It is possible to parse the reports with VBS or BAT programs and other administration applications.

DOWNLOAD LINK