FAQ - Health Monitoring in ASP.NET 2.

0
What is Health Monitoring?
Health Monitoring is a framework for monitoring status of running ASP.NET applications and
logging significant ASP.NET application events.

Why would I use Health Monitoring?

• Health Monitoring is runtime based for your production environment, so it provides
information of your running ASP.NET applications
• Health Monitoring gives event details rather than providing a number or a total, which
can be useful to solve running application issues.
• Health Monitoring is customizable, so you can tailor the event information they way you
need it.
What are examples of Health Monitoring events that can be logged?
• Application starts and stops
• Failed logins and unhandled exceptions
• "Heartbeats"
• Successful and failed login attempts through Membership
• Successful and failed URL and ACL authorizations by authenticated users
• Valid and expired forms authentication tickets
• View state validation failures
• Compilation errors
• Configuration errors
• Unhandled exceptions
• Request validation failures
• Anything that causes request to abort
• Requests queued, processing, or rejected
• Specific or periodic monitoring event
• Process start time and more
What are examples of locations where Health Monitoring events can be logged?
• Windows event log
• SQL Server database
• Email
• Console window using WMI
• Trace output window
What are Health Monitoring events?
Health Monitoring events help you keep track of different things that are occurring while your
ASP.NET application is running. These events are divided into five main areas:
• Application Lifetime Events
• All Audits
• All Errors
• Reqeust Processing Events
• Heartbeats
What are Health Monitoring providers?
Providers consume Web event data. By default, the ASP.NET health-monitoring system can
deliver Web event data using the built-in providers listed in the following table. More than one
provider can listen for the same event, and more than one event can be consumed by the same
provider.

Event Providers Details

EventLogWebEventProvider
Writes Web event data to the Windows event log. By default, this provider is configured to
write all errors to the Windows event log. Security operation errors are logged under the event
name Failure Audits and logs all other errors are logged under the event name All
Errors.
To read event log data, you can view data using the Windows Event Viewer or read event log
data programmatically.

SqlWebEventProvider Logs Web event data to a Microsoft SQL server database. By default, this provider logs data to
the SQL Server Express database in the Web application's App_Data folder. It does not
subscribe to any events by default.

WmiWebEventProvider
Passes Web events to WMI, converting them to WMI events. By default, this provider does not
subscribe to any events.
To listen for WMI events, you can build an application such as the one illustrated in
Walkthrough: Listening for WMI Events in ASP.NET Health Monitoring. For more
information, see Using WMI to Deliver ASP.NET Health Monitoring Events. WMI applications
do not have to be written in managed code.

SimpleMailWebEventProvider and Sends an e-mail message when Web events are raised. By default, these providers are not
TemplatedMailWebEventProvider configured and do not subscribe to any events.

TraceWebEventProvider
Passes event data to the ASP.NET page tracing system. By default, this provider is not
configured and does not subscribe to any events. Tracing provides you the ability to start and
stop event tracing sessions, to instrument applications to provide trace events, and to consume
trace events. You can use the events to debug an application and perform capacity and
performance analysis. For more information, see ASP.NET Tracing.

What are Health Monitoring profiles?

Profiles determine how events are collected by ASP.NET and raised to providers.
By default, there are two profiles named Critical and Default included in the configuration.

What are Health Monitoring buffers?

Buffers (BufferModes) define how health-monitoring events can be buffered before they are
raised. The three included providers that can use bufferModes are:
• SqlWebEventProvider (included by default)
• SimpleMailWebEventProvider
• TemplatedMailWebEventProvider
Each of the above providers inherits from the BufferedWebEventProvider class.

What are Health Monitoring rules?

The rules define the map of how an event is raised. At a minimum each rule must list the event
name, the provider and the profile.

How is Health Monitoring configured and controlled?

The configuration is the main location to control what events will be monitored and how those
events will be monitored. You can either modify the configuration using a text editor or use the
API. For more information see, HealthMonitoringSection Class and ASP.NET Configuration
Files.
Where in the configuration is Health Monitoring found?
The <healthMonitoring> section is within the <system.web> section of the configuration.

What are the sub-sections within the <healthMonitoring> section of the configuration?
There are five sub-sections within the <healthMonitoring> section. The Health Monitoring
section looks like the following:
<healthMonitoring ...>
<bufferModes>
...
</bufferModes>
<providers>
...
</providers>
<eventMappings>
...
</eventMappings>
<profiles>
...
</profiles>
<rules>
...
</rules>
</healthMonitoring>

Are there default values (a default configuration) established in the <healthMonitoring>

section of the configuration?
Yes. These values are contained at the root web.config file. The root web.config file is located at
%windir%\Microsoft.NET\Framework\v2.0.50727\CONFIG. By default, a number of
eventMappings, providers, profiles, rules, and bufferModes are already established within the
<heathMonitoring> section.

What are the default Health Monitoring events included in the configuration?
The default events are mapped in the root web.config file:
<eventMappings>
<add name="All Events" type="System.Web.Management.WebBaseEvent, ..." />
<add name="HeartBeats"
type="System.Web.Management.WebHeartBeatEvent, ..." />
<add name="Application Lifetime Events"
type="System.Web.Management.WebApplicationLifetimeEvent, ..." />
<add name="Request Processing Events"
type="System.Web.Management.WebRequestEvent, ..." />
<add name="All Errors"
type="System.Web.Management.WebBaseErrorEvent, ..." />
<add name="Infrastructure Errors"
type="System.Web.Management.WebErrorEvent, ..." />
 <add name="Request Processing Errors"
type="System.Web.Management.WebRequestErrorEvent, ..." />
<add name="All Audits" type="System.Web.Management.WebAuditEvent, ..." />
<add name="Failure Audits"
type="System.Web.Management.WebFailureAuditEvent, ..." />
<add name="Success Audits"
type="System.Web.Management.WebSuccessAuditEvent, ..." />
</eventMappings>

What are the default Health Monitoring providers included in the configuration?
The default providers are included in the following section of the root web.config file:
<providers>
<add name="EventLogProvider"
type="System.Web.Management.EventLogWebEventProvider, …
<add name="SqlWebEventProvider"
connectionStringName="LocalSqlServer"
maxEventDetailsLength="1073741823"
buffer="false"
bufferMode="Notification"
type="System.Web.Management.SqlWebEventProvider, …
<add name="WmiWebEventProvider"
type="System.Web.Management.WmiWebEventProvider,…
</providers>

What are the default Health Monitoring profiles included in the configuration?
The default profiles are included in the following section of the root web.config file:
<profiles>
<add name="Default"
minInstances="1"
maxLimit="Infinite"
minInterval="00:01:00"
custom="" />
<add name="Critical"
minInstances="1"
maxLimit="Infinite"
minInterval="00:00:00"
custom="" />
</profiles>

What are the default Health Monitoring buffers included in the configuration?
The default bufferModes are included in the following section of the root web.config file:
<bufferModes>
<add name="Critical Notification"
maxBufferSize="100"
maxFlushSize="20"
urgentFlushThreshold="1"
 regularFlushInterval="Infinite"
urgentFlushInterval="00:01:00"
maxBufferThreads="1" />
<add name="Notification"
…
</>
<add name="Analysis"
…
</>
<add name="Logging“
…
</>
</bufferModes>

What are the default Health Monitoring rules included in the configuration?
The default rules are included in the following section of the root web.config file:
<rules>
<add name="Failure Audits Default"
eventName="Failure Audits"
provider="EventLogProvider"
profile="Default"
minInterval="00:00:00"
minInstances="1"
maxLimit="Infinite"
/>
...
</rules>

I understand the basics of Health Monitoring, but I still don’t understand exactly how to
implement it. How can I get started using Health Monitoring right now?
Follow the steps below:
1. Create a new Web application in Visual Web Developer.
2. From the Website menu select Add New Item.
3. Select and add a Web Configuration File.
4. Add the following node before the end of the <system.web> node in the newly added
configuration file:
<healthMonitoring enabled="true" heartbeatInterval="10">
<rules>
<add name="Heartbeats Default"
eventName="Heartbeats"
provider="EventLogProvider"
profile="Critical"/>
</rules>
</healthMonitoring>
5. Run your Web application.
6. Run the Event Viewer (eventvwr.exe).
7. Select Application in the right pane of the Event Viewer.
8. Notice that the “heartbeat” events for your application occur every 10 seconds.

What would be an example of using the SqlWebEventProvider to log monitoring event?

There is an example on the ASP.NET site that demonstrates the SqlWebEventProvider.

I understand that the root web.config file contains the default Health Monitoring support.
What should I do if I want to modify the <healthMonitoring> section?
There are three points to note:
• Use the Add, Remove, and Clear elements
• Do not modify the root level config files
• Modify using text editor or the API.
I understand that event friendly names are mapped to the event type within the
configuration, but how can I find the exact events that are related to each friendly event
name, such as “All Audits”?
Take a look at the WebEventCodes on MSDN. This list will give you a more specific list of
events.

In the Event Viewer I see the event code (i.e. 1005) but how can I match that code to the
specific event?
The list below will help you match the event code name with the event code number.
WebEventCode Event Code
InvalidEventCode -1
UndefinedEventCode 0
UndefinedEventDetailCode 0
ApplicationCodeBase 1000
ApplicationStart 1001
ApplicationShutdown 1002
ApplicationCompilationStart 1003
ApplicationCompilationEnd 1004
ApplicationHeartbeat 1005
RequestCodeBase 2000
RequestTransactionComplete 2001
RequestTransactionAbort 2002
ErrorCodeBase 3000
RuntimeErrorRequestAbort 3001
RuntimeErrorViewStateFailure 3002
RuntimeErrorValidationFailure 3003
RuntimeErrorPostTooLarge 3004
RuntimeErrorUnhandledException 3005
WebErrorParserError 3006
WebErrorCompilationError 3007
WebErrorConfigurationError 3008
WebErrorOtherError 3009
WebErrorPropertyDeserializationError 3010
WebErrorObjectStateFormatterDeserializationError 3011
AuditCodeBase 4000
AuditFormsAuthenticationSuccess 4001
AuditMembershipAuthenticationSuccess 4002
AuditUrlAuthorizationSuccess 4003
AuditFileAuthorizationSuccess 4004
AuditFormsAuthenticationFailure 4005
AuditMembershipAuthenticationFailure 4006
AuditUrlAuthorizationFailure 4007
AuditFileAuthorizationFailure 4008
AuditInvalidViewStateFailure 4009
AuditUnhandledSecurityException 4010
AuditUnhandledAccessException 4011
MiscCodeBase 6000
WebEventProviderInformation 6001
ApplicationDetailCodeBase 50000
ApplicationShutdownUnknown 50001
ApplicationShutdownHostingEnvironment 50002
ApplicationShutdownChangeInGlobalAsax 50003
ApplicationShutdownConfigurationChange 50004
ApplicationShutdownUnloadAppDomainCalled 50005
ApplicationShutdownChangeInSecurityPolicyFile 50006
ApplicationShutdownBinDirChangeOrDirectoryRename 50007
ApplicationShutdownBrowsersDirChangeOrDirectoryRename 50008
ApplicationShutdownCodeDirChangeOrDirectoryRename 50009
ApplicationShutdownResourcesDirChangeOrDirectoryRenam 50010
e
ApplicationShutdownIdleTimeout 50011
ApplicationShutdownPhysicalApplicationPathChanged 50012
ApplicationShutdownHttpRuntimeClose 50013
ApplicationShutdownInitializationError 50014
ApplicationShutdownMaxRecompilationsReached 50015
StateServerConnectionError 50016
AuditDetailCodeBase 50200
InvalidTicketFailure 50201
ExpiredTicketFailure 50202
InvalidViewStateMac 50203
InvalidViewState 50204
WebEventDetailCodeBase 50300
SqlProviderEventsDropped 50301
WebExtendedBase 100000

What are the details that get logged when a Health Monitoring event occurs?
The WebBaseEvent provides the details of the information that gets logged for each event:
public class WebBaseEvent : System.Object
{
public static WebApplicationInformation
ApplicationInformation { get; }
public int EventCode { get; }
public int EventDetailCode { get; }
public Guid EventId { get; }
public long EventOccurrence { get; }
public long EventSequence { get; }
public object EventSource { get; }
public DateTime EventTime { get; }
public DateTime EventTimeUtc { get; }
public string Message { get; }
public virtual void FormatCustomEventDetails (...);
public virtual void Raise (...);
}
For more information, see WebBaseEvent Members.

Can the Health Monitoring subsystem be extended?

Yes, you can create your own providers, events and other objects to help customize the
monitoring of your ASP.NET applications. For more information, see Web Event Providers and
WebBaseEvent Class.

Where can I find out more about Health Monitoring and related topics?
ASP.NET Health Monitoring
How to: Install and Configure SMTP Virtual Servers in IIS
How to: Send E-mail for Health Monitoring Notifications
Web Event Providers (Custom Provider Example)
ASP.NET SQL Server Registration Tool
WebEventCodes Class
Walkthrough: Listening for WMI Events in ASP.NET Health Monitoring
System.Web.Management Namespace