Preparing Your IIS VM for Azure SRE Agent: A Reader-Only Guide
Microsoft walks through preparing an IIS virtual machine on Azure for a reader-only Azure SRE Agent: Azure Monitor Agent ships IIS logs, Windows events, counters and configuration changes into Log Analytics. The lesson is that diagnosis quality depends less on the model than on the evidence the agent can actually read.
Key points
- A reader-only SRE Agent sees only two sources: Azure control plane data and Log Analytics; uncollected files stay invisible.
- Install the AzureMonitorWindowsAgent extension and associate a DCR that ships Microsoft-W3CIISLog, selected events and eight counters.
- IIS logs must be W3C on a local drive with circular logging off; hourly rollover keeps data flowing, and AMA picks up a log roughly every 5 minutes.
- The default 20 MB Application log can lose a day of events in an hour on a busy server; enlarge it and collect WAS 5002/5011 plus reboot IDs 41, 1074 and 6008.
- Enable the Microsoft-IIS-Configuration/Operational channel for Event 29 and file auditing for Event 4663 to see who changed what.
- Alert on a missing Heartbeat (10 minutes) so the agent can tell no errors apart from no data.
Azure SRE Agent investigates problems in Azure rather than on the box: it installs nothing in the guest OS and, in the reader-only setup Microsoft describes here, never runs commands on the server. Its only views of an IIS workload are the Azure control plane (metrics, Activity Log, Resource Health) and a Log Analytics workspace it queries with KQL. Everything inside Windows and IIS therefore has to be pushed out first.
The pipeline is the AzureMonitorWindowsAgent extension plus one data collection rule shipping W3C IIS request logs, selected Application and System events, IIS configuration changes and eight performance counters. The quieter fixes matter as much: raise the 20 MB Application log, keep hourly rollover and UTC timestamps, enable the Microsoft-IIS-Configuration/Operational channel so Event 29 shows who changed a setting, and alert on a missing Heartbeat so "no data" is not read as "no errors".
Real-world use
- A single VM hosting several ASP.NET sites that needs 500s traced to the right site and application pool.
- An ops team asking why a pool recycled at 02:14 without collecting WAS information-level events.
- A log-heavy IIS server where free-space alerts should fire before the volume fills and takes the site down.
- A developer separating application code, SQL and downstream calls when a page is slow, by pairing IIS time-taken with APM data.
Why it matters
An agent diagnoses only as well as the evidence it can read; if IIS logs, counters and change events never reach the workspace, no model can name a root cause and the investigation ends by asking for more data.