You can use the zoom tool as well as click and drag to focus on specific parts of the hierarchy. You can now see a hierarchy of all of your services.If you're in Tile View, access the Tree View by clicking the Tree button. By default, this app opens on the Service Analyzer Tree View. Individual services can have multiple KPIs - for example, Database KPIs could include % Memory Used, % CPU Used, % Disk Space Used or Database Queries. KPIs are searchable performance metrics, such as CPU load percentage, and any valid business metrics like revenue. The health of a service is affected by the health of a child service. This is an overall score for each service based on the health scores of all of its KPIs, and ranges from 0-100 (0 being critical and 100 being normal.) Within Splunk ITSI, services are color-coded using a traffic-light system according to their SHS. The Service Analyzer within Splunk ITSI lets you do that by showing metrics for your services that you can drill down into to access different levels of detail. One cannot just use sc_status=401 for failed logons. When a service is non-responsive or not running as intended, it's essential to be able to quickly identify the root cause of the problem. Server returns sc_status=200 with the page details.Client sends “GET /” with Authorization head.

Server returns sc_status=401 Authorization Required.Can I provide a report that shows the top failed logons into IIS with integrated authentication? Since the integrated authentication does something like this:

Which brings us to the question that caused me to write this blog post. You can look up any other sc_win32_status codes at MSDN. Once you submit those credentials, you will get another sc_status=401 but with sc_win32_status=2148074252 instead when those credentials cannot be verified. This will prompt the browser to pop up a window saying “Enter your credentials”. You will normally see sc_status=401 sc_win32_status=2148074254 on the first access during an integrated authentication to an IIS Web site. No credentials are available in the security package This aids in debugging when things go wrong.įor the sc_win32_status, fortunately, there are only a few you need to know: Win32 Code

You can get really granular about why a particular request failed. The majority of failures are in 401 (which deals with Authentication and Authorization) and 404 (which deals with server-side failures, as opposed to the content generators and filters). Header values specify a configuration that is not implemented UNC authorization credentials are incorrect Request Filtering (Query string is too long) Request Filtering (Content length is too long)

Request Filtering (Hidden File Attribute) Not Found (Web service extension lockdown policy) Not Found (Website not accessible on the requested port) Here is the big table: Status CodeĪccess Denied (Logon Failed due to server configuration)Īccess Denied (Unauthorized due to ACL on resource)Īccess Denied (Authorization failed by filter)Īccess Denied (Authorization failed by ISAPI/CGI application)Īccess Denied (By IIS6 URL authorization policy on web server)įorbidden (Client Access Licenses exceeded)įorbidden (Client certificate is untrusted)įorbidden (Client certificate is expired)įorbidden (Cannot execute URL in current application pool)įorbidden (Cannot execute CGIs in current application pool) The sc_status codes follow a pattern: 1xx are informational, 2xx indicate success, 3xx indicate redirection, and higher ones are for errors. So, for instance, 401.1 means an sc_status of 401 and an sc_substatus of 1. These are normally written together as a decimal number. Let’s start with the sc_status and sc_substatus codes. How can you really decode these, especially since the sc_win32_status seems to have really large numbers? There is also an extended code called sc_substatus and a Win32 error code. The HTTP/1.1 status is stored in sc_status (and it is automagically decoded for you in Splunk 6). However, IIS gives you two more status codes in the log files. Everyone (just about) knows that there is a table of status codes that HTTP/1.1 defines.

Error code 32 splunk itsi