IIS insights

When IIS log time-taken values are high but performance counter 'Request Execution Time' remains normal, the latency is in network transfer (client bandwidth, geographic distance) rather than server-side processing.

When the HTTP Service Request Queue (HTTP.sys kernel queue) shows CurrentQueueSize > 0 before requests reach IIS worker processes, the bottleneck is at the kernel level—either port exhaustion, socket limits, or worker process unavailability.

When IIS request queue length grows while CPU usage remains low, it indicates worker threads are blocked waiting on external resources (database, network, locks), not actual processing bottlenecks.

When iis_backend_active connections approach MaxRequestWorkers limit and requests start getting rejected (503 errors), it signals imminent application pool failure due to connection exhaustion.

Frequent or scheduled application pool recycling combined with steadily increasing memory consumption indicates unmanaged memory leaks, often in non-thread-safe modules or application code.

Poor ratio between HTTP 200 and 304 responses (>95% 200s) means clients are not leveraging browser caching, causing IIS to serve every request from disk/application instead of returning 304 Not Modified responses.

When CPU usage exceeds 80% but request queues remain empty and response times are slow, the bottleneck is CPU-intensive application code (inefficient algorithms, excessive serialization, regex operations) rather than I/O wait.

When 500 errors concentrate on specific URI paths rather than distributing across all requests, it indicates problematic code in those specific handlers that should be prioritized for debugging.