IIS Monitor Download

Data & security

Your data stays on the server

Where IIS Monitor keeps settings and history, who can read them, what it never stores (query strings, SQL literal values) and why nothing listens on the network.

All features and guides

Where IIS Monitor keeps its data

WhatWhere
Settings, including SQL Server connection strings and blacklist rules%ProgramData%\IISMonitor\settings.json
History, slow queries and IP blocks%ProgramData%\IISMonitor\history.db (SQLite)
Dashboard preferences (Overview ticks, colors, RAM choice)%LocalAppData%\IISMonitor\dashboard.json, per Windows user
The request log, Top IPs and rule hit countsThe service's memory only
Service errorsThe Windows Application event log, source IISMonitor

When IIS Monitor creates %ProgramData%\IISMonitor, it restricts access to Administrators and SYSTEM, because the settings can contain SQL Server connection strings.

What is never stored

  • URL query strings. The request log keeps paths only.
  • SQL literal values. Statements are stored with values replaced by ?: WHERE Email = 'x@y.com' becomes WHERE Email = ?, double-quoted values too.
  • Requests on disk. The request log lives in memory and is gone when the service stops. Lifted and expired blocks are deleted along with the rest of the history when it ages out.

Nothing listens on the network

The dashboard talks to the service over a local named pipe that only Administrators and SYSTEM can open. IIS Monitor opens no port and sends no data off the server: there is no cloud service, no telemetry and no account to register. The only connections it makes are to the SQL Servers you configure.

SQL Server access

  • Prefer Integrated Security=true so no password is stored. The service runs as LocalSystem and signs in to a local SQL Server as NT AUTHORITY\SYSTEM and to a remote one as the computer account, DOMAIN\SERVER$.
  • The login needs only VIEW SERVER STATE, or VIEW SERVER PERFORMANCE STATE on SQL Server 2022 and later. IIS Monitor reads dynamic management views; it doesn't read your tables, create objects or start traces.

Changes IIS Monitor makes, and only when asked

ActionWhat changes
Enable response timesIIS W3C log target becomes File, ETW; four log fields are switched on if off. Asks first.
Set up IIS logging…Standard W3C fields for all sites; optional custom header fields per site. Asks first.
Blocking a direct visitorA Windows Firewall rule in the group “IIS Monitor”.
Blocking a visitor behind a trusted proxyA deny entry in IIS IP restrictions, batched, never above an allow entry covering the address, and never in Shared Configuration.

Uninstalling removes every block IIS Monitor made; IIS logging settings are left as they are.

How big the history gets

About 60,000 rows per app pool or site per week at 10-second resolution. Measured: 10 pools and 10 sites with every metric populated take about 260 MB for 7 days, and a 7-day chart query takes about 0.15 seconds. A 30-second resolution cuts the size to a third. Old rows are deleted every hour.