Active Sessions Performance Counter for Web Server

The more secure method uses Windows authentication. This will allow you to write your application without a password included in any of the connection strings or config file.

One each system you will create a user account. This should not be an administrator account, just a regular user account. One both systems create the user with the same name and password.

Now on your IIS system edit the application pool settings. Change the identity to run as the user account that you just created. At this point you will need to type in the password for the user.

On the SQL server create a login account that is associated with the Windows use account that you have created. You can use the normal SQL Server permissions to grant/deny the actions that your application requires.

Now in your application connect to the SQL server using integrated security. The app pool user will be used when making the SQL connection.

No password in your config or app and a secure database connection!

Here are 2 documents that should be helpful. The first is a general IIS "Suggested Performance Counters to Watch" list that includes baseline ideal values. The second adds some suggested counters for monitoring ASP.Net performance.

http://technet.microsoft.com/en-us/library/cc782186(WS.10).aspx
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/97d0872a-96b3-41e4-8997-b174a9dbb87f.mspx?mfr=true