Dave's Blog

Where is Execute Permission in the UI?

davcox — Fri, 05 Sep 2008 17:26:00 GMT

A lot has changed in the IIS7 UI from IIS6, sometimes it can be hard to find out where to set certain things such as the execute permission for CGI's and ISAPI's. Yesterday, I was trying to get a CGI to execute, but couldn't find where to set it. In IIS7...(read more)

Accessing custom properties at runtime through managed modules (part 2)

davcox — Wed, 21 Nov 2007 19:53:00 GMT

Ok, now I want to do something in my managed module during runtime that will only read from my custom configuration properties.

I need someplace to start ... like a starter kit! :)
http://www.iis.net/downloads/default.aspx?tabid=34&i=1302&g=6

This helps me get started, but it doesn’t tell me about the other events to get callbacks on as my module runs ... I realized finally that an IIS managed module is really an ASP.net module as far as it's ability to interface with the IIS pipeline. So I took a look at the ASP.net integration articles.

Finally, I found this article:
http://www.iis.net/articles/view.aspx/IIS7/Hosting-Web-Applications/ASP-NET/ASP-NET-Integration-with-IIS7?Page=3

I have my modules working, the starter kit was very helpful to get my Visual studio project setup properly. Athough it didn’t have a reference to Microsoft.Web.Administration which may be a common issue; something to add for future starter kits. This is an important issue that I realized later. Most asp.net modules will be using System.Configuration which does not support the custom properties you add through IIS and the custom schema we've described. Instead, you must use Microsoft.Web.Administration to access this kind of configuration. These two API's unfortunately don't always play well together, so you need to know when you're using which one and why.

Ok, now to deploy my module … seems hard to find a good example of doing this … probably some arcane appcmd command that would do it. I’ll copy and paste config for now … oops, the web.config default in the starter kit didn’t have preCondition="managedHandler" in there …

Ok, I copied my module to the test machine and am trying to make requests ... but it gives me an error saying that it cannot read configuration! Hmm, why is this? What would be different about using the same configuration code in a console (running as the Administrator) and in the IIS pipeline (running as Network Service). Well, the permission's were set properly, both of them can read configuration. But I didn't realize that ServerManager object (in Microsoft.Web.Administration) opens up config for write access, which is not allowed!

I have to use WebConfigurationManager instead of ServerManager …and luckily MSDN helps me: http://msdn2.microsoft.com/en-us/library/system.web.configuration.webconfigurationmanager.aspx

And I found out later that Carlos had just blogged about this! but the search engines had not yet found this great blog post:
http://blogs.msdn.com/carlosag/archive/2007/09/28/IIS7ManagedConfigurationAPI.aspx This is where Carlos goes into some detail about the difference between using design-time and run-time API's (which he implemented).

Great!! Now my module is working ... here is a code snippet:

using System;
using System.Collections.Generic;
using System.IO;
using System.Web;
using System.Diagnostics;
using Microsoft.Web.Administration;

namespace MyIIS7Modules
{
public class PonyModule : IHttpModule
{

        public void Init(HttpApplication application)
        {
            // Subscribe to the BeginRequest event
            //
            application.BeginRequest += new EventHandler(this.CheckForPony);

}

public void Dispose() { }

public void CheckForPony(Object source, EventArgs e)
{

HttpApplication application = (HttpApplication)source;
HttpContext context = application.Context;

string HttpUrl = application.Request.Url.ToString().ToLower();

            /// if this is a PONY request, then let's handle it, otherwise just continue
            if (HttpUrl.Contains("pony"))
            {

                // Get the custom configuration section from that file
                ConfigurationSection section = WebConfigurationManager.GetSection("ENC-Pony");
                bool PonyAnswer = (bool)section.GetAttributeValue("CanIHaveAPonyPlease");

application.Response.StatusCode = 200;

                if (PonyAnswer)
                {
                    ResponseEntity += ("<H1>" + section.GetAttributeValue("YesResponse") + "</H1><BR>");

At a later date, I'll post my entire module with a brief overview of it's capabilities and how to use it.

Dave

Accessing custom properties at runtime through managed modules (part 1)

davcox — Wed, 21 Nov 2007 19:25:00 GMT

Following on my last post in developing my module for app-building week, I want to talk about how I wrote the code for my managed module (C# code). So far, I have custom configuration schema that could be accessed through various built-in tools and I know that I can access custom configuration through managed code, but I needed to find some samples.

So I searched iis.net for some articles, tools and forum posts about this problem.

I found this article first:

http://www.iis.net/articles/view.aspx/IIS7/Extending-IIS7/Extending-IIS7-Configuration/Extending-IIS7-Schema-and-Accessing-the-custom-sec?Page=2
This example isn’t so detailed for a c# newbie like myself and I needed an example to access collections.
I found an example of code accessing collections here: http://forums.iis.net/t/1026445.aspx

And another one here:

http://www.iis.net/articles/view.aspx/IIS7/Extending-IIS7/Using-Microsoft-Web-Administration/Accessing-Configuration-Sections-using-Microsoft-W

With these examples, I was able to write a little console application that would read and write my configuration. A good start.

Here is my code:

using System;
using Microsoft.Web.Administration;

namespace PonyConsole
{
    class Program
    {
        static void Main(string[] args)
        {
            // Initialize the server manager used to administer the sections
            ServerManager serverManager = new ServerManager();

// Get the applicationHost.config file
Configuration config = serverManager.GetApplicationHostConfiguration();

// Get the custom configuration section from that file
ConfigurationSection section = config.GetSection("ENC-Pony");

// Output the default value of the booleanProperty
Console.WriteLine(section.GetAttributeValue("CanIHaveAPonyPlease"));

// Set the new value of the booleanProperty
section.SetAttributeValue("CanIHaveAPonyPlease", true);

// add an item to the collection
ConfigurationElementCollection collection = section.GetCollection("ponies");

            ConfigurationElement newElement = collection.CreateElement();
            newElement.SetAttributeValue("PonyLocation", "HttpLink");
            newElement.SetAttributeValue("value", "c:\\pic");
            collection.Add(newElement);

            // Update the config file with the changes that you have made
            serverManager.CommitChanges();
            Console.WriteLine("Finished writing ... ");

// Output the default value of the booleanProperty
Console.WriteLine(section.GetAttributeValue("CanIHaveAPonyPlease"));

Console.WriteLine("YesResponse is: " + section.GetAttributeValue("YesResponse"));
Console.WriteLine("NoResponse is: " + section.GetAttributeValue("NoResponse"));

foreach (ConfigurationElement element in section.GetCollection("ponies"))
{

                Console.WriteLine(element.GetAttribute("PonyLocation").Value);
                Console.WriteLine(element.GetAttribute("value").Value);
            }
        }
    }
}

At this point I had successfully written code using our new managed interface to read and write to my custom configuration properties. Very exciting ... next post is how do I make this work in the context of an IIS pipeline module.

Adding simple custom schema to IIS Configuration

davcox — Wed, 31 Oct 2007 16:27:00 GMT

Let's see if I can get 2 blog posts written in the same month! :)

As I was talking last post, our team had an app-building week (everyone will see the results over the next couple months; there were some VERY cool tools that I'm excited for people to see). I wanted to document part of my journey on getting a custom schema added.

One thing that I noted is that it's important to make sure your schema file is well-formed XML, or all sorts of tools will choke in various ways.

I looked at the existing iis_schema.xml for examples of various elements that I could use. Also, this IIS.net article is extremely helpful in getting started: http://www.iis.net/articles/view.aspx/IIS7/Extending-IIS7/Extending-IIS7-Configuration/Extending-IIS7-Schema-and-Accessing-the-custom-sec

I ended up creating this schema:

I wanted to automate adding my custom Section to the IIS config system, so I saw that MVolo has a tool to do just that; it works great. It's really just adding one line to applicationhost.config, but it's easier said than automated.

The line that needs to be added to the <configSections> element is:

Here is the iisschema.exe tool which will let you add this line item automatically.

http://mvolo.com/blogs/serverside/archive/2007/08/04/IISSCHEMA.EXE-_2D00_-A-tool-to-register-IIS7-configuration-sections.aspx
http://www.harbar.net/archive/2007/08/08/IISSCHEMA.EXE--A-tool-to-register-IIS7-configuration-sections.aspx

At this point, I could read and write configuration through tools like appcmd and the rest of the configuration stack (including the UI Configuration Editor module).

The next post will be how to develop a managed module that runs in the IIS pipeline.

Recovering FREB.XSL after deleting it

davcox — Fri, 05 Oct 2007 20:23:00 GMT

For the next week, I hope to produce a couple of blogs about my journey through the land of developing a managed module for IIS7. Being a test lead on the team, I rarely have time to get my hands dirty with the product at the level of developing modules against API's; it's a lot of fun and I wish I had more time for it.

The first thing I wanted to mention was that I had a hard time getting my module to emit tracing information properly to FREB aka Failed Request Tracing. Although I had numerous problems (which I will go into some detail about next week); the frustrating one was when I deleted my FREB style sheet freb.xsl ... I tried a lot ot get it back, restarting services, etc. but I had to walk down the hall and talk my good tester Bobby (who tests FREB) to see how to get it back!

He said that I needed to delete the directory that was containing the freb log files. Once I deleted the entire folder (not just the files in the folder), then to my great joy, I saw the FREB.XSL file back in the folder after my next request to the server. The FREB module will re-create the XSL file only when it is creating the folder to begin with; due to performance reasons, it does not check if the XSL exists after the folder is created.

I bet a lot of people will see that; and hopefully we can get an article written about troubleshooting FREB, but until then, this blog entry (and perhaps others) will have to suffice. There has been talk of posting updated XSL's up on iis.net which is a great idea! I hope some of you take the XSL file, improve it and post it here as well!

Task pane, task pane, task pane

davcox — Tue, 13 Feb 2007 20:45:00 GMT

In the IIS7 UI, which is the first IIS UI that anyone can actually say "looks beautiful" ... has had a bit of a learning curve for me. I keep forgetting about the "Task Pane", sometimes called the "Action Pane" which is on the right side of the window.

There are a LOT of very useful little tasks that you might be looking for in the "main" middle pane but you can't find.

As an example, I was just examining the IP and Domain Restrictions dialog and couldn't find the domain restrictions part, well it was hidden until you enable the Reverse DNS Lookup (which is bad for performance) ... but the item to turn this on is in the Task Pane in the Edit Feature Settings action. A couple UI modules have tasks/actions like this. IP and Domain Restrictions is one of them, Output Caching is another, and Error Pages is another. These are just a handful of hte modules where you need to be alert and look at the Task Pane to really find the setting that you're looking for.

One of the things I really love about the new UI is that it shows so many more settings than were exposed before. Even settings for old features like ASP are now brought out into the UI. When I go back and look at the IIS6 UI, it really didn't have as much surface area of the IIS feature set exposed for easy administration. I'm glad we've been able to add so much richness and depth to IIS7.

Also, we finally have a forum specifically for the Administration UI. If you feel silly because can't find where to set "that setting", this is a great place to ask. If you want to know how to add your own UI (to do whatever you might want to do to ease administration ... such as perf counters, customized metrics and configuration, etc) this is a great place to ask.

Here is the direct link: http://forums.iis.net/1111/ShowForum.aspx

WebDAV coming (short)

davcox — Wed, 13 Dec 2006 17:49:00 GMT

Some people were asking me about webdav in IIS for Vista ... and you're right it's not there. But check out Keith Moore's blog on the future of webdav with IIS (I was impressed). Keith's background is somewhat legendary on the team and so I have high expectations for what they will produce for a new and improved webdav module for IIS7.

I don't know how many people have been using webfolders (and a lot of other products and services) and not known that under the covers they were using DAV.

One example is that with Windows XP and Windows Vista, you can do "net use * http://intranet-site/mywebdav/" which will effectively map a drive to a particular webdav enabled virtual directory. It's a pretty cool feature ... and in fact we use webdav to move around files in our own test infrastructure.

Some of the history of WebDAV is that it was written by a team in Exchange, which used the same code for DAV-EX (WebDAV against an exchange store), DAV-FS (WebDAV against the file system which is what IIS used) and DAV-SQL (WebDAV against a SQL store). This team no longer exists and cannot support WebDAV that we have shipped with IIS; so Keith, Robert and Marchel have taken on this charter to do a simplified and more performant version of WebDAV that fits into the IIS7 "Module" programming model. The cool thing about this is that we already have a large automation suite that we can use to test WebDAV, so I expect we'll have a high-quality release.

I hope to get more into bloggin here soon ... perhaps the new year will bring more time ... :)

UNC on IIS7 - time for a refresher course!

davcox — Tue, 05 Sep 2006 16:55:00 GMT

Recently we started an effort to again look at the centralized content and configuration story and see where we can improve for IIS7. It was a bit amazing to me that some people had not yet read the whitepaper from Brett Hill and myself on remote content and configuration! :) And sadly didn't understand the value of the "GetLastModified" based caching algorithm for hosters. Anyway, they will be reading the paper and I'll be giving a quiz afterwards to check. :)

Typically when scaling out a web server for lots of sites, performance isn't the critical piece (sometimes caching is off completely), but TCO per site and per box is. This is where using the alternative caching method of the GetLastModified date in our static file and asp page caching systems comes into play. As the whitepaper goes into detail about, this algorithm may use more internal network bandwidth, but it doesn't use up NonPaged Pool (memory) on the webserver or file server to maintain the change notifications. This allows the machines to have a broader set of content and still maintian some performance characteristics.

The unfortunate part of this, is that only static files and asp content are covered by this caching algorithm, for FPSE and asp.net and 3rd party handlers; we don't have an easy way to expose this caching system. Perhaps in a future version of IIS this will occur.

If you haven't read the whitepaper and want to see your web server scale better where you have your content centralized, please read this whitepaper ... we'd love to get your feedback.

Here is the link: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/webapp/iis/remstorg.mspx

3 Years and 3 months

davcox — Fri, 21 Jul 2006 18:44:00 GMT

Windows Server 2003 and IIS6 released in March of 2003. Last week, we released a patch for asp.dll to fix our first vulnerability in over 3 years!

It was kind of a sad day for the team (but one that we knew would come), because after IIS5, we committed as a team to never let IIS be an primary attack vector for the Windows platform. And so far we've been able to keep that commitment. Hopefully it'll be another 3 years before we release another one! :) So it was also a happy day in that 3 years is a really long time (these days) for your product to be really "unbreakable". :)

I had the duty of testing the patch before it was released to make sure the vulnerability was indeed fixed. Ulad did a great job of doing a very thorough analysis of the code and a thorough fix to the issue. Given that we hadn't shipped a release like this in 3 years we did have a couple hicups, you might have seen or experienced this issue:

http://news.com.com/Microsoft+irons+out+security+patch/2100-1002_3-6096179.html?tag=newsmap

That issue was mostly due to the "detectoid" logic that WU uses to say if the patch is needed or not; the patch itself was fine (so no work was required on the IIS side) although I spent a long night here last week to help them pinpoint the issue.

Also, we were unable to get the right logic to restart w3svc prior to updating the asp.dll binary, but there is an easy workaround for that. Next time, (if there is a next time) we'll be sure to get that logic correct.

As the MSRC bulletin says, this vulnerability requires the attacker to place asp content on the machine (so for example hosting scenarios). Once the maliciously formed page is requested, the attacker would be able to run arbitrary code. So it's certainly an important patch to install. There is extremely little risk in installling this patch given the nature of the code change and the testing that we did on this patch.

Anyway, I'm glad to be back blogging, I had some permissions and user account problems blocking me.

Perf counter behavior changes in IIS6

alowe — Fri, 17 Mar 2006 21:41:00 GMT

I thought I'd really just share some information I collected while testing perf counters during the IIS6 days. The big changes were primarily to address the architecture and new process model that HTTP.sys and IIS provided and also to help our scalability situation. Much of the counter behavior was already documented in the resource kit, but I thought I'd add my own flavor to this, since I helped the UE people write the docs and I think they did a great job given the difficult challenge it is to write about something as you learn it. So this blog basically covers two items; it covers counters that have new behavior and then some registry keys you can set if you really need to scale out your server for tens of thousands of sites (rare).

Counters that have updated behavior

Bytes Per Second and Total Bytes counters

In IIS5, these counters gave you the Bytes per Second:

"BYTES_SENT_COUNTER",

"BYTES_RECEIVED_COUNTER",

"BYTES_TOTAL_COUNTER"

In IIS6, they give you Bytes Total (Total sent, total received, total sent+received)

These counters are new in IIS6 and will return the Bytes per Second values:

"BYTES_SENT_PER_SEC",

"BYTES_RECEIVED_PER_SEC",

"BYTES_TOTAL_PER_SEC"

This brings the PDH counters in line with SNMP counters that had already existed.

IIS 6.0 counts Current Non/AnonymousUsers as Current Requests; IIS5 equates users with connections.

This means that you’re going to notice much smaller CurrentAnonymousUsers count in IIS6 (and consequently a lower MaxAnonymousUser). The same is true for NonAnonymousUser counters. But actually it is just more accurate. CurrentUsers are now the # of current in-flight requests (the # of requests currently being worked on by the server). CurrentConnections is a better counter to monitor for scalabilty and availability metrics (its behavior is unchanged). This number will of course be much higher than the number of users for sites that support keep-alive connections.

It’s important to remember that in IIS6 each request (not connection) is logically a user.

In IIS 6.0 the Kernel Mode Cache causes some new behavior in counters.

You may notice that these counters no longer increment when files are only being served out of the Kernel-Mode cache.

Total Files Sent

Total Files Transfered

Instead, Web Service Cache\Kernel: URI Cache Hits will be incremented.

Total Anonymous Users and related Anonymous User counters will be updated during cache hits. Be aware that the Kernel mode cache does not cache requests that are authenticated so the NonAnonymousUser related counters are exactly the same as before.

New general counter behavior

Several new registry keys exist to help IIS scale to many more sites:

The registry keys all exist under this node:

HKLM\SYSTEM\CurrentControlSet\Services\w3svc\Performance\

Here are some typical settings that we used in our testing (no warranties expressed or implied):

"FreshTimeForCounters",1,"REG_DWORD"

"CheckCountersEveryNMiliseconds",250,"REG_DWORD"

"NumberOfTimesToCheckCounters",8,"REG_DWORD"

These registry keys allows IIS to “check” on the counters less often. As you add more sites to IIS, each site will be “asked” for counters which can be quite time consuming. The idea here is that you want to increase the Miliseconds and FreshTime to a higher number when you have higher sites. You'll know you might want to do this if you have a lot of extremely idle sites (on the order of more than 10 thousand), but the w3wp's are using up a lot of processor time. Be careful here, most people won't need to mess with these registry keys.

My first blog

alowe — Fri, 17 Mar 2006 17:09:00 GMT

Yeah, what a cheesy title, but hey it's just my first blog entry. My goal is to get a blog entry out at least once a week, if not more.

So why blog? Well it's a great way to have a little fun and talk with other people about the things I'm interested in. It's also a good way to get more data from customers about IIS and help teach people about some cool things IIS is capable of doing, but that we didn't get time to document or explain fully.

Topics I plan to go over in the course of my blogs:

Various feature areas I've tested in IIS, such as WebDAV, HTTP Compliance, Perf Counters, Static File Handler, UNC scenarios
Testing in Windows - automation strategy; assessing quality of complex products
Why Microsoft? - why I like working here and plan to stay working here
Other stuff - I might get into politics, religion ... all the things you're not suppossed to talk about during dinner. :)
Lastly, as a homeowner I spend a lot of time on my lawn and house ... and since I'm too cheap to hire out work I like to do the stuff myself or work on it with a friend

I'll blog again soon, but here's the first installment. Next time around, I'll start digging into some of the nitty gritty details of perf counters and how they've changed between IIS5 and IIS6.