Ganesh Anekar's Blog : Troubleshooting

PAL - Performance Analyzer with IIS

ganeshanekar — Wed, 12 Aug 2009 13:30:03 GMT

PAL is a very good tool when it comes to analyzing perfmon data. This automated tool generates a nice report in html format which can be sent to customer’s directly. This tool is written by BizTalk PFE and few others. As this is a free tool, customers can download the tool on their own. Tool has built in templates for OS/Exchange/MOSS/AD/BizTalk/SQL with recommended(baseline) counter values specific to products and which can be customized further.

Check out these links for more information:
http://www.codeplex.com/PAL/Release/ProjectReleases.aspx?ReleaseId=16807
http://msdn.microsoft.com/en-us/library/cc296652.aspx
http://blogs.technet.com/clint_huffman/archive/2008/09/02/how-to-use-the-pal-tool-for-biztalk-performance-analysis.aspx

PAL Download - http://www.codeplex.com/PAL/Release/ProjectReleases.aspx?ReleaseId=16807

Note: It requires Microsoft Log Parser. Log Parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files, and CSV files, as well as key data sources on the Windows operating system such as the event log, the registry, the file system, and Active Directory® ,directory service. You may want to use this tool to query a significant amount of logging information.

You can download the Log Parser tool at http://go.microsoft.com/fwlink/?linkid=85574.

More Info on PAL Tool - http://msdn.microsoft.com/en-us/library/cc296652.aspx

IIS 7.0/IIS6.0 - URLSCAN 3.1 and Outlook Web Access

ganeshanekar — Fri, 26 Dec 2008 12:15:00 GMT

I was working with one of the customer on Urlscan and their requirement was to install Urlscan on Windows Server 2003 64-bit to hide Server's identity. Basically in Urlscan.ini, we can configure "RemoveServerHeader=1" to server's identity from HTTP Header.

As Urlscan 2.5 has urlscan.dll in 32-bit, we weren't able to get it work on Windows 2003 64-bit and the only option was to switch IIS worker process to run in 32-bit mode (Enable32bitAppOnWin64). But they wanted to run it in 64-bit. So we downloaded latest Urlscan 3.1 64-bit and installed it on Windows Server 2003 64-bit.

Download URLSCAN 3.1 from following locations:
Download the x86 version from Microsoft Download Center here.
Download the x64 version from Microsoft Download Center here.

Once you download desired URLSCAN, you can double click .msi to to install Urlscan and here is how it looks:

By Default Urlscan keeps all the files in "%systemroot%\system32\inetsrv\urlscan" folder on Windows 2003/2008/Vista. We successfully installed Urlscan 3.1 64-bit on Windows Server 2003 64-bit and found that urlscan.dll ISAPI filter is loaded (shows up green arrow) in Default Web Site>ISAPI Filters Tab in IIS 6 Manager.

Note: If you install Urlscan 2.5 which is 32-bit on 64-bit machine, it copies all the file to "%systemroot%\SysWOW64\inetsrv\urlscan" folder.

Customer had Exchange 2007 installed with OWA configured. When OWA users tried to access the OWA site, they got a Blank page, little strange. So we looked at Urlscan logs, we found that the OWA URL was rejected by urlscan. The reason for rejection "AllowDotInPath" was not permitted [set to 0 (Zero)]. After changing "AllowDotInPath=1" in Urlscan.ini, all OWA users were able to successfully browse/login to OWA site.

Here is a MS KB 823175 which talks about sample Urlscan.ini template file for OWA. Anytime you configure Urlscan and if it does not work, simply look at urlscan log file and check reason for URL rejection.

Later I installed Urlscan 3.1 on my 64-bit Vista machine running IIS 7.0. You can see Urlscan 3.1 ISAPI filter gets installed in ISAPI filters lists.

Without any re-configuration in Urlscan.ini file, I simply tried browsing a HTML page and here is what I got:

By Default, anything which is NOT in allow section, will get rejected and normally show "404 Error" on the page.

You can check URLSCAN logs to see what is the cause of rejection. The log resides in "%system%\system32\inetsrv\urlscan\logs" folder.
Look for recent file e.g. - urlscan.121708.log.

Here is a example of rejected URL by URLSCAN 3.1.

#Software: Microsoft UrlScan 3.1
#Version: 1.0
#Fields: Date Time c-ip s-siteid cs-method cs-uri x-action x-reason x-context cs-data x-control
2008-12-17 05:05:38 ::1 2 GET /default.aspx/SampleNamespaceOne/Welcome.html Rejected URL+contains+dot+in+path URL - -

Check out blogs on UrlScan v3.1 by Wade
SQL Injection attack

IIS 7.0 - Application Pool Recycles - Log a event in Windows Event Log

ganeshanekar — Fri, 12 Dec 2008 13:18:00 GMT

This is my 1st blog post on IIS 7.0.

Application Logging

Apart from the standard IIS logs type, other items can be logged. Many of these options can be set in UI using the IIS Manager or by using Appcmd.exe - IIS command line administration Tool.

Application Pool - Process Recycling Logging

In IIS 7.0, events are logged to the Windows event log when an application pool recycles. You can control eight recycling application pool configuration settings with each option listed in Table below:

Recycling Options Under Generate Recycle Event Log Entry
Option	Description	Default Setting
Application Pool Configuration Changed	Event is logged when the application pool recycles due to a change in its configuration	No
ISAPI Report Unhealthy	Event is logged because an ISAPI extension has reported itself as unhealthy	No
Manual Recycle	Event is logged when the application pool has been manually recycled	No
Private Memory Limit Exceeded	Event is logged when the application pool recycles after exceeding its private memory limit	Yes
Regular Time Interval	Event is logged when the application pool recycles on its scheduled interval	Yes
Request Limit Exceeded	Event is logged when the application pool recycles after exceeding its request limit	No
Specific Time	Event is logged when the application pool recycles at a scheduled time	No
Virtual Memory Limit Exceeded	Event is logged when the application pool recycles after exceeding its virtual memory limits	Yes

In IIS Manage UI, you can find above options as below:

1. Open IIS Manager

2. Go application pools.

3. Highlight the application pool and select "Advanced Settings".

4. Under Recycling, Expand "Generate Recycle Event Log Entry"

Classic ASP Error Logging:

For Classic ASP (Active Server Pages) in IIS 7.0, you can configure options for logging ASP errors under the ASP section in the IIS Manager. You may use the following options to discover issues when migrating your Classic ASP applications to IIS 7.0.

Enable Log Error Requests - Controls whether the Web server writes ASP errors to the application event log
Log Errors To The NT Log - Specifies that ASP errors are recorded in the Windows event log

Note: These options are also available in IIS 6.0, but you have to use ADSUtil.vbs to enable them in the metabase. Now, in IIS 7.0, you can use the IIS Manager to enable these options or use command line appcmd.exe tool.

Logging ASP.NET Exceptions:

All ASP.NET 2.0 unhandled exceptions are always written to the Application Event log. Along with application pool recycle events or other errors in the event logs, this can be very helpful in troubleshooting application errors. It is always a good idea to debug Unhandled Exceptions in ASP.NET. See following blogs for more information:

Debugging Unhandled Exceptions in ASP.NET
Learning how to Debug ASP.NET App Issues (Memory Leaks, Crashes, Deadlocks, etc)

IIS 6.0 Events Reference
IIS logs events in the windows event viewer which helps to analyze performance and troubleshooting. Review "Event Reference" for more information.