all groups > iis security > november 2004 >
You're in the

iis security

group:

IIS 6.0 NT Authorization problem, slow response


IIS 6.0 NT Authorization problem, slow response Janis Buks
11/4/2004 11:51:02 PM
iis security:
Every 1-5 seconds I receive in IIS 6.0 log 401 errors but none of them
appeares in client browsers. IE processes pages normally without errors, but
with delays(sometimes long delays).

We have 2003 server system with MSSQL2k on it and asp/asp.net applications
running. Previously we had win2k and iis 5.0 and same trouble. IIS uses only
NT4 file security when client requests file.

My log looks like this(below is only one! real life page request e.g. click
on link and result in browser without errors), somehow ie requests 3 times
one file but client doesn't even imagine this.

username LogTime processingtime
TMS\Edvard 2004.11.04 13:58 265
- 2004.11.04 13:58 0
- 2004.11.04 13:58 0

servicestatus win32status target
200 0 /abons/seek.asp
401 0 /abons/seek.asp
401 -2146893042 /abons/seek.asp

Searched all net, no answer..only releated symptoms found on
support.microsoft therefore please help me to find answer to questions below:

Any one knows hot to receive in 832911 article listed trouble hotfix?
And how to solve article 297210 if i have iframes in pages, but no chance to
rewrite code without iframes or no chance to use other than NT authorization?
Re: IIS 6.0 NT Authorization problem, slow response David Wang [Msft]
11/5/2004 11:00:52 PM
The reason those 401 errors show up in the log file but not IE is because
they are part of an expected authentication handshake. Modern browsers do a
LOT of such type of processing on your behalf such that multiple
request/response of various status code could be automatically negotiated
even if all YOU saw was clicking on a single hyperlink.

The sequence of 401.2 -> 401.1 -> 200 is expected when the browser
negotiates the 3-way handshake with the server for Integrated
Authentication. However, it's not supposed to happen on every single
request -- if that happens, it suggests that *something* is closing the
connection aggressively. Some possibilities include the web application is
coded that way, maybe you have KeepAlives disabled on IIS, or maybe the
client is intentionally re-negotiating.

If you also saw the problem on IIS5 prior to IIS6, it is almost certainly
not a problem with IIS but rather with something you did.

832911 has nothing to do with your situation.
297210 mentions the behavior is by design for security reasons (opening a
cross-frame must re-authenticate), so you have no choice if you use IFrames
and Integrated Authentication.


So far, everything you have said is "by-design".

What do you mean by "every 1-5 seconds I receive in IIS 6.0 log 401
errors..." -- is the browser making any requests? Are you sure those 401
errors are caused by your browser and not someone else? Can you give more
context, such as a network trace, of your claimed slow response?

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Every 1-5 seconds I receive in IIS 6.0 log 401 errors but none of them
appeares in client browsers. IE processes pages normally without errors, but
with delays(sometimes long delays).

We have 2003 server system with MSSQL2k on it and asp/asp.net applications
running. Previously we had win2k and iis 5.0 and same trouble. IIS uses only
NT4 file security when client requests file.

My log looks like this(below is only one! real life page request e.g. click
on link and result in browser without errors), somehow ie requests 3 times
one file but client doesn't even imagine this.

username LogTime processingtime
TMS\Edvard 2004.11.04 13:58 265
- 2004.11.04 13:58 0
- 2004.11.04 13:58 0

servicestatus win32status target
200 0 /abons/seek.asp
401 0 /abons/seek.asp
401 -2146893042 /abons/seek.asp

Searched all net, no answer..only releated symptoms found on
support.microsoft therefore please help me to find answer to questions
below:

Any one knows hot to receive in 832911 article listed trouble hotfix?
And how to solve article 297210 if i have iframes in pages, but no chance to
rewrite code without iframes or no chance to use other than NT
authorization?

Re: IIS 6.0 NT Authorization problem, slow response Janis Buks
11/8/2004 4:12:01 AM
Thank you for your reply, I think problem is not in network side...either it
is IIS +NT4 domain server miscofiguration either asp applications are lame.
Maybe this will show whats going on in my asp appplications when they are slow

IISState log:
***********************
Starting new log output
IISState version 3.0

Tue Nov 02 15:52:20 2004

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 304

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: bbc
Kernel Time: 0:0:0.15
User Time: 0:0:0.46
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0006fe58 77f43741 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 0006fecc 77e4168f ntdll!NtWaitForSingleObject+0xc
02 010012a0 72617453 kernel32!WaitForSingleObject+0xf
03 33576c55 00000000 0x72617453




Thread ID: 1
System Thread ID: 868
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00a4ff9c 77f4262b SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00a4ffb8 77e4a990 ntdll!NtDelayExecution+0xc
02 00a4ffec 00000000 kernel32!FlsSetValue+0x779




Thread ID: 2
System Thread ID: c74
Kernel Time: 0:0:0.93
User Time: 0:0:0.140
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
c:\windows\system32\inetsrv\W3TP.dll -
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00cfff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00cfff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00cfff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00cfffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 3
System Thread ID: dc
Kernel Time: 0:0:0.62
User Time: 0:0:0.125
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d3ff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00d3ff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00d3ff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00d3ffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 4
System Thread ID: 6a8
Kernel Time: 0:0:0.140
User Time: 0:0:0.296
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d7ff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00d7ff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00d7ff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00d7ffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 5
System Thread ID: 7d0
Kernel Time: 0:0:0.46
User Time: 0:0:0.93
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00dbff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00dbff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00dbff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00dbffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 6
System Thread ID: 7fc
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e7fcec 77f4372d SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00e7ffb8 77e4a990 ntdll!ZwWaitForMultipleObjects+0xc
02 00e7ffec 00000000 kernel32!FlsSetValue+0x779




Thread ID: 7
System Thread ID: a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0174ff14 77f43741 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 0174ff88 77e4168f ntdll!NtWaitForSingleObject+0xc
02 77f420c6 4affc033 kernel32!WaitForSingleObject+0xf
03 0424548b 00000000 0x4affc033




Thread ID: 8
System Thread ID: 7f8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 017cff8c 77f4262b SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 017cffb8 77e4a990 ntdll!NtDelayExecution+0xc
02 017cffec 00000000 kernel32!FlsSetValue+0x779




Thread ID: 9
System Thread ID: f4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 027aff14 77f43741 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 027aff88 77e4168f ntdll!NtWaitForSingleObject+0xc
02 027affec 00000000 kernel32!WaitForSingleObject+0xf




Thread ID: 10
System Thread ID: 158
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\USER32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
\\?\C:\WINDOWS\system32\inetsrv\asp.dll -
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 02aefe1c 77f4372d SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 02aefec8 77d076f5 ntdll!ZwWaitForMultipleObjects+0xc
02 02aeff24 77d077f5 USER32!GetLastInputInfo+0xe4
03 02aeff40 70a183cc USER32!MsgWaitForMultipleObjects+0x1d
04 70a36fa0 00000310 asp!AspStatusHtmlDump+0x305c


....



Thread ID: 23
System Thread ID: a78
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\RPCRT4.dll -
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ole32.dll -
OLE32.dll Symbols not found. Unable to proceed with DCOM check.
Continuing other analysis.

# ChildEBP RetAddr
00 035dfe20 77f4313f SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 035dff8c 77c696a9 ntdll!NtReplyWaitReceivePortEx+0xc
02 035dffb0 77c696d7 RPCRT4!I_RpcBindingIsClientLocal+0x799
03 035dffec 00000000 RPCRT4!I_RpcBindingIsClientLocal+0x7c7




Thread ID: 24
System Thread ID: ae8
Re: IIS 6.0 NT Authorization problem, slow response David Wang [Msft]
11/8/2004 8:52:37 PM
I do not think authorization has anything to do with your slows response.

You have several requests which are stuck waiting for a non-existent
thread -- so they are going to hang until some timeout happens.

I noticed some DB calls made by your ASP pages. I suggest you at least
install this QFE to remove one possible hang possibility on WS03.

http://support.microsoft.com/default.aspx?scid=kb;en-us;838306

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Thank you for your reply, I think problem is not in network side...either it
is IIS +NT4 domain server miscofiguration either asp applications are lame.
Maybe this will show whats going on in my asp appplications when they are
slow

IISState log:
***********************
Starting new log output
IISState version 3.0

Tue Nov 02 15:52:20 2004

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 304

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: bbc
Kernel Time: 0:0:0.15
User Time: 0:0:0.46
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0006fe58 77f43741 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 0006fecc 77e4168f ntdll!NtWaitForSingleObject+0xc
02 010012a0 72617453 kernel32!WaitForSingleObject+0xf
03 33576c55 00000000 0x72617453




Thread ID: 1
System Thread ID: 868
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00a4ff9c 77f4262b SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00a4ffb8 77e4a990 ntdll!NtDelayExecution+0xc
02 00a4ffec 00000000 kernel32!FlsSetValue+0x779




Thread ID: 2
System Thread ID: c74
Kernel Time: 0:0:0.93
User Time: 0:0:0.140
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
c:\windows\system32\inetsrv\W3TP.dll -
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00cfff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00cfff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00cfff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00cfffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 3
System Thread ID: dc
Kernel Time: 0:0:0.62
User Time: 0:0:0.125
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d3ff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00d3ff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00d3ff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00d3ffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 4
System Thread ID: 6a8
Kernel Time: 0:0:0.140
User Time: 0:0:0.296
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d7ff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00d7ff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00d7ff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00d7ffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 5
System Thread ID: 7d0
Kernel Time: 0:0:0.46
User Time: 0:0:0.93
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00dbff28 77f430c7 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00dbff58 5a302360 ntdll!ZwRemoveIoCompletion+0xc
02 00dbff90 5a302531 W3TP!THREAD_POOL::PostCompletion+0x78
03 00dbffec 00000000 W3TP!THREAD_POOL::~THREAD_POOL+0x11c




Thread ID: 6
System Thread ID: 7fc
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e7fcec 77f4372d SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 00e7ffb8 77e4a990 ntdll!ZwWaitForMultipleObjects+0xc
02 00e7ffec 00000000 kernel32!FlsSetValue+0x779




Thread ID: 7
System Thread ID: a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0174ff14 77f43741 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 0174ff88 77e4168f ntdll!NtWaitForSingleObject+0xc
02 77f420c6 4affc033 kernel32!WaitForSingleObject+0xf
03 0424548b 00000000 0x4affc033




Thread ID: 8
System Thread ID: 7f8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 017cff8c 77f4262b SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 017cffb8 77e4a990 ntdll!NtDelayExecution+0xc
02 017cffec 00000000 kernel32!FlsSetValue+0x779




Thread ID: 9
System Thread ID: f4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 027aff14 77f43741 SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 027aff88 77e4168f ntdll!NtWaitForSingleObject+0xc
02 027affec 00000000 kernel32!WaitForSingleObject+0xf




Thread ID: 10
System Thread ID: 158
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\USER32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
\\?\C:\WINDOWS\system32\inetsrv\asp.dll -
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 02aefe1c 77f4372d SharedUserData!SystemCallStub+0x4
WARNING: Stack unwind information not available. Following frames may be
wrong.
01 02aefec8 77d076f5 ntdll!ZwWaitForMultipleObjects+0xc
02 02aeff24 77d077f5 USER32!GetLastInputInfo+0xe4
03 02aeff40 70a183cc USER32!MsgWaitForMultipleObjects+0x1d
04 70a36fa0 00000310 asp!AspStatusHtmlDump+0x305c


....



Thread ID: 23
System Thread ID: a78
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\RPCRT4.dll -
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

Re: IIS 6.0 NT Authorization problem, slow response Janis Buks
11/9/2004 6:12:03 AM
IISState shows only that what I already know, how i could point out the
problem?
"You have several requests which are stuck waiting for a non-existent
thread" and this is the problem so far. I don't know why but IIS proccesses
pages sometimes very very slow (even simple html not asp)

Here is the asp code example that we have in average all our pages:

<%
var qstring="dsn=mydsn;uid=user;pwd=pass"

var ServerConnection=Server.CreateObject("ADODB.Connection"), RecordClone,
query;

//Initialize server connection
function CreateServer()
{
ServerConnection.Open(qstring);
}


//Finilize server connection
function DeleteServer(){
ServerConnection.Close();
ServerConnection=null;
}

//Function than runs sql query and in case of error parses error description
function runSQL(query) {
try {
RecordClone=ServerConnection.Execute(query);
return RecordClone;
}
catch (exception) {
Response.Write("<!--ERROR WAS ON PAGE: "+exception.description+"-->");
}
}


CreateServer();
....

var data = runSQL("select xx from yy"); //lots of simple queries
runSQL("update xx set yy=zz");

....

DeleteServer();
%>

Nothing special as you see. ODBC connection, some simple queries, html
output and thats all. Same sql queries which I launch in asp, through query
analyzer runs in 0 secs
We have windows2003, sql2000, iis6 and asp/asp.net applications on it, also
sometimes we access sql server through access 2000/xp applications.Previously
we had win2k and iss5 same trouble. And yes, we have Iframes in asp pages.

[quoted text, click to view]
Re: IIS 6.0 NT Authorization problem, slow response David Wang [Msft]
11/9/2004 1:58:41 PM
Try asking microsoft.public.inetserver.iis , which has more traffic than
this newsgroup. There are people who knows how to optimize/write ADO code
there.

I think you have issues with your pages/data-access and not security. Many
people run the same sort of things as you do without issues.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
IISState shows only that what I already know, how i could point out the
problem?
"You have several requests which are stuck waiting for a non-existent
thread" and this is the problem so far. I don't know why but IIS proccesses
pages sometimes very very slow (even simple html not asp)

Here is the asp code example that we have in average all our pages:

<%
var qstring="dsn=mydsn;uid=user;pwd=pass"

var ServerConnection=Server.CreateObject("ADODB.Connection"), RecordClone,
query;

//Initialize server connection
function CreateServer()
{
ServerConnection.Open(qstring);
}


//Finilize server connection
function DeleteServer(){
ServerConnection.Close();
ServerConnection=null;
}

//Function than runs sql query and in case of error parses error description
function runSQL(query) {
try {
RecordClone=ServerConnection.Execute(query);
return RecordClone;
}
catch (exception) {
Response.Write("<!--ERROR WAS ON PAGE: "+exception.description+"-->");
}
}


CreateServer();
....

var data = runSQL("select xx from yy"); //lots of simple queries
runSQL("update xx set yy=zz");

....

DeleteServer();
%>

Nothing special as you see. ODBC connection, some simple queries, html
output and thats all. Same sql queries which I launch in asp, through query
analyzer runs in 0 secs
We have windows2003, sql2000, iis6 and asp/asp.net applications on it, also
sometimes we access sql server through access 2000/xp
applications.Previously
we had win2k and iss5 same trouble. And yes, we have Iframes in asp pages.

[quoted text, click to view]

AddThis Social Bookmark Button