Customizing App pools:
By default, Application pools is configured to use
Network Service Account to service the request. At times we will end in a
situation where we should use a separate account for servicing the request for
different reasons. There are other configuration settings which some times need
to be optimized which are really done in exceptional situations. The coming
sections will answer these things and take us through on accomplishing this.
Steps:
1. Right click the App pool you
have created (Test Pool) in this example and click Properties. It will bring a
dialog like below figure 8.
Figure 8 - App Pool Property Recycling tab
Recycling tab is opened with default settings like
above. Periodic recycling of your application pools is recommended that helps to
clean up memory fragmentation, memory leaks, abandoned threads and other
disorders. Keep in mind that when an application pool recycles, session state
information stored in-process is lost for that pool, but other pools are not
affected. ASP.NET, however, does allow you to store your session state outside
the worker process, so that session information is not lost during a recycle.
It’s better to choose this time should fall when there is less number users
accessing the site. We can recycle the worker process based on number of
requests, memory usages.
2. Moving to Performance tab.
Refer Figure 9.
Figure 9 - App Pool Property Performance tab
When the application does not receive request for
certain amount of time it is said to be idle so this setting allow us to free up
the occupied resource from the server after the specified time given here.
Consider changing Request queue limit if your application receives thousands
request per second to mitigate Server busy messages. Most of the time Enable CPU
monitoring is not used. Web garden setting should not be changed from 1, this
specifies the number of worker process required to process the request for an
app pool.
3. Next tab “Health” tab for
configuring the health i.e. the availability of the application can be
configured. Refer Figure 10.
Figure 10 - App Pool Property Health tab
Enable pinging, causes IIS to automatically query a
worker process to see if it is responsive utilizing network bandwidth. Enable
rapid-fail protection helps to disable the app pool for specified number of
failures occurred in the worker process. Startup time limit and shutdown time
limit are self explanatory and failing to satisfy those condition falls under
failure for rapid fail protection.
4. The “Identity” tab is where we
can configure the worker process identity. Refer below Figure 11.
Figure 11 - App Pool Property Identity tab
The predefined setting’s default is to use network
service account which is a less privileged account for security purposes. The
other account that can be pre configured is Local Service and LocalSystem
account. Before making the App pool to use custom account known as Service
accounts we will explore what and why it is used.
Service Accounts:
It is identity of the App pool under which it services
the request. It is account that has very less privileges on the machine so as to
reduce the security risk and loop holes. There can be several reasons to opt for
custom service account over the Network service account. Some of the reasons
are:
Ø
We can have different access controls for different applications
on the local and network resources such as fileservers, etc.
Ø
It is also a mode of isolating one application from another by
giving a separate identity so other applications cannot access the resource of
another application.
Ø
We can prevent any accidental or deliberate changes to the access
controls or permissions associated with the general purpose Network Service
account from affecting your application.
See reference section for creating new service
account.
One think to note here is, if our site uses database
then make sure that the custom service account has the required access to the
database.
Configuring Custom service account with App Pool:
In the above Figure select Configurable> type the
service account id, password and enter. It will ask for password confirmation
like below figure, Refer Figure 12. Click OK.
Figure 12 - Configure service account
After doing this restart the App pool by stopping and
starting it again.
Associating Site with App Pool:
We need to associate our site with the App pool we
created. It can be done by right clicking the site virtual directory (Test in
our case) and property. Select the TestPool from Application pool drop down in
“Home Directory” tab as in the Figure 13. Click Apply and OK.
Figure 13 - Associating site with App Pool
Thus we are at the end of the process and we need to do
a smoke test for the application verification.
Possible Errors:
Error:
Service unavailable.
Resolution:
This is one of the ever green errors often we use to get
due to many reasons mostly because of service accounts. The common problem will
be this account might not be a member of IIS_WPG group on the server or check
IIS_WPG group have Read & Execute, List Folder Contents, and Read
permissions to the Web site directories. So pre check with a network admin who
is creating the service account for you whether the account has all the required
permissions on the server.
Error:
An error has occurred while establishing a connection to
the server. When connecting to SQL Server 2005, this failure may be caused by
the fact that under the default settings SQL Server does not allow remote
connections. (Provider: TCP Provider, error: 0 - A connection attempt failed
because the connected party did not properly respond after a period of time, or
established connection failed because connected host has failed to respond.)
Resolution:
Again there may be several reasons most common will be
check the service account has access to the Sql Server. This error occurs even
if you are not using Sql server 2005 i.e. the same error occurs even if you use
Sql Server 2000. Similar error occurs if there is any problem in connection
string too.
Error:
It is not possible to run different versions of ASP.NET
in the same IIS process. Please use the IIS Administration Tool to reconfigure
your server to run the application in a separate process.
Resolution:
When we host multiple versions of ASP.net in single
server we may get this error in event log. The problem might be a application
pool will be associated with 2 different application that uses different
frameworks. So isolating this application into a different App Pools will solve
the problem.
Things to note:
This section highlights some of the important things to
consider when we are deploying the application.
1. Make sure the Web.Config
setting is perfect, such as connection strings, App setting values, check
<compilation debug="false"/> because setting it to true causes the
application to be processed slow, memory consumption is more, scripts and images
downloaded from the WebResources.axd handler are not cached.
2. To trouble shoot the error if
occurred use <CustomErrors> section in Web.Config and make sure you are
reverting back the original settings so that whenever any error.
3. If we are running multiple
versions of ASP.net on the same webserver don’t use aspnet_regiis utility with
–i switch to register the ASP.net with the IIS, instead use –s switch and
register it for the particular site because using –i switch is going to update
entire IIS with the current version of ASP.net you are registering leaving the
existing application configuration affected. For example: Aspnet_regiis –s
W3SVC/1/ROOT/Test
4. By default IIS does not allow
dynamic contents like ASP\ASP.NET to be processed by IIS. So to allow this, Open
IIS manager click Web Service Extensions and Allow the Web Service Extensions if
it is disabled as shown in the Figure 14. If there is no extensions for
processing say ASP.net 2.0 application, we can add a new web service extension
by clicking “Add a new Web service extension” link shown in the figure. Read
more on MSDN on how to add web service extensions in IIS 6.0.
5. The following are the operating
systems and the versions of IIS packed with it.
Ø
Windows 2000 à IIS
5.0
Ø
Windows XP à IIS
5.1
Ø
Windows 2003 à IIS
6.0
6. Inputs from PrabhuRajan[Refer
Comments in ASPAlliance.Com]
There are some places, were
Firewall is Mandatory and it cannot be disabled. In such condition, after giving
appropriate Permission. Next step is to enable the Web Server(Http) in LAN
Settings of the Firewall.
1. Goto Start à Run à type 'Firewall.cpl'.
2. Goto Advanced tab, in Local
Area Network setting à Click
Settings.
3. After clicking Settings, you
will get the list of services. Check WebServer(Http) is checked or not.
4. After checking WebServer only,
your WebSite can be accessed from Other Machines.
Figure 14 - Web service Extensions
|