Application Pools

Application pools, as discussed in Chapter 1, are used when IIS is running in worker process isolation mode. Application pools make worker process isolation mode work with the applications by tying applications to worker processes. Application pools help maintain the health of IIS, since an application can be tied to one or more worker processes. Also, since worker processes are separated, if one fails, the others aren’t affected, ensuring your other applications are available.

You access the Application Pools node from the IIS MMC, as shown in Figure 2-22.

Figure 2-22: Application Pools in the MMC

Creating an Application Pool

The default application pool is called DefaultAppPool. Each site created will use the DefaultAppPool unless otherwise configured. To make a new application pool:

1. Highlight Application Pools in the IIS MMC.

2. Choose Action | New | Application Pool. The Add New Application Pool dialog box appears.

3. Type in the Application Pool ID in the text box. This should be a friendly name.

4. If you want to use another application pool as a template, instead of the default settings, click the Use Existing Application Pool As Template radio button and choose that application pool from the list.

5. Click OK.

Application Pool Properties

After you have created a new application pool, you can configure its options. To access the Application Pool Properties window, highlight the application pool in the MMC and choose Action | Properties. The Properties window will open, where you’ll be able to configure this pool. You can also configure all the application pools globally. Just highlight the Application Pools level instead of the individual pool. The options are the same.

The Recycling Tab

On the Recycling tab, shown in Figure 2-23, you configure memory and worker process recycling. Recycling worker processes helps keep IIS healthy by terminating the worker process and launching a new one, thereby returning all the memory that a worker process used.

Figure 2-23: The Recycling tab

You can set five criteria for recycling processes. You can use one or all of them at the same time.

• Recycle Worker Processes (In Minutes) Allows you to configure the number of minutes that a worker process will be active before it is terminated and a new one is launched in its place. You can choose any value between 1 and 4,000,000 minutes. At 1 minute, you’ll be recycling so often that your server will be doing that more than anything else. At 4,000,000 minutes (7.6 years), you may as well not recycle at all. From a memory leak perspective, the frequency needed to recycle depends on the technology the site is using. ASP/COM applications have many more memory leak problems than ASP.NET or CGI applications. The volume of requests on the site is also an important consideration. Each application is different, so it’s best to evaluate how the application handles itself to determine how often you need to recycle it.

• Recycle Worker Processes (Number Of Requests) Allows you to configure how many requests a worker process processes before recycling. You can choose any value between 1 and 4,000,000 requests.

• Recycle Worker Processes At The Following Times Will configure certain times of the day, each day, that the worker processes are recycled. You can add, remove, and edit the times here.

Dealing with Memory Leaks

Memory leaks are caused by applications that run and don't return all the memory used back to the system. Each time that application is run, a little more memory is lost. Eventually, there isn't enough memory left for the system to run. Memory leaks are very easy to create. For example, the following ASP code will cause a memory leak:

SET MyBadApp = Server.CreateObject("SomeApp.ThisHurts") MyBadApp.DoSomething

Normally, you should close out your application by setting MyBadApp to Nothing by adding the line SET MyBadApp = Nothing. By not making this setting, that memory is not returned.

Memory Recycling You can also recycle based on memory usage. This is a great way to prevent memory leaks from taking over the system, since you can recycle as soon as a predefined threshold is reached.

• Maximum Virtual Memory (In Megabytes) Will recycle the worker process after the threshold is reached. This is measured against the system’s virtual memory. Valid choices are between 1 and 2,000,000 MB. Note that you can enter a number much larger than the actual amount of virtual memory you have available (about 1.9 terabytes), and, of course, 1 MB will pretty much always be hit, so you’ll be recycling constantly.

• Maximum Used Memory (In Megabytes) Will recycle based on physical memory usage, instead of virtual memory usage. The valid choices again are between 1 and 2,000,000 MB, which is far more memory than your average Windows Server has.

The Performance Tab

The Performance tab, shown in Figure 2-24, enables you to configure the options that keep IIS from taking over the CPU.

Figure 2-24: The Performance tab

• Idle Timeout Allows you to configure how long a worker process can stay idle before it is shut down. This allows more applications to be hosted on a server, especially if they are frequently idle, since they won’t use CPU time when idle. You can choose any time period between 1 and 4,000,000 minutes.

• Request Queue Limit Configures the number of requests that this application pool will queue up before rejecting any new requests. This prevents the server from becoming overloaded with requests. When the limit is reached, the server will respond to all new requests with an HTTP 503 “Service Unavailable” error. You can choose between 0 and 65,535 items in the queue.

• Maximum CPU Use (Percentage) Prevents this application pool from using a certain percentage of the CPU time. This uses CPU accounting to track the CPU time, and it is not done in real time. You can set any value between 1 and 100 percent.

• Refresh CPU Usage Numbers (In Minutes) Configures the refresh time for CPU accounting. The CPU process numbers are updated at this interval. You can select any time between 1 and 1440 minutes.

• Action Performed When CPU Usage Exceeds Maximum CPU You have two options: No Action or Shutdown. No Action just writes an event to the event log. Shutdown sends a shutdown request to the worker processes in this application pool.

Web Gardens Web gardens allow you to farm out requests to more than one worker process in this application pool, which allows an even greater degree of performance and reliability, since this application will be using multiple worker processes and an error in one process will not affect the other worker processes. The Maximum Number Of Worker Processes setting allows you to set the number of worker processes in this application pool. You can choose between 1 and 4,000,000 worker processes for this application.

Caution 

Setting too many worker processes can hurt your system’s performance, since each one takes about 5 MB just to start. Keep this in mind when choosing how many worker processes to run on your server.

The Health Tab

The Health tab, shown in Figure 2-25, allows you to configure options that keep this application pool healthy or to detect when problems occur.

Figure 2-25: The Health tab

• Enable Pinging Configures the system to ping the worker process periodically. If the worker process fails to respond, something is wrong with it, so IIS terminates that process and creates a new one. You can choose any value between 1 and 4,000,000 seconds.

Rapid-Fail Protection Rapid-fail protection protects the server by monitoring failures in the worker processes. If a service fails a certain number of times in a certain time period, IIS shuts down this application pool to protect the server. The server will respond to all new requests with an HTTP 503 “Service Unavailable” error.

• Failures Configures the number of failures that the server will allow before triggering the rapid-fail protection. You can choose any number between 1 and 4,000,000 failures.

• Time Period (Time In Minutes) Configures the period of time in which these failures must take place before the rapid-fail protection takes place. You can choose any time period between 1 and 4,000,000 minutes.

Here’s how it works:

1. The worker process fails.

2. IIS writes an event to the application log stating that the process terminated unexpectedly, and issues a process ID number and an exit code.

3. IIS restarts the worker process automatically when another request comes in.

4. This continues until the threshold is reached.

5. When the threshold is reached, IIS writes an event to the application log stating that the application pool is being automatically disabled due to multiple failures.

6. All clients attempting to use that application pool will receive a 503 “Service Unavailable” error.

7. This will continue until the application pool is stopped and restarted.

Startup and Shutdown Time Limits Worker processes are not necessarily killed immediately when terminated, and they need time to start up as well. When a worker process needs to be stopped, it is sent a terminate request, and then it is given time for the current activities to finish and drain out of the queue before the process is terminated. If it’s being recycled, the new process is up and running before the old one is stopped so that there is no interruption in service. Sometimes, a worker process doesn’t stop very well or has problems starting up. These timeouts are used to configure how long IIS waits before determining that a problem exists.

• Startup Time Limit Configures how long IIS will wait for a worker process to start. You can set a time between 1 and 4,000,000 seconds.

• Shutdown Time Limit Configures how long IIS will wait for a worker process to stop gracefully. You can set a time between 1 and 4,000,000 seconds.

The Identity Tab

The Identity tab, shown in Figure 2-26, allows you to choose which security account the worker processes in this application pool will use. By default, worker processes will run as a Network Service, giving them limited rights to the operating system. Here, you can choose which identity they will use. You can choose from a predefined identity, or choose a user account. Choosing a user account can be a security risk, since they typically have greater access to the operating system.

Figure 2-26: The Identity tab

• Network Service This is the default choice, it’s the most secure choice, and it’s a good choice to run worker processes. It can’t directly access the operating system and can’t exert any control over it.

• Local Service Has more rights to the system than Network Service. It can access the operating system, but it can’t access anything outside the server. It also can’t interact with the desktop.

• Local System Has more rights than Local Service. In fact, Local System has full rights to the entire system.

All three accounts are part of the IIS_WPG group, which is on the local system to which you can assign rights. If you find you need to grant the worker process more rights than it currently has, you can grant those rights to the IIS_WPG group. If you configure an account for this worker process, you must make sure it is a member of the IIS_WPG group for it to run.

• Configurable Allows you to choose an account under which to run these worker processes. You can either type in the account or click the Browse button and select it there. You also need to provide the password and confirm it to use an account here.

When a worker process is launched, it has a token for the identity it is configured with. It uses this token when performing actions. When a client request comes through, that thread uses the client’s token to process that request. This is called impersonation, and it allows worker processes to run at a low security level while still performing higher level operations.

Processor Affinity

When you have multiple processors in a server, you can tie an application pool to a processor. This allows you to have CPUs set aside for a specific application pool, guaranteeing that application more processing power. This option is available only if there are multiple processors in the server and IIS is running in Worker Process mode.