More Troubleshooting Tips | IIS 6 Administration

I’ll end this chapter with a potpourri of tips for troubleshooting various aspects of IIS. These are in no particular order, it’s just useful stuff you need to know. As you work with IIS, you’ll probably be able to add to this list, so I left some blank template sections at the end for you so you can do this.

Can’t Access Site

Obviously, a lot of different conditions can prevent users from accessing a site on your IIS machine. The first thing you can do is try pinging its IP address to see if it’s there or not. Then try pinging its NetBIOS name if the server is on the intranet, or its DNS name if it’s on the Internet. Pinging its DNS name successfully also depends on whether DNS is configured properly, so you may need to test your DNS servers with nslookup as well.

If you still can’t access your site, check the server to see if the location of the home directory is specified properly. Check the Directory Security tab to see if authentication is configured correctly and to see whether there are any IP address or domain name restrictions configured. Check the web permissions and execute permissions on the Home Directory tab. Check the IP address, port, and host header settings assigned to the site. Check the NTFS permissions on the content directories and files. Make sure a default document is specified and is present in your root directory.

If all that fails but you get an HTTP error message, use the information in the section entitled “Custom HTTP Error Messages in Detail,” previously in this chapter, to try to troubleshoot the problem based on the message you received from the web server.

If everything still seems OK, try restarting the website. If that fails, try restarting IIS. Try logging on to the machine itself and see if you can access the site. If you’re connecting as an authenticated user, verify your credentials on the local machine (in a workgroup scenario) or in Active Directory (in a domain scenario). Make sure a domain controller is available on the network.

Another common reason clients cannot access websites or FTP sites is because of a misconfigured firewall or proxy server at the perimeter of your network. If internal clients can access the site but external ones can’t, check the configuration of your firewall or proxy server. If that doesn’t reveal anything, check your DNS configuration.

Don’t forget that Windows Server 2003 has its own built-in Internet Connection Firewall, To see if this is causing the problem, open the properties sheet for the local area connection, select the Advanced tab, and view the settings.

Some Users Can’t Access FTP Site

If some users can access your FTP site and others can’t, it may be a firewall configuration issue that allows standard (PORT) mode FTP clients to connect while denying connections to passive (PASV) mode clients. You can configure FTP on IIS 6 to support both PORT and PASV clients simultaneously: see Knowledge Base article 323446 on support.microsoft .com for more info. This problem can also occur if the client is behind a NAT device.

Logging Worker Process Recycling

You can use the LogEventOnRecycle metabase property to configure the WWW Service to log recycling events for worker processes in the Application log, which you can view later using Event Viewer. You can configure this property so that logging of such events happens according to time consumed, requests processed, scheduled recycles, and so on. See the Metabase Property Reference in IIS Help for detailed information of all metabase properties.

Can’t Administer IIS Using Remote Desktop

Make sure that you don’t have a blank password for the account you are using to connect to IIS using Remote Desktop. You could instead modify the Local Security Policy on your IIS machine to allow blank passwords, but this is not recommended for security reasons.

Host Header Issues

If you put a space in a host header name, the website will be unavailable to clients trying to connect to it. Another host header issue is that two websites running on the same IIS machine can’t have the same host header name and port number while having different IP addresses (if you configure them this way, one of them won’t start).

ASP Error Messages

By default, ASP is configured to send detailed error messages to clients when problems occur. You may want to disable this feature and send a generic error message instead, as detailed messages can sometimes provide malicious users with information they can use to hack your system. To configure this feature, open the properties sheet for the website of your application in IIS Manager, select the Home Directory tab, click the Configuration button, select the Debugging tab, select the check box for sending a standard text error message to the client, and type your message in the text box (Figure 13-9).

click to expand
Figure 13-9: Configuring ASP error messages

Anonymous Users Can’t Run CGI Apps

If your CGI app resides in the \Windows\System32 directory or makes use of other executables such as cmd.exe located in that directory, your CGI app will fail for anonymous users unless you remove the Deny ACL for the IUSR_computername account for these executables. The purpose of this ACL is to prevent anonymous users from running cmd.exe and other dangerous executables found in \System32, so do this with caution!

Automatic Restart Disabled

If a flaky application kills your server and the server doesn’t automatically restart, it may be that you’ve disabled the Automatic Restart feature of IIS. Automatic Restart is a feature that enables the IIS Admin service to automatically start itself when it stops for some unexpected reason. Automatic Restart can be disabled two ways:

Type iisreset /disable from the command line. See Chapter 11 for more information on the iisreset command.
Use the Services console in Administrative Tools, and configure the Recovery tab options on the properties sheet for the service (either IIS Admin or WWW).

My Troubleshooting Tips

You can add your own troubleshooting tips for IIS 6 on the following pages as you discover them from further reading, hands-on use of the platform, and discussion with colleagues.

Problem:

_______________________________________________________________________