|
Home > Archive > IIS Server Security > May 2004 > IIS Stops serving randomly
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
IIS Stops serving randomly
|
|
| Ron L 2004-05-13, 11:32 am |
| We have a server that is used on our internal intranet and hosts 2 web sites
using IIS. Both sites are configured to use HTTPS using a certificate we
generated. We have found that IIS will stop serving these sites at random
times. If I log directly into the server, start IE, and browse to one of
the sites, once I have accepted the certificate's security alert dialog then
all access seems to be restored. Does any one have any suggestions as to
what to do to fix this?
TIA
Ron L
| |
| Kristofer Gafvert 2004-05-13, 4:20 pm |
| Have you checked the Event Log?
I cannot understand why IIS would magically start up when you access some
specific part of the website, in a certain way. Are you sure it is stopping?
--
Regards,
Kristofer Gafvert - IIS MVP
http://www.ilopia.com - When you need help!
"Ron L" <rlounsbury@bogusAddress.com> wrote in message
news:evjrs0OOEHA.1348@TK2MSFTNGP12.phx.gbl...
> We have a server that is used on our internal intranet and hosts 2 web
sites
> using IIS. Both sites are configured to use HTTPS using a certificate we
> generated. We have found that IIS will stop serving these sites at random
> times. If I log directly into the server, start IE, and browse to one of
> the sites, once I have accepted the certificate's security alert dialog
then
> all access seems to be restored. Does any one have any suggestions as to
> what to do to fix this?
>
> TIA
> Ron L
>
>
| |
|
| Kristofer
Thanks for the response. There is nothing that appears to be relevant
in the event log. I am not sure if IIS is stopping, but it no longer will
serve any pages. When we browse to the site from the server, it restarts
serving the pages for other clients.
Ron L
"Kristofer Gafvert" <kgafvert@NEWSilopia.com> wrote in message
news:%2313a3xROEHA.1616@TK2MSFTNGP12.phx.gbl...
> Have you checked the Event Log?
>
> I cannot understand why IIS would magically start up when you access some
> specific part of the website, in a certain way. Are you sure it is
stopping?
>
> --
> Regards,
> Kristofer Gafvert - IIS MVP
> http://www.ilopia.com - When you need help!
>
>
> "Ron L" <rlounsbury@bogusAddress.com> wrote in message
> news:evjrs0OOEHA.1348@TK2MSFTNGP12.phx.gbl...
> sites
we[vbcol=seagreen]
random[vbcol=seagreen]
of[vbcol=seagreen]
> then
to[vbcol=seagreen]
>
>
| |
| Kristofer Gafvert 2004-05-13, 4:20 pm |
| What happens when you browse the website from a client machine, when it is
not working as expected? What do you get? Please disable "Friendly HTTP
Error Messages" on the client machine.
--
Regards,
Kristofer Gafvert - IIS MVP
http://www.ilopia.com - When you need help!
"Ron L" <rlounsbury@bogusAddress.com> wrote in message
news:%23jso9OSOEHA.1392@TK2MSFTNGP09.phx.gbl...
> Kristofer
> Thanks for the response. There is nothing that appears to be relevant
> in the event log. I am not sure if IIS is stopping, but it no longer will
> serve any pages. When we browse to the site from the server, it restarts
> serving the pages for other clients.
>
> Ron L
>
>
> "Kristofer Gafvert" <kgafvert@NEWSilopia.com> wrote in message
> news:%2313a3xROEHA.1616@TK2MSFTNGP12.phx.gbl...
some[vbcol=seagreen]
> stopping?
> we
> random
> of
dialog[vbcol=seagreen]
> to
>
>
| |
|
| Ron,
If your server is crashing or hanging you might want to
download our ReJuvin8 tool. It's free for the first
15-days. It can keep your site running despite problems.
It's designed to detect problems then restart or reboot.
It can restart ANY programs, services, or processes in
precise order. It doesn't fix bugs but it does give you some
breathing room while you are finding them. ReJuvin8 also
gives you email and telephone alert messages and graphic
status reports. It runs as a Windows Service.
It can also test, alert, and report on URLs running anywhere
on any server on your net connection. So if you use multiple
servers you can use them to watch each other, too.
ReJuvin8 has both an automatic and a custom mode. In the
auto mode you make all the settings by pointing and
clicking. This will handle most applications.
The custom mode uses heartbeat synch files to get absolute
detection that key processes are working. Tools and
instructions are provided to help you do this. We also offer
customization as a contract service.
Charles
Get ReJuvin8 at: http://www.rejuvin8.net?ac=ch1
Also, see it and reviews at
http://www.hotscripts.com/cgi-bin/s...uvin8&catid=all
"Ron L" <rlounsbury@bogusAddress.com> wrote in message
news:evjrs0OOEHA.1348@TK2MSFTNGP12.phx.gbl...
> We have a server that is used on our internal intranet and hosts 2 web
sites
> using IIS. Both sites are configured to use HTTPS using a certificate we
> generated. We have found that IIS will stop serving these sites at random
> times. If I log directly into the server, start IE, and browse to one of
> the sites, once I have accepted the certificate's security alert dialog
then
> all access seems to be restored. Does any one have any suggestions as to
> what to do to fix this?
>
> TIA
> Ron L
>
>
| |
| Ron L 2004-05-14, 12:51 pm |
| Kristofer
It doesn't generate an error message, the browser simply hangs until it
times out.
Ron L
"Kristofer Gafvert" <kgafvert@NEWSilopia.com> wrote in message
news:%23CJVRbSOEHA.268@TK2MSFTNGP11.phx.gbl...
> What happens when you browse the website from a client machine, when it is
> not working as expected? What do you get? Please disable "Friendly HTTP
> Error Messages" on the client machine.
>
> --
> Regards,
> Kristofer Gafvert - IIS MVP
> http://www.ilopia.com - When you need help!
>
>
> "Ron L" <rlounsbury@bogusAddress.com> wrote in message
> news:%23jso9OSOEHA.1392@TK2MSFTNGP09.phx.gbl...
relevant[vbcol=seagreen]
will[vbcol=seagreen]
restarts[vbcol=seagreen]
> some
web[vbcol=seagreen]
certificate[vbcol=seagreen]
one[vbcol=seagreen]
> dialog
as[vbcol=seagreen]
>
>
| |
| Roopesh K K 2004-05-14, 7:34 pm |
| ***************
Check if the SSL sites works after changing port (change the port to 444) and try to access from a system in the same network, This may not work over a Internet connection because 444 may be blocked in most of the firewalls. So try accessing the site from
same network with the alternate port
If it works on different port
***************
Stop IIS and try to telnet to the server with port 443. (If it connects to the server another application is listening on that port)
If you don not have an application which you have configured to run on 443 port it could be a malicious application listening on the port 443
***************
Run fport or TCPView to identify the applications/services which listens at port 443
Fport can be downloaded from http://www.foundstone.com/index.htm...ddesc/fport.htm
TCPview can be downloaded from http://www.sysinternals.com
***************
Check in Services for any suspicious services (Serv U, Fire Daemon etc.)
***************
Run house call (online virus scanning from any of the anti virus vendor) on your affected server
http://housecall.trendmicro.com/
or
http://us.mcafee.com/root/mfs/default.asp?cid=9914
look for any malicious application or Trojan in the system (ServU, TROJ_SERVI.A etc.)
***************
Search for "443" in registry. Check If you can find this number associated with any other application or services.
For example:
" hklm\system\currentcontrolset\services\s
ysmon\parameters\appparameters = 443"; This indicates possibility of a service which listens at 443 port which may affect SSL sites.
If you detect another service or Application listens at port 443 which affects IIS. you may confirm that the system has been affected with that malicious application.
Thanks & Regards
Roopesh
| |
|
| Roopesh
Thanks for your response. I will take a look at this today.
Ron L.
"Roopesh K K" <anonymous@discussions.microsoft.com> wrote in message
news:495E42C2-C203-455C-BBF3-18DEC71FEA1E@microsoft.com...
> ***************
> Check if the SSL sites works after changing port (change the port to 444)
and try to access from a system in the same network, This may not work over
a Internet connection because 444 may be blocked in most of the firewalls.
So try accessing the site from same network with the alternate port
>
> If it works on different port
>
> ***************
> Stop IIS and try to telnet to the server with port 443. (If it connects to
the server another application is listening on that port)
> If you don not have an application which you have configured to run on 443
port it could be a malicious application listening on the port 443
>
> ***************
> Run fport or TCPView to identify the applications/services which listens
at port 443
> Fport can be downloaded from
http://www.foundstone.com/index.htm...ddesc/fport.htm
> TCPview can be downloaded from http://www.sysinternals.com
>
> ***************
> Check in Services for any suspicious services (Serv U, Fire Daemon etc.)
>
> ***************
> Run house call (online virus scanning from any of the anti virus vendor)
on your affected server
> http://housecall.trendmicro.com/
> or
> http://us.mcafee.com/root/mfs/default.asp?cid=9914
> look for any malicious application or Trojan in the system (ServU,
TROJ_SERVI.A etc.)
>
> ***************
> Search for "443" in registry. Check If you can find this number associated
with any other application or services.
>
> For example:
>
> " hklm\system\currentcontrolset\services\s
ysmon\parameters\appparameters =
443"; This indicates possibility of a service which listens at 443 port
which may affect SSL sites.
>
> If you detect another service or Application listens at port 443 which
affects IIS. you may confirm that the system has been affected with that
malicious application.
>
> Thanks & Regards
> Roopesh
>
| |
| spam-this-at-erc-dot-bc-dot-see-eh 2004-05-25, 4:32 pm |
| "Ron L" <rlounsbury@bogusAddress.com> wrote in message news:<evjrs0OOEHA.1348@TK2MSFTNGP12.phx.gbl>...
> We have a server that is used on our internal intranet and hosts 2 web sites
> using IIS. Both sites are configured to use HTTPS using a certificate we
> generated. We have found that IIS will stop serving these sites at random
> times. If I log directly into the server, start IE, and browse to one of
> the sites, once I have accepted the certificate's security alert dialog then
> all access seems to be restored. Does any one have any suggestions as to
> what to do to fix this?
>
> TIA
> Ron L
I've been having the same problem, unfortunately I haven't been able
to find a solution yet. It's just bizzare.
|
|
|
|
|