IIS Server Security - asp vs. exe execution time problem

Author

asp vs. exe execution time problem

kejs

2005-02-14, 5:54 pm

i have:
a) vb project, compiled as standard exe
b) active server page with the same source code

when i run exe file from command prompt as a domain user or administrator or
local administrator, it finishes in 4 seconds
same code run from asp takes 20 seconds.

putting a few <%response.write time%> lines in my asp ive concluded that 99%
of the time is consumed by calling a function that seems to initialize some
sort of database connection, since the parameters that it takes are the
database name, username and password.
i dont have the source code to the functions in dlls im calling.
i tried to add iusr and iwam to administrators group, but it didnt help.
my question is, is it possible that its a security issue all though it
finishes successfuly in both cases or should i look elsewhere ?

thanks.

Tom Kaminski [MVP]

2005-02-14, 5:54 pm

"kejs" <kejs@no.ip> wrote in message
news:cuqgb7$c2q$1@magcargo.vodatel.hr...
> i have:
> a) vb project, compiled as standard exe
> b) active server page with the same source code
>
> when i run exe file from command prompt as a domain user or administrator
or
> local administrator, it finishes in 4 seconds
> same code run from asp takes 20 seconds.
>
> putting a few <%response.write time%> lines in my asp ive concluded that
99%
> of the time is consumed by calling a function that seems to initialize
some
> sort of database connection, since the parameters that it takes are the
> database name, username and password.
> i dont have the source code to the functions in dlls im calling.
> i tried to add iusr and iwam to administrators group, but it didnt help.
> my question is, is it possible that its a security issue all though it
> finishes successfuly in both cases or should i look elsewhere ?

If it was a security issue, I would not expect it to work at all.

IPGrunt

2005-02-15, 5:54 pm

On 14 Feb 2005, "Tom Kaminski [MVP]" <tomk (A@T) mvps (D.O.T) org>
postulated in news:OopaFCrEFHA.624@TK2MSFTNGP09.phx.gbl:

> "kejs" <kejs@no.ip> wrote in message
> news:cuqgb7$c2q$1@magcargo.vodatel.hr...
administrator[vbcol=seagreen]
> or
concluded that[vbcol=seagreen]
> 99%
initialize[vbcol=seagreen]
> some
are the[vbcol=seagreen]
help.[vbcol=seagreen]
though it[vbcol=seagreen]
>
> If it was a security issue, I would not expect it to work at all.
>
>
>

The OP is correct that if you didn't pass security, you couldn't
connect.

However, creating a connection in itself is quite expensive.

You can make architectural changes that speed things up.

First, who is authenticating the user? Is it a local server, or a
domain server across town or across a slow connection? Can you use
MTS to pool your access indentity closer to the application? Can you
preload a connection somehow?

NEVER give admin permissions to the machine accounts I_USR or
I_WAM...this gives any IIS connection or webapp an administrator ACL.

Since this is a DLL, you cannot really cache your connections to
speed up the process, however, ADO can can help, so make sure that
ADO is set for pooled connections.

If connecting really is still slow, forget about pooling. Can you
connect once for the application and have all sessions use that
single connection? Then keep the connection open. This technique
really depends on the traffic in your site. Too busy, and it provides
a resource contention. Not busy enough and you have app resources
hogging server memory that don't need to be there.

Finally, can you speed up your database? Perhaps a larger buffer
size? More threads? A faster processor?

There are some good articles out there about optimizing performance
of ASP/database applications. Check the usual sites... MSDN, 15-
seconds, 4-guys, etc. And make sure you understand all the parts of
the process... IIS, ADO, SQLServer.

-- ipgrunt