Review and understanding of ASP false positives in IIS 6.0 (complete)

Author: brave wind
Source: evil gossip Security Team

This problem has been bothering me for a long time. Because it is too long, I cannot remember how long it has been. It is a long time. Recently, my personal home site, which provides space services for individuals, has encountered this problem again, so I have to reconsider this issue.

In the past, I found a solution for ASP false positives on the official site of MS: aspx? Scid = kb; zh-cn; 831464 "target = _ blank> http://support.microsoft.com/default.aspx? Scid = kb; zh-cn; 831464 before seeing the patch, the solution adopts the IIS5 Isolation Mode. After seeing the patch, I thought the problem was resolved, but it still did not work.

These days, when viewing system logs, we find that an error message and a warning message appear in the system logs every time ASP is suspended, as shown below:
========================================================== ==================================
Error message:
The Service World Wide Web Publishing Service unexpectedly stops. This happens twice.
Source: Service Control Manager
-------------------------------------------------------------
Warning:
Worker processes with a process ID of 5088 providing services for the application pool DefaultAppPool have requested to be recycled because the worker process has reached the allowed running time limit.
Source: W3SVC
========================================================== ==================================

Seeing the above information and combining the original solution, I guess this problem is caused by the application pool, because there is no application pool in the isolation mode, so I began to look for information about the application pool and got to know it:

1. Working Process: I really don't know how MS is named. It is the number of connections generated by ASP sessions, but it is called a working process.
2. Recycle the Worker Process: clears all the websites using the application pool that currently use Session objects.
3. The solution should be how to recycle (conjecture );

So we made a change to the recycle method in the application pool: We only use the timed recycle method to recycle it at, and. As for how it works and how it is used, it is decomposed.

(Unfinished ...)

Bytes -------------------------------------------------------------------------------------------------
(Continued)

After more than a month of testing, no error was found, indicating that this method is indeed feasible. Here is a brief summary:

1. The above settings have drawbacks: this setting is not enough, because when there are more and more sites under the application pool, the above settings may be faulty.
2. An application pool should be set up for sites with excessive traffic.
3. Do not set too many sites under each application pool.
4. Set the application pool based on the total access volume of the website. Sorry, I don't know how much access volume should be set up with an application pool.