Home
  •  

A server side include file has included itself or the maximum depth of server side includes has been exceeded

Microsoft.Windows.InternetInformationServices.10.0.A.server.side.include.file.has.included.itself.or.the.maximum.depth.of.server.side.includes.has.been.exceeded (Rule)

Knowledge Base article:

Summary

In order to perform its activities successfully, the Internet Information Services (IIS) World Wide Web Publishing Service (W3SVC) must be free of any I/O errors involving file access, memory availability, and network connections. In addition, any scripts that are used must be accessible and running, and any include files must be configured correctly.

Resolutions

Remove nested includes

Possible resolutions of nested includes include the following:

Check if a server-side include file has included itself

To check if a server-side include file has included itself:

Check if maximum depth of server-side includes has been exceeded

To check if maximum depth of server-side includes has been exceeded:

Element properties:

TargetMicrosoft.Windows.InternetInformationServices.10.0.WebServer
CategoryAlert
EnabledTrue
Event_ID2221
Event SourceMicrosoft-Windows-IIS-W3SVC-WP
Alert GenerateFalse
RemotableTrue
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WA WriteAction Microsoft.Windows.Server.IIS.10.0.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.InternetInformationServices.10.0.A.server.side.include.file.has.included.itself.or.the.maximum.depth.of.server.side.includes.has.been.exceeded" Enabled="true" Target="Microsoft.Windows.InternetInformationServices.10.0.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-IIS-W3SVC-WP</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>2221</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.10.0.GenerateAlertAction.SuppressedByDescription">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.10.0.A.server.side.include.file.has.included.itself.or.the.maximum.depth.of.server.side.includes.has.been.exceeded.AlertMessage"]$</AlertMessageId>

    </WriteAction>

  </WriteActions>

</Rule>