In order to perform its activities successfully, the Internet Information Services (IIS) World Wide Web Publishing Service (W3SVC) must be free of any I/O errors involving file access, memory availability, and network connections. In addition, any scripts that are used must be accessible and running, and any include files must be configured correctly.
Remove nested includes
Possible resolutions of nested includes include the following:
Check if a server-side include file has included itself.
Check if maximum depth of server-side includes has been exceeded.
Check if a server-side include file has included itself
To check if a server-side include file has included itself:
Review server-side include files to ensure that no server-side include file includes itself.
Remove or replace any #include directive that includes itself.
Check if maximum depth of server-side includes has been exceeded
To check if maximum depth of server-side includes has been exceeded:
Review server-side include files to ensure that no server-side include file exceeds the maximum depth of server-side includes.
Remove any #include directives that exceed the maximum depth.
Target | Microsoft.Windows.InternetInformationServices.2008.WebServer | ||
Category | Alert | ||
Enabled | True | ||
Event_ID | 2221 | ||
Event Source | Microsoft-Windows-IIS-WMSVC | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | Application |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
WA | WriteAction | Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription | Default |
<Rule ID="Microsoft.Windows.InternetInformationServices.2008.A.server.side.include.file.has.included.itself.or.the.maximum.depth.of.server.side.includes.has.been.exceeded" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.InternetInformationServices.2008.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-IIS-WMSVC</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>2221</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.2008.A.server.side.include.file.has.included.itself.or.the.maximum.depth.of.server.side.includes.has.been.exceeded.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>