Blank browser pages for Audit Log Reports in SP2007

  • [アーティクル]

 

 

Symptoms

 

Perhaps your audit log reporting functionality was working great last month but this month you're only seeing blank, empty pages in your browser. You can't run any reports successfully anymore in your MOSS 2007 farm. You can make it to SITE ACTIONS and then on to AUDIT LOG REPORTS.

 

You see all the links you're supposed to see at Reporting.aspx.

But you can't do anything with those links anymore.

Clicking any of these links should open a spreadsheet in Excel or, if Excel isn't installed on the client machine, it should render in the browser with some valid xml data that looks something like this:

 

But after installing the .net update 2905247/2894844/2894852/2894851/2894847/2894843 and rebooting things changed.

Now you just see blank pages whenever you click any of the links.

 

You can click the Run a Custom Report link and get a page but you won't be able to run any existing reports or create any new reports.

 

You'll just get a blank page.

 

Troubleshooting

 

Nothing interesting seems to show up in the SharePoint diagnostic/ULS logs.

But reproducing the problem while monitoring the application pool with a debugdiag crash rule (that is configured to log CLR exceptions) shows some great hints.

 

Type:     System.Web.HttpException
Message:  Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. https://go.microsoft.com/fwlink/?LinkID=314055
Type:     System.Web.UI.ViewStateException
Message:  NOT_FOUND
 Stack:   
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.ViewStateException.ThrowError(System.Exception, System.String, System.String, Boolean)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[], Byte[], Int32, Int32, Int32 ByRef)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.UI.Util.DeserializeWithAssert(System.Web.UI.IStateFormatter, System.String)
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
  System.Web.UI.Page.LoadAllState()
  System.Web.UI.Page.ProcessRequestMain(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest()
  System.Web.UI.Page.ProcessRequest(System.Web.HttpContext)
  ASP._layouts_runreport_aspx.ProcessRequest(System.Web.HttpContext)
  System.Web.HttpApplication+CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  System.Web.HttpApplication.ExecuteStep(IExecutionStep, Boolean ByRef)
  System.Web.HttpApplication+ApplicationStepManager.ResumeSteps(System.Exception)
  System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(System.Web.HttpContext, System.AsyncCallback, System.Object)
  System.Web.HttpRuntime.ProcessRequestInternal(System.Web.HttpWorkerRequest)
  System.Web.HttpRuntime.ProcessRequestNoDemand(System.Web.HttpWorkerRequest)
  System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)

 

 Type:     System.Web.HttpException
 Message:  Unable to validate data.
 Stack:   
         RetAddr          Call Site
  System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[], Byte[], Int32, Int32, Int32 ByRef)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.UI.Util.DeserializeWithAssert(System.Web.UI.IStateFormatter, System.String)
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
  System.Web.UI.Page.LoadAllState()
  System.Web.UI.Page.ProcessRequestMain(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest()
  System.Web.UI.Page.ProcessRequest(System.Web.HttpContext)
  ASP._layouts_runreport_aspx.ProcessRequest(System.Web.HttpContext)
  System.Web.HttpApplication+CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  System.Web.HttpApplication.ExecuteStep(IExecutionStep, Boolean ByRef)
  System.Web.HttpApplication+ApplicationStepManager.ResumeSteps(System.Exception)
  System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(System.Web.HttpContext, System.AsyncCallback, System.Object)
  System.Web.HttpRuntime.ProcessRequestInternal(System.Web.HttpWorkerRequest)
  System.Web.HttpRuntime.ProcessRequestNoDemand(System.Web.HttpWorkerRequest)
  System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)
DetailID = 2
 Count:    1
 Type:     System.Web.HttpException
 Message:  Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. https://go.microsoft.com/fwlink/?LinkID=314055

 
 

Root Cause

 

By design, the installation of update 2905247/2894844/2894852/2894851/2894847/2894843 enables the use of ViewStateMac. Unfortunately this causes some problems for WSS-3.0/MOSS-2007 site collection audit log reports.

 

Solution/Workarounds

 

Some have uninstalled the update to get past this problem. I am not recommending that. This is an important security patch to have. Besides, some future .net patch will just put you back in the same place.

Others have disabled AspNetEnforceViewStateMac in the registry to get around this problem. I am not recommending that either. It's important for security reasons to have it enabled. (See https://blogs.msdn.com/b/webdev/archive/2014/09/09/farewell-enableviewstatemac.aspx.)

Disabling AspNetEnforceViewStateMac (followed by an IISRESET) does take the blank-page symptoms away. In a lab environment I opened up regedit, searched for AspNetEnforceViewStateMac, found it in two places, and changed the value of 1 (enabled) to 0 (disabled).

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\AspNetEnforceViewStateMac (This is the only one you probably would want to test with.)

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\AspNetEnforceViewStateMac (This might be good to keep in mind if your application pool is running in 32-bit mode for some reason)

Restart IIS to iron in the changes.

 

Mainstream support for WSS 3.0/MOSS 2007 ended over two years ago. (See https://support2.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=SharePoint+Server+2007&Filter=FilterNO.) So it's not clear at this time if a design change can or will be made. If such a fix/change is produced, I'll try to make it known here.

Otherwise perhaps the time has come to stop trying to get audit reports and start speeding up the pace towards going to either SharePoint Online (O365) or SharePoint 2013!

 

 

More Information

 

https://blogs.msdn.com/b/webdev/archive/2014/09/09/farewell-enableviewstatemac.aspx - Farewell, EnableViewStateMac!

 

https://support2.microsoft.com/kb/2915218 - Resolving view state message authentication code (MAC) errors

    [Note that this article won't help if the problem began when the patch was installed.]

 

 

 

Additional Keywords:

 

Content modifications        Content_modifications.xml

Content type and list modifications     Content_type_and_list_modifications.xml

Content viewing         Content_viewing.xml

Deletion            Deletion.xml

Run a custom report         Run_a_custom_report.xml

Expiration and Disposition     Expiration_and_Disposition.xml

Policy modifications        Policy_modifications.xml

Auditing settings         Auditing_settings.xml

Security settings         Security_settings.xml

RunReport.aspx, SharePoint 2007,

https://support.microsoft.com/kb/2905247 - Microsoft security advisory: Insecure ASP.NET site configuration could allow elevation of privilege

Microsoft .NET Framework 3.5.1 2894844 Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: December 10, 2013

Microsoft .NET Framework 3.5 2894852 Description of the security update for the .NET Framework 3.5 on Windows 8.1 and Windows Server 2012 R2: December 10, 2013

2894851 Description of the security update for the .NET Framework 3.5 on Windows 8 and Windows Server 2012: December 10, 2013

Microsoft .NET Framework 2.0 2894847 Description of the security update for the .NET Framework 2.0 Service Pack 2 on Windows Vista Service Pack 2 and Windows Server 2008 Service Pack 2: December 10, 2013

2894843 Description of the security update for the .NET Framework 2.0 Service Pack 2 on Windows Server 2003: December 10, 2013

Dude, my audit reports don't work! Auditing reports blank. Blank auditing reports. Blank audit report. White browser. Empty browser window.

Comments

  • Anonymous
    November 13, 2014
    If anyone else out there is hitting this problem, let me know please by leaving a comment.  Do NOT leave any information here that could help identify your corporation though. Also consider opening a support ticket with Microsoft to see workarounds or fixes.  

  • Anonymous
    November 13, 2014
    Hi Christopher,I have this problem in one of my company's customer environment, thank you for posting this article, I've been searching for solution for long time. Will definitely give it i try and post back whether it helped or not.

  • Anonymous
    November 14, 2014
    I ran into the same problem a few days ago.  Thanks for the post.  

  • Anonymous
    November 23, 2014
    Hi Christopher,Same problem happen to us, Only from one server we are able to fetch report rest all the server on which user hit is going facing blank page issue.Your help is highly appreciated.Thank you in advance

  • Anonymous
    December 01, 2014
    Thanks for the comments, All. I don't have any updates yet but its possible there still might be something in the works.  I'll let you know if and when I hear something.

  • Anonymous
    December 02, 2014
    Running into this issue as well. Disabling AspNetEnforceViewStateMac in registry does resolve the issue. Thank you for the information. Will watch this page for any updates.

  • Anonymous
    December 29, 2014
    we have this problem also. Waiting for your updates.

  • Anonymous
    January 27, 2015
    Witnessed exactly the same problem today following some Windows Updates - make the registry changes fixed the problem.Thanks for saving me a lot of aggro!

  • Anonymous
    February 05, 2015
    We are experiencing this issue as well.

  • Anonymous
    February 08, 2015
    Yes seeing this for several environments following these updates.  As you note, the kb article doesn't fix this issue :-(

  • Anonymous
    February 16, 2015
    Run into the same problem, changing the AspNetEnforceViewStateMac to 0 resolve the issue.Thanks for your resolution.

  • Anonymous
    March 23, 2015
    I recently heard that they're still considering a fix for it. So there is still hope. But there is no certainty about it yet either.

  • Anonymous
    January 18, 2016
    Christopher, any updates for this issue? Our reports worked this time last year but are no longer working.

  • Anonymous
    February 17, 2016
    Kyle, I'm no longer with Microsoft Corp so I no longer have an inside channel to ask though. I recommend opening a support case with the SharePoint Admin team and refer them to this blog. A bug was filed on it so they shouldn't charge you for the case. Good luck!

  • Anonymous
    February 17, 2016
    I just got confirmation from a reliable source that says this will not be fixed in SP2007.