How to enable access auditing of critical files or directories that cause a restart of the TIBCO Spotfire Web Player application, using Process Monitor.

How to enable access auditing of critical files or directories that cause a restart of the TIBCO Spotfire Web Player application, using Process Monitor.

The Web Player application will restart automatically if the critical files or directories monitored by IIS and ASP.NET are modified. For example, this will be due to an anti-virus scan on the Web Player's webroot folder. A shutdown and restart which includes "HostingEnvironment initiated shutdown", such as the following, will be seen in the Web Player Spotfire.Dxp.Web.logs:

INFO  2014-05-30 07:10:53,556 [17, (null)] Spotfire.Dxp.Web.Forms.Global - Application shutdown reason:Change Notification for critical directories.
bin dir change or directory rename
HostingEnvironment initiated shutdown
Change Notification for critical directories.
bin dir change or directory rename
HostingEnvironment caused shutdown
DEBUG 2014-05-30 07:10:53,556 [17, (null)] Spotfire.Dxp.Web.Forms.Global - Application shutdown callstack:   at System.Environment.GetStackTrace(Exception e, Boolean needFileInfo)
   at System.Environment.get_StackTrace()
   at System.Web.Hosting.HostingEnvironment.InitiateShutdownInternal()
   at System.Web.HttpRuntime.ShutdownAppDomain(String stackTrace)
   at System.Web.HttpRuntime.OnCriticalDirectoryChange(Object sender, FileChangeEvent e)
   at System.Web.FileChangesMonitor.OnCriticaldirChange(Object sender, FileChangeEvent e)
   at System.Web.DirectoryMonitor.FireNotifications()
   at System.Web.Util.WorkItem.CallCallbackWithAssert(WorkItemCallback callback)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
DEBUG 2014-05-30 07:10:53,587 [17, (null)] Spotfire.Dxp.Web.SiteManager - Web Player server shutting down on host 'MY-SERVER'.

or:

INFO ;2014-07-17 09:29:13,306;21;(null);Spotfire.Dxp.Web.Forms.Global;Application shutdown reason:CONFIG change
HostingEnvironment initiated shutdown
HostingEnvironment caused shutdown^~
INFO ;2014-07-17 09:29:13,322;21;(null);Spotfire.Dxp.Web.SiteManager;Web Player server shut down on host 'MY-SERVER'.^~

This Web Player application restart can be prevented by determining which external application is accessing the Web Player files. The external application can be configured to avoid this.

1. Download "Process Monitor".
   URL: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx?PHPSESSID=d926bdd849b5aab10f7263dd7f5904f2
2. Extract "ProcessMonitor.zip".
3. Run "Procmon.exe".
4. Select "Filter" from the menu, then select "Filter..." to open the "Process Monitor Filter" window .
5. Add a filter to monitor the "webroot" folder by setting the following (do not include quotes):
   • Display entries matching these conditions:
   • "Path" "contains" "<INSTALLATION_DIR>\TIBCO\Spotfire Web Player\5.5.0\webroot" then "Include"
    where the path is updated with your Web Player webroot directory. For example:
   • C:\Program Files\TIBCO\Spotfire Web Player\5.5.0\webroot
6. Click "Add".
7. Add a filter to monitor the settings and temp folders by setting the following. Do not include quotes.
   • Display entries matching these conditions:
   • "Path" "contains" "<INSTALLATION_DIR>\Program Files\TIBCO\Spotfire Web Player\5.5.0\Temp" then "Include"
    where the path is updated is updated with your SettingsRootFolder and TempFolder folders as defined in your web.config:

   <applicationSettings>
         <!-- You normally shouldn't edit these settings. -->
         <Spotfire.Dxp.Internal.Properties.Settings>
           ...
           <setting name="SettingsRootFolder" serializeAs="String">
               <value>C:\Program Files\TIBCO\Spotfire Web Player\5.5.0\Temp</value>
           </setting>
           <setting name="TempFolder" serializeAs="String">
               <value>C:\Program Files\TIBCO\Spotfire Web Player\5.5.0\Temp</value>
           </setting>

8. Click "Add".
9. Add a filter to monitor these system folders by setting the following. Do not include quotes.
   • Display entries matching these conditions:
   • "Path" "contains" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files" then "Include"
10. Click "Add".
11. Add a filter to monitor these system folders by setting the following. Do not include quotes.
    • Display entries matching these conditions:
    • "Path" "contains" "C:\Windows\System32\inetsrv\config" then "Include"
12. Click "Add".
13. Add a filter to exclude capturing the w3wp.exe process:
    • Display entries matching these conditions:
    • "Process Name" "is" "w3wp.exe" then "Exclude"
14. Click "Add".
15. Click "OK".
16. Leave Process Monitor running until a Web Player application restart occurs. Identify the application shutdown and restart time in the "Spotfire.Dxp.Web.log" files. For example, you can search for "Application shutdown reason", "bin dir change or directory rename", "HostingEnvironment initiated shutdown", or "Web application starting..." to determine the exact time.
17. In Process Monitor, find the activity that corresponds to the time of shutdown and note the "Process Name" to identify which application is causing the restart.  For example, if this is an anti-virus application, you can now exclude the Web Player folders defined above from the anti-virus scan.

Optional:

• If the size of the data captured becomes a problem, enable the following option to only capture events that match the filters. Otherwise, all events will be capture.
  • Process Monitor > Filter > Drop Filtered Events

Alternate solution:

• KB: 000022177, How to enable access auditing of critical files or directories that cause a restart of the TIBCO Spotfire Web Player application, using Windows Audit Policy.

• https://docs.microsoft.com/en-us/sysinternals/downloads/procmon