Blank browser pages for Audit Log Reports in SP2007

Artigo
11/11/2014

Symptoms

Perhaps your audit log reporting functionality was working great last month but this month you're only seeing blank, empty pages in your browser. You can't run any reports successfully anymore in your MOSS 2007 farm. You can make it to SITE ACTIONS and then on to AUDIT LOG REPORTS.

You see all the links you're supposed to see at Reporting.aspx.

But you can't do anything with those links anymore.

Clicking any of these links should open a spreadsheet in Excel or, if Excel isn't installed on the client machine, it should render in the browser with some valid xml data that looks something like this:

But after installing the .net update 2905247/2894844/2894852/2894851/2894847/2894843 and rebooting things changed.

Now you just see blank pages whenever you click any of the links.

You can click the Run a Custom Report link and get a page but you won't be able to run any existing reports or create any new reports.

You'll just get a blank page.

Troubleshooting

Nothing interesting seems to show up in the SharePoint diagnostic/ULS logs.

But reproducing the problem while monitoring the application pool with a debugdiag crash rule (that is configured to log CLR exceptions) shows some great hints.

Type:     System.Web.HttpException
Message: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. https://go.microsoft.com/fwlink/?LinkID=314055
Type:     System.Web.UI.ViewStateException
Message: NOT_FOUND
Stack:
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.ViewStateException.ThrowError(System.Exception, System.String, System.String, Boolean)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[], Byte[], Int32, Int32, Int32 ByRef)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.UI.Util.DeserializeWithAssert(System.Web.UI.IStateFormatter, System.String)
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
  System.Web.UI.Page.LoadAllState()
  System.Web.UI.Page.ProcessRequestMain(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest()
  System.Web.UI.Page.ProcessRequest(System.Web.HttpContext)
  ASP._layouts_runreport_aspx.ProcessRequest(System.Web.HttpContext)
  System.Web.HttpApplication+CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  System.Web.HttpApplication.ExecuteStep(IExecutionStep, Boolean ByRef)
  System.Web.HttpApplication+ApplicationStepManager.ResumeSteps(System.Exception)
  System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(System.Web.HttpContext, System.AsyncCallback, System.Object)
  System.Web.HttpRuntime.ProcessRequestInternal(System.Web.HttpWorkerRequest)
  System.Web.HttpRuntime.ProcessRequestNoDemand(System.Web.HttpWorkerRequest)
  System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)

Type:     System.Web.HttpException
Message: Unable to validate data.
Stack:
         RetAddr          Call Site
  System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[], Byte[], Int32, Int32, Int32 ByRef)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.UI.Util.DeserializeWithAssert(System.Web.UI.IStateFormatter, System.String)
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
  System.Web.UI.Page.LoadAllState()
  System.Web.UI.Page.ProcessRequestMain(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest()
  System.Web.UI.Page.ProcessRequest(System.Web.HttpContext)
  ASP._layouts_runreport_aspx.ProcessRequest(System.Web.HttpContext)
  System.Web.HttpApplication+CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  System.Web.HttpApplication.ExecuteStep(IExecutionStep, Boolean ByRef)
  System.Web.HttpApplication+ApplicationStepManager.ResumeSteps(System.Exception)
  System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(System.Web.HttpContext, System.AsyncCallback, System.Object)
  System.Web.HttpRuntime.ProcessRequestInternal(System.Web.HttpWorkerRequest)
  System.Web.HttpRuntime.ProcessRequestNoDemand(System.Web.HttpWorkerRequest)
  System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)
DetailID = 2
Count:    1
Type:     System.Web.HttpException
Message: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. https://go.microsoft.com/fwlink/?LinkID=314055

Root Cause

By design, the installation of update 2905247/2894844/2894852/2894851/2894847/2894843 enables the use of ViewStateMac. Unfortunately this causes some problems for WSS-3.0/MOSS-2007 site collection audit log reports.

Solution/Workarounds

Some have uninstalled the update to get past this problem. I am not recommending that. This is an important security patch to have. Besides, some future .net patch will just put you back in the same place.

Others have disabled AspNetEnforceViewStateMac in the registry to get around this problem. I am not recommending that either. It's important for security reasons to have it enabled. (See https://blogs.msdn.com/b/webdev/archive/2014/09/09/farewell-enableviewstatemac.aspx.)

Disabling AspNetEnforceViewStateMac (followed by an IISRESET) does take the blank-page symptoms away. In a lab environment I opened up regedit, searched for AspNetEnforceViewStateMac, found it in two places, and changed the value of 1 (enabled) to 0 (disabled).

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\AspNetEnforceViewStateMac (This is the only one you probably would want to test with.)

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\AspNetEnforceViewStateMac (This might be good to keep in mind if your application pool is running in 32-bit mode for some reason)

Restart IIS to iron in the changes.

Mainstream support for WSS 3.0/MOSS 2007 ended over two years ago. (See https://support2.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=SharePoint+Server+2007&Filter=FilterNO.) So it's not clear at this time if a design change can or will be made. If such a fix/change is produced, I'll try to make it known here.

Otherwise perhaps the time has come to stop trying to get audit reports and start speeding up the pace towards going to either SharePoint Online (O365) or SharePoint 2013!

More Information

https://blogs.msdn.com/b/webdev/archive/2014/09/09/farewell-enableviewstatemac.aspx - Farewell, EnableViewStateMac!

https://support2.microsoft.com/kb/2915218 - Resolving view state message authentication code (MAC) errors

[Note that this article won't help if the problem began when the patch was installed.]

Additional Keywords:

Content modifications Content_modifications.xml

Content type and list modifications Content_type_and_list_modifications.xml

Content viewing Content_viewing.xml

Deletion Deletion.xml

Run a custom report Run_a_custom_report.xml

Expiration and Disposition Expiration_and_Disposition.xml

Policy modifications Policy_modifications.xml

Auditing settings Auditing_settings.xml

Security settings Security_settings.xml

RunReport.aspx, SharePoint 2007,

https://support.microsoft.com/kb/2905247 - Microsoft security advisory: Insecure ASP.NET site configuration could allow elevation of privilege

Microsoft .NET Framework 3.5.1 2894844 Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: December 10, 2013

Microsoft .NET Framework 3.5 2894852 Description of the security update for the .NET Framework 3.5 on Windows 8.1 and Windows Server 2012 R2: December 10, 2013

2894851 Description of the security update for the .NET Framework 3.5 on Windows 8 and Windows Server 2012: December 10, 2013

Microsoft .NET Framework 2.0 2894847 Description of the security update for the .NET Framework 2.0 Service Pack 2 on Windows Vista Service Pack 2 and Windows Server 2008 Service Pack 2: December 10, 2013

2894843 Description of the security update for the .NET Framework 2.0 Service Pack 2 on Windows Server 2003: December 10, 2013

Dude, my audit reports don't work! Auditing reports blank. Blank auditing reports. Blank audit report. White browser. Empty browser window.

Comments

Anonymous
November 13, 2014
If anyone else out there is hitting this problem, let me know please by leaving a comment. Do NOT leave any information here that could help identify your corporation though. Also consider opening a support ticket with Microsoft to see workarounds or fixes.
Anonymous
November 13, 2014
Hi Christopher,I have this problem in one of my company's customer environment, thank you for posting this article, I've been searching for solution for long time. Will definitely give it i try and post back whether it helped or not.
Anonymous
November 14, 2014
I ran into the same problem a few days ago. Thanks for the post.
Anonymous
November 23, 2014
Hi Christopher,Same problem happen to us, Only from one server we are able to fetch report rest all the server on which user hit is going facing blank page issue.Your help is highly appreciated.Thank you in advance
Anonymous
December 01, 2014
Thanks for the comments, All. I don't have any updates yet but its possible there still might be something in the works. I'll let you know if and when I hear something.
Anonymous
December 02, 2014
Running into this issue as well. Disabling AspNetEnforceViewStateMac in registry does resolve the issue. Thank you for the information. Will watch this page for any updates.
Anonymous
December 29, 2014
we have this problem also. Waiting for your updates.
Anonymous
January 27, 2015
Witnessed exactly the same problem today following some Windows Updates - make the registry changes fixed the problem.Thanks for saving me a lot of aggro!
Anonymous
February 05, 2015
We are experiencing this issue as well.
Anonymous
February 08, 2015
Yes seeing this for several environments following these updates. As you note, the kb article doesn't fix this issue :-(
Anonymous
February 16, 2015
Run into the same problem, changing the AspNetEnforceViewStateMac to 0 resolve the issue.Thanks for your resolution.
Anonymous
March 23, 2015
I recently heard that they're still considering a fix for it. So there is still hope. But there is no certainty about it yet either.
Anonymous
January 18, 2016
Christopher, any updates for this issue? Our reports worked this time last year but are no longer working.
Anonymous
February 17, 2016
Kyle, I'm no longer with Microsoft Corp so I no longer have an inside channel to ask though. I recommend opening a support case with the SharePoint Admin team and refer them to this blog. A bug was filed on it so they shouldn't charge you for the case. Good luck!
Anonymous
February 17, 2016
I just got confirmation from a reliable source that says this will not be fixed in SP2007.

Compartilhar via