Blank browser pages for Audit Log Reports in SP2007

Article
11/11/2014

Symptoms

Perhaps your audit log reporting functionality was working great last month but this month you're only seeing blank, empty pages in your browser. You can't run any reports successfully anymore in your MOSS 2007 farm. You can make it to SITE ACTIONS and then on to AUDIT LOG REPORTS.

You see all the links you're supposed to see at Reporting.aspx.

But you can't do anything with those links anymore.

Clicking any of these links should open a spreadsheet in Excel or, if Excel isn't installed on the client machine, it should render in the browser with some valid xml data that looks something like this:

But after installing the .net update 2905247/2894844/2894852/2894851/2894847/2894843 and rebooting things changed.

Now you just see blank pages whenever you click any of the links.

You can click the Run a Custom Report link and get a page but you won't be able to run any existing reports or create any new reports.

You'll just get a blank page.

Troubleshooting

Nothing interesting seems to show up in the SharePoint diagnostic/ULS logs.

But reproducing the problem while monitoring the application pool with a debugdiag crash rule (that is configured to log CLR exceptions) shows some great hints.

Type:     System.Web.HttpException
Message: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. https://go.microsoft.com/fwlink/?LinkID=314055
Type:     System.Web.UI.ViewStateException
Message: NOT_FOUND
Stack:
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.ViewStateException.ThrowError(System.Exception, System.String, System.String, Boolean)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[], Byte[], Int32, Int32, Int32 ByRef)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.UI.Util.DeserializeWithAssert(System.Web.UI.IStateFormatter, System.String)
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
  System.Web.UI.Page.LoadAllState()
  System.Web.UI.Page.ProcessRequestMain(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest()
  System.Web.UI.Page.ProcessRequest(System.Web.HttpContext)
  ASP._layouts_runreport_aspx.ProcessRequest(System.Web.HttpContext)
  System.Web.HttpApplication+CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  System.Web.HttpApplication.ExecuteStep(IExecutionStep, Boolean ByRef)
  System.Web.HttpApplication+ApplicationStepManager.ResumeSteps(System.Exception)
  System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(System.Web.HttpContext, System.AsyncCallback, System.Object)
  System.Web.HttpRuntime.ProcessRequestInternal(System.Web.HttpWorkerRequest)
  System.Web.HttpRuntime.ProcessRequestNoDemand(System.Web.HttpWorkerRequest)
  System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)

Type:     System.Web.HttpException
Message: Unable to validate data.
Stack:
         RetAddr          Call Site
  System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[], Byte[], Int32, Int32, Int32 ByRef)
  System.Web.UI.ObjectStateFormatter.Deserialize(System.String)
  System.Web.UI.Util.DeserializeWithAssert(System.Web.UI.IStateFormatter, System.String)
  System.Web.UI.HiddenFieldPageStatePersister.Load()
  System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
  System.Web.UI.Page.LoadAllState()
  System.Web.UI.Page.ProcessRequestMain(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest(Boolean, Boolean)
  System.Web.UI.Page.ProcessRequest()
  System.Web.UI.Page.ProcessRequest(System.Web.HttpContext)
  ASP._layouts_runreport_aspx.ProcessRequest(System.Web.HttpContext)
  System.Web.HttpApplication+CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  System.Web.HttpApplication.ExecuteStep(IExecutionStep, Boolean ByRef)
  System.Web.HttpApplication+ApplicationStepManager.ResumeSteps(System.Exception)
  System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(System.Web.HttpContext, System.AsyncCallback, System.Object)
  System.Web.HttpRuntime.ProcessRequestInternal(System.Web.HttpWorkerRequest)
  System.Web.HttpRuntime.ProcessRequestNoDemand(System.Web.HttpWorkerRequest)
  System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)
DetailID = 2
Count:    1
Type:     System.Web.HttpException
Message: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. https://go.microsoft.com/fwlink/?LinkID=314055

Root Cause

By design, the installation of update 2905247/2894844/2894852/2894851/2894847/2894843 enables the use of ViewStateMac. Unfortunately this causes some problems for WSS-3.0/MOSS-2007 site collection audit log reports.

Solution/Workarounds

Some have uninstalled the update to get past this problem. I am not recommending that. This is an important security patch to have. Besides, some future .net patch will just put you back in the same place.

Others have disabled AspNetEnforceViewStateMac in the registry to get around this problem. I am not recommending that either. It's important for security reasons to have it enabled. (See https://blogs.msdn.com/b/webdev/archive/2014/09/09/farewell-enableviewstatemac.aspx.)

Disabling AspNetEnforceViewStateMac (followed by an IISRESET) does take the blank-page symptoms away. In a lab environment I opened up regedit, searched for AspNetEnforceViewStateMac, found it in two places, and changed the value of 1 (enabled) to 0 (disabled).

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\AspNetEnforceViewStateMac (This is the only one you probably would want to test with.)

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\AspNetEnforceViewStateMac (This might be good to keep in mind if your application pool is running in 32-bit mode for some reason)

Restart IIS to iron in the changes.

Mainstream support for WSS 3.0/MOSS 2007 ended over two years ago. (See https://support2.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=SharePoint+Server+2007&Filter=FilterNO.) So it's not clear at this time if a design change can or will be made. If such a fix/change is produced, I'll try to make it known here.

Otherwise perhaps the time has come to stop trying to get audit reports and start speeding up the pace towards going to either SharePoint Online (O365) or SharePoint 2013!

More Information

https://blogs.msdn.com/b/webdev/archive/2014/09/09/farewell-enableviewstatemac.aspx - Farewell, EnableViewStateMac!

https://support2.microsoft.com/kb/2915218 - Resolving view state message authentication code (MAC) errors

[Note that this article won't help if the problem began when the patch was installed.]

Additional Keywords:

Content modifications Content_modifications.xml

Content type and list modifications Content_type_and_list_modifications.xml

Content viewing Content_viewing.xml

Deletion Deletion.xml

Run a custom report Run_a_custom_report.xml

Expiration and Disposition Expiration_and_Disposition.xml

Policy modifications Policy_modifications.xml

Auditing settings Auditing_settings.xml

Security settings Security_settings.xml

RunReport.aspx, SharePoint 2007,

https://support.microsoft.com/kb/2905247 - Microsoft security advisory: Insecure ASP.NET site configuration could allow elevation of privilege

Microsoft .NET Framework 3.5.1 2894844 Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: December 10, 2013

Microsoft .NET Framework 3.5 2894852 Description of the security update for the .NET Framework 3.5 on Windows 8.1 and Windows Server 2012 R2: December 10, 2013

2894851 Description of the security update for the .NET Framework 3.5 on Windows 8 and Windows Server 2012: December 10, 2013

Microsoft .NET Framework 2.0 2894847 Description of the security update for the .NET Framework 2.0 Service Pack 2 on Windows Vista Service Pack 2 and Windows Server 2008 Service Pack 2: December 10, 2013

2894843 Description of the security update for the .NET Framework 2.0 Service Pack 2 on Windows Server 2003: December 10, 2013

Dude, my audit reports don't work! Auditing reports blank. Blank auditing reports. Blank audit report. White browser. Empty browser window.