Recently, we assisted a customer who was facing issues that “None of the websites were working and browser will show the blank white page without any errors”. But There was an error in the application event with Event ID:1 (<Provider Name="GetAccess IIS Runtime" />) we collected IIS logs, Freb logs, and event logs generated at the time of the issue and helped the customer to resolve the issue.
Symptoms
=========
None of the websites are working and browser will show the blank white page without any errors.
Description: The description for Event ID 1 from source GetAccess IIS Runtime cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Unable to find a suitable agent for the current message.
The following event observed in application event logs:
Log Name: Application
Source: GetAccess IIS Runtime
Date: 2/5/2020 3:18:15 PM
Event ID: 1
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: XXXX
Description:
The description for Event ID 1 from source GetAccess IIS Runtime cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Unable to find a suitable agent for the current message.
The specified resource type cannot be found in the image file.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="GetAccess IIS Runtime" />
<EventID Qualifiers="0">1</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-02-05T15:18:15.541005200Z" />
<EventRecordID>42348</EventRecordID>
<Channel>Application</Channel>
<Computer> XXXX </Computer>
<Security />
</System>
<EventData>
<Data>Unable to find a suitable agent for the current message</Data>
</EventData>
</Event>
How to Troubleshoot
===============
Created test website and tested the issue. Test site was also failing with blank page. However, we were seeing the same above event logs every time reproduced the issue.
Collected IIS logs, Freb logs, and event logs generated at the time of the issue.
We were seeing that the requests are reaching the IIS server with status code 200.
2020-02-05 15:49:49 111.111.111.111GET /Index.html - 8080 - 111.111.111.111 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 0
2020-02-05 15:49:49 111.111.111.111 GET /favicon.ico - 8080 - 111.111.111.111 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 0
2020-02-05 15:51:45 127.0.0.1 GET /Index.html - 8080 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 0
2020-02-05 15:53:19 127.0.0.1 GET /Index.html - 8080 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 0
2020-02-05 15:55:32 127.0.0.1 GET /index.html - 8080 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 0
2020-02-05 15:55:46 127.0.0.1 GET /flower.jpg - 8080 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 0
We observed that 3rd party module GetAccessRTModule was loaded in FREB logs.
Cross varied that there was GetAccessRTModule was installed in IIS modules.
Found that there was 3rd party module Apache Software Foundation EntrustGetAccessRuntime9.0 and EntrustGetAccessRuntime9.0 patch 207420 were installed on the same day when issue started.
Resolution
==========
Issue resolved after removing the GetAccessRTModule module from the Test website and site was working as expected.