Configuring the IIS ASP Global.asa File

By Stephen Bucaro

Global.asa is a file that can contain up to four subroutines. Application_OnStart is executed when IIS is started, for example when the machine is rebooted, Application_OnEnd is executed when IIS is stoped. Session_OnStart is executed when a visitor first accesses the website, Session_OnEnd is executed when a visitor leaves the website.

Having a global.asa file is optional, but if you have one, it should be in the root of the virtual directory, typically C:\inetpub\wwwroot. Shown below is the code for a global.asa file that tracks the number of current visitors and the total number of visitors since the application started.

<script language="vbscript" runat="server">

Sub Application_OnStart
   Application.Lock
   Application("onlineNow") = 0
   Application("totalVisits") = 0
   Application.Unlock
End Sub

Sub Session_OnStart
   Application.Lock
   Application("onlineNow") = Application("onlineNow") + 1
   Application("totalVisits") = Application("totalVisits") + 1
   Application.Unlock
End Sub

Sub Session_OnEnd
   Application.Lock
   Application("onlineNow") = Application("onlineNow") - 1
   Application.Unlock
End Sub

Sub Application_OnEnd
   Application("onlineNow") = 0
   Application("totalVisits") = 0
End Sub

</script>

A session starts when a visitor first accesses the website, causing Session_OnStart to execute. This causes the contents of the variables onlineNow and totalVisits to be incremented by 1. A session ends when a visitor leaves the website. This causes the variable onlineNow to be decremented by 1. The variable totalVisits is not decremented.

Having provided this example, I must advise that having a global.asa file is optional and, since the file difficult to configure, unreliable, and is a popular target for hackers, you may not want to have one. An online search will reveal that many webmasters are having problems when they attempt to use the global.asa Session_OnStart subroutine to initialize their database connection string.

This is unreliable. Instead, initialize the database connection string on the first page called by your application. Many webmasters attempt to use the global.asa Session_OnEnd subroutine to save global variables to a file when IIS is shut down. This is unreliable.

The global.asa file is a popular target for hackers who like to change Application_OnStart to redirect all site accesses to a database on a different site.

Other problems with use of the global.asa file is that sessions work only with visitors who have cookies enabled in their browsers. Without the session cookie, every page access is a new session start. The global.asa file cannot contain any HTML code, which limits troubleshooting options. And when you make a change to global.asa, you have to restart the application before it will take effect, in fact you usually need to reboot the machine to get it to execute the global.asa file and recognize the changes.

RSS Feed

 Follow @Stephen Bucaro

 Active Server Pages
 Java
 MySQL
 Visual Basic Programming
 XML
 Microsoft TechNet Home