European SharePoint Conference Copenhagen 2013 – Forensics for IT Pro’s

On the Tuesday of the SharePoint conference I attended an interesting session by Jason Kaczor on ‘Forensics for IT pro’s and administrators’. This session had a beware sign stamped all over it for developers as the session was mainly aimed at giving IT pro’s the knowledge and tools to check custom code (thoroughly!!) before it is deployed.

In a majority of cases issues with SharePoint is commonly caused by customisations (custom code). The issues that you are most likely to discover from bad custom code is memory leaks. Below are some bullet points on the tips and recommendations that I found useful from the session:

• Only accept .wsp files (cabinet file) to deploy to your environment. Reject .exe, .msi and bat files.
• If you have to deploy a msi (eg from a vendor) then unpack the file using msiexec or 7-zip and inspect the files. Deploy to your test environment first and look out for a licence file.
• The wsp should contain a manifest.xml, which will list the solutions and features.
• The solutions will have no version numbers, but the features do have version numbers as it is used to update/rollback a solution. Ensure the version number is an increment on the previous version.
• If the wsp has no dll’s then the deployment will generally be safe. If you have multiple dll’s in your deployment then this is a potential risk to your environment.
• Run SPDisposeCheck against the compiled code (DLL) which checks for potential memory leaks in the code.
• If you have custom code already deployed to the GAC in your farm then you can use tools like windiff or winmerge to extract the structure of the files to a safe place for future reference.
• The solution called ‘Lapointe.SharePoint2010.Automation.wsp’ by Gary Lapointe is a must have tool for any SharePoint environment. The solution runs a full audit of your SharePoint farm detailing all custom code deployed to it.

There are some very useful Static Analysis tools available for you to use to help troubleshoot and analyse custom code which I have listed below for you:

• Fx Cop 10 – Performs static code analysis of .NET code.
• Gendarme – Extensible rule-based tool to fine problems in .Net applications.
• Cat.net – Is a binary code analysis tool for finding security vulnerabilities
• Dependency Walker – Finds dll’s dependencies
• Perfmon – Use is to find memory leaks.
• iLSpy – Open source .Net assembly browser and decompiler.