Mudanças entre as edições de "Conpat 2.25.2.0"

De MSTECH wiki
Ir para: navegação, pesquisa
(→‎Resultado dos testes)
(→‎Verificação de Segurança)
Linha 4: Linha 4:
 
== Verificação de Segurança ==
 
== Verificação de Segurança ==
  
−
Em verificação.
+
=== Testes Realizados ===
  
 +
{| class="wikitable"
 +
!Item de Teste
 +
!Referência OWASP
 +
!Resultado
 +
|-
 +
|Review Webpage Comments and Metadata for Information Leakage
 +
|[https://www.owasp.org/index.php/Review_webpage_comments_and_metadata_for_information_leakage_(OTG-INFO-005) OTG-INFO-005]
 +
|OK
 +
|-
 +
|Test Application Platform Configuration
 +
|[https://www.owasp.org/index.php/Test_Application_Platform_Configuration_(OTG-CONFIG-002) OTG-CONFIG-002]
 +
|NA
 +
|-
 +
|Test File Extensions Handling for Sensitive Information
 +
|[https://www.owasp.org/index.php/Test_File_Extensions_Handling_for_Sensitive_Information_(OTG-CONFIG-003) OTG-CONFIG-003]
 +
|OK
 +
|-
 +
|Review Old, Backup and Unreferenced Files for Sensitive Information
 +
|[https://www.owasp.org/index.php/Review_Old,_Backup_and_Unreferenced_Files_for_Sensitive_Information_(OTG-CONFIG-004) OTG-CONFIG-004]
 +
|OK
 +
|-
 +
|Test HTTP Methods
 +
|[https://www.owasp.org/index.php/Test_HTTP_Methods_(OTG-CONFIG-006) OTG-CONFIG-006]
 +
|NA
 +
|-
 +
|Test HTTP Strict Transport Security
 +
|[https://www.owasp.org/index.php/Test_HTTP_Strict_Transport_Security_(OTG-CONFIG-007) OTG-CONFIG-007]
 +
|F
 +
|-
 +
|Test RIA cross domain policy
 +
|[https://www.owasp.org/index.php/Test_RIA_cross_domain_policy_(OTG-CONFIG-008) OTG-CONFIG-008]
 +
|NA
 +
|-
 +
|Test Role Definitions
 +
|[https://www.owasp.org/index.php/Test_Role_Definitions_(OTG-IDENT-001) OTG-IDENT-001]
 +
|NA
 +
|-
 +
|Test User Registration Process
 +
|[https://www.owasp.org/index.php/Test_User_Registration_Process_(OTG-IDENT-002) OTG-IDENT-002]
 +
|NA
 +
|-
 +
|Test Account Provisioning Process
 +
|[https://www.owasp.org/index.php/Test_Account_Provisioning_Process_(OTG-IDENT-003) OTG-IDENT-003]
 +
|NA
 +
|-
 +
|Testing for Account Enumeration and Guessable User Account
 +
|[https://www.owasp.org/index.php/Testing_for_Account_Enumeration_and_Guessable_User_Account_(OTG-IDENT-004) OTG-IDENT-004]
 +
|OK
 +
|-
 +
|Testing for Credentials Transported over an Encrypted Channel
 +
|[https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001) OTG-AUTHN-001]
 +
|F
 +
|-
 +
|Testing for default credentials
 +
|[https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002) OTG-AUTHN-002]
 +
|OK
 +
|-
 +
|Testing for Weak lock out mechanism
 +
|[https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003) OTG-AUTHN-003]
 +
|NA
 +
|-
 +
|Testing for Bypassing Authentication Schema
 +
|[https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004) OTG-AUTHN-004]
 +
|OK
 +
|-
 +
|Testing for Vulnerable Remember Password
 +
|[https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005) OTG-AUTHN-005]
 +
|NA
 +
|-
 +
|Testing for Browser cache weakness
 +
|[https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006) OTG-AUTHN-006]
 +
|OK
 +
|-
 +
|Testing for Weak password policy
 +
|[https://www.owasp.org/index.php?title=Testing_for_Weak_password_policy_(OTG-AUTHN-007)&setlang=en OTG-AUTHN-007]
 +
|OK
 +
|-
 +
|Testing for weak password change or reset functionalities
 +
|[https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009) OTG-AUTHN-009]
 +
|OK
 +
|-
 +
|Testing for Weaker authentication in alternative channel
 +
|[https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010) OTG-AUTHN-010]
 +
|NA
 +
|-
 +
|Testing Directory traversal/file include
 +
|[https://www.owasp.org/index.php/Testing_Directory_traversal/file_include_(OTG-AUTHZ-001) OTG-AUTHZ-001]
 +
|OK
 +
|-
 +
|Testing for Bypassing Authorization Schema
 +
|[https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002) OTG-AUTHZ-002]
 +
|OK
 +
|-
 +
|Testing for Privilege escalation
 +
|[https://www.owasp.org/index.php?title=Testing_for_Privilege_escalation_(OTG-AUTHZ-003)&setlang=en OTG-AUTHZ-003]
 +
|OK
 +
|-
 +
|Testing for Insecure Direct Object References
 +
|[https://www.owasp.org/index.php?title=Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)&setlang=en OTG-AUTHZ-004]
 +
|F
 +
|-
 +
|Testing for Session Management Schema
 +
|[https://www.owasp.org/index.php/Testing_for_Session_Management_Schema_(OTG-SESS-001) OTG-SESS-001]
 +
|F
 +
|-
 +
|Testing for cookies attributes
 +
|[https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OTG-SESS-002) OTG-SESS-002]
 +
|OK
 +
|-
 +
|Testing for Session Fixation
 +
|[https://www.owasp.org/index.php/Testing_for_Session_Fixation_(OTG-SESS-003) OTG-SESS-003]
 +
|OK
 +
|-
 +
|Testing for Exposed Session Variables
 +
|[https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004) OTG-SESS-004]
 +
|OK
 +
|-
 +
|Testing for CSRF
 +
|[https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005) OTG-SESS-005]
 +
|F
 +
|-
 +
|Testing for logout functionality
 +
|[https://www.owasp.org/index.php/Testing_for_logout_functionality_(OTG-SESS-006) OTG-SESS-006]
 +
|F
 +
|-
 +
|Testing for Session Timeout
 +
|[https://www.owasp.org/index.php?title=Test_Session_Timeout_(OTG-SESS-007)&setlang=en OTG-SESS-007]
 +
|OK
 +
|-
 +
|Testing for Session puzzling
 +
|[https://www.owasp.org/index.php/Testing_for_Session_puzzling_(OTG-SESS-008) OTG-SESS-008]
 +
|OK
 +
|-
 +
|Testing for Reflected Cross site scripting
 +
|[https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001) OTG-INPVAL-001]
 +
|OK
 +
|-
 +
|Testing for Stored Cross site scripting
 +
|[https://www.owasp.org/index.php/Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002) OTG-INPVAL-002]
 +
|OK
 +
|-
 +
|Testing for HTTP Verb Tampering
 +
|[https://www.owasp.org/index.php?title=Testing_for_HTTP_Verb_Tampering_(OTG-INPVAL-003)&setlang=en OTG-INPVAL-003]
 +
|NA
 +
|-
 +
|Testing for HTTP Parameter pollution
 +
|[https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004) OTG-INPVAL-004]
 +
|OK
 +
|-
 +
|Testing for SQL Injection
 +
|[https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005) OTG-INPVAL-005]
 +
|F
 +
|-
 +
|Testing for LDAP Injection
 +
|[https://www.owasp.org/index.php/Testing_for_LDAP_Injection_(OTG-INPVAL-006) OTG-INPVAL-006]
 +
|NA
 +
|-
 +
|Testing for XML Injection
 +
|[https://www.owasp.org/index.php?title=Testing_for_XML_Injection_(OTG-INPVAL-008)&setlang=en OTG-INPVAL-008]
 +
|NA
 +
|-
 +
|Testing for SSI Injection
 +
|[https://www.owasp.org/index.php?title=Testing_for_SSI_Injection_(OTG-INPVAL-009)&setlang=en OTG-INPVAL-009]
 +
|NA
 +
|-
 +
|Testing for XPath Injection
 +
|[https://www.owasp.org/index.php?title=Testing_for_XPath_Injection_(OTG-INPVAL-010)&setlang=en OTG-INPVAL-010]
 +
|NA
 +
|-
 +
|Testing for IMAP/SMTP Injection
 +
|[https://www.owasp.org/index.php/Testing_for_IMAP/SMTP_Injection_(OTG-INPVAL-011) OTG-INPVAL-011]
 +
|NA
 +
|-
 +
|Testing for Code Injection
 +
|[https://www.owasp.org/index.php?title=Testing_for_Code_Injection_(OTG-INPVAL-012)&setlang=en OTG-INPVAL-012]
 +
|OK
 +
|-
 +
|Testing for Command Injection
 +
|[https://www.owasp.org/index.php?title=Testing_for_Command_Injection_(OTG-INPVAL-013)&setlang=en OTG-INPVAL-013]
 +
|OK
 +
|-
 +
|Testing for Buffer Overflow
 +
|[https://www.owasp.org/index.php/Testing_for_Buffer_Overflow_(OTG-INPVAL-014) OTG-INPVAL-014]
 +
|OK
 +
|-
 +
|Testing for Incubated Vulnerability
 +
|[https://www.owasp.org/index.php?title=Testing_for_Incubated_Vulnerability_(OTG-INPVAL-015)&setlang=en OTG-INPVAL-015]
 +
|OK
 +
|-
 +
|Testing for HTTP Splitting/Smuggling
 +
|[https://www.owasp.org/index.php?title=Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-016)&setlang=en OTG-INPVAL-016]
 +
|OK
 +
|-
 +
|Testing for Information Disclosure
 +
|[https://www.owasp.org/index.php/Testing_for_Error_Code_(OTG-ERR-001) OTG-ERR-001], [https://www.owasp.org/index.php/Testing_for_Stack_Traces_(OTG-ERR-002) OTG-ERR-002]
 +
|OK
 +
|-
 +
|Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection
 +
|[https://www.owasp.org/index.php/Testing_for_Weak_SSL/TLS_Ciphers,_Insufficient_Transport_Layer_Protection_(OTG-CRYPST-001) OTG-CRYPST-001]
 +
|NA
 +
|-
 +
|Testing for Padding Oracle
 +
|[https://www.owasp.org/index.php?title=Testing_for_Padding_Oracle_(OTG-CRYPST-002)&setlang=en OTG-CRYPST-002]
 +
|NA
 +
|-
 +
|Testing for Sensitive information sent via unencrypted channels
 +
|[https://www.owasp.org/index.php?title=Testing_for_Sensitive_information_sent_via_unencrypted_channels_(OTG-CRYPST-003)&setlang=en OTG-CRYPST-003]
 +
|NA
 +
|-
 +
|Tests of business logic
 +
|[https://www.owasp.org/index.php/Testing_for_business_logic OTG-BUSLOGIC-001..009]
 +
|OK
 +
|-
 +
|Testing for DOM-based Cross site scripting
 +
|[https://www.owasp.org/index.php/Testing_for_DOM-based_Cross_site_scripting_(OTG-CLIENT-001) OTG-CLIENT-001]
 +
|OK
 +
|-
 +
|Testing for JavaScript Execution
 +
|[https://www.owasp.org/index.php/Testing_for_JavaScript_Execution_(OTG-CLIENT-002) OTG-CLIENT-002]
 +
|OK
 +
|-
 +
|Testing for HTML Injection
 +
|[https://www.owasp.org/index.php/Testing_for_HTML_Injection_(OTG-CLIENT-003) OTG-CLIENT-003]
 +
|OK
 +
|-
 +
|Testing for Client Side URL Redirect
 +
|[https://www.owasp.org/index.php/Testing_for_Client_Side_URL_Redirect_(OTG-CLIENT-004) OTG-CLIENT-004]
 +
|OK
 +
|-
 +
|Testing for CSS Injection
 +
|[https://www.owasp.org/index.php/Testing_for_CSS_Injection_(OTG-CLIENT-005) OTG-CLIENT-005]
 +
|OK
 +
|-
 +
|Testing for Client Side Resource Manipulation
 +
|[https://www.owasp.org/index.php/Testing_for_Client_Side_Resource_Manipulation_(OTG-CLIENT-006) OTG-CLIENT-006]
 +
|OK
 +
|-
 +
|Test Cross Origin Resource Sharing
 +
|[https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007) OTG-CLIENT-007]
 +
|OK
 +
|-
 +
|Testing for Cross site flashing
 +
|[https://www.owasp.org/index.php?title=Testing_for_Cross_site_flashing_(OTG-CLIENT-008)&setlang=en OTG-CLIENT-008]
 +
|OK
 +
|-
 +
|Testing for Clickjacking
 +
|[https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009) OTG-CLIENT-009]
 +
|OK
 +
|-
 +
|Testing WebSockets
 +
|[https://www.owasp.org/index.php?title=Testing_WebSockets_(OTG-CLIENT-010)&setlang=en OTG-CLIENT-010]
 +
|NA
 +
|-
 +
|Test Web Messaging
 +
|[https://www.owasp.org/index.php?title=Test_Web_Messaging_(OTG-CLIENT-011)&setlang=en OTG-CLIENT-011]
 +
|NA
 +
|-
 +
|Test Local Storage
 +
|[https://www.owasp.org/index.php?title=Test_Local_Storage_(OTG-CLIENT-012)&setlang=en OTG-CLIENT-012]
 +
|NA
 +
|}
 +
<font size=1>
 +
:OK (Nenhum problema encontrado); F (Teste falhou, verificar os resultados); NA (Teste não aplicado)
 +
</font>
 +
 +
=== Resultados dos Testes ===
  
 
== Verificação de Desempenho ==
 
== Verificação de Desempenho ==

Edição das 14h29min de 8 de agosto de 2016

Sistemas Verificados

  • Controle de patrimônio (Conpat), versão 2.25.2.0

Verificação de Segurança

Testes Realizados

Item de Teste Referência OWASP Resultado
Review Webpage Comments and Metadata for Information Leakage OTG-INFO-005 OK
Test Application Platform Configuration OTG-CONFIG-002 NA
Test File Extensions Handling for Sensitive Information OTG-CONFIG-003 OK
Review Old, Backup and Unreferenced Files for Sensitive Information OTG-CONFIG-004 OK
Test HTTP Methods OTG-CONFIG-006 NA
Test HTTP Strict Transport Security OTG-CONFIG-007 F
Test RIA cross domain policy OTG-CONFIG-008 NA
Test Role Definitions OTG-IDENT-001 NA
Test User Registration Process OTG-IDENT-002 NA
Test Account Provisioning Process OTG-IDENT-003 NA
Testing for Account Enumeration and Guessable User Account OTG-IDENT-004 OK
Testing for Credentials Transported over an Encrypted Channel OTG-AUTHN-001 F
Testing for default credentials OTG-AUTHN-002 OK
Testing for Weak lock out mechanism OTG-AUTHN-003 NA
Testing for Bypassing Authentication Schema OTG-AUTHN-004 OK
Testing for Vulnerable Remember Password OTG-AUTHN-005 NA
Testing for Browser cache weakness OTG-AUTHN-006 OK
Testing for Weak password policy OTG-AUTHN-007 OK
Testing for weak password change or reset functionalities OTG-AUTHN-009 OK
Testing for Weaker authentication in alternative channel OTG-AUTHN-010 NA
Testing Directory traversal/file include OTG-AUTHZ-001 OK
Testing for Bypassing Authorization Schema OTG-AUTHZ-002 OK
Testing for Privilege escalation OTG-AUTHZ-003 OK
Testing for Insecure Direct Object References OTG-AUTHZ-004 F
Testing for Session Management Schema OTG-SESS-001 F
Testing for cookies attributes OTG-SESS-002 OK
Testing for Session Fixation OTG-SESS-003 OK
Testing for Exposed Session Variables OTG-SESS-004 OK
Testing for CSRF OTG-SESS-005 F
Testing for logout functionality OTG-SESS-006 F
Testing for Session Timeout OTG-SESS-007 OK
Testing for Session puzzling OTG-SESS-008 OK
Testing for Reflected Cross site scripting OTG-INPVAL-001 OK
Testing for Stored Cross site scripting OTG-INPVAL-002 OK
Testing for HTTP Verb Tampering OTG-INPVAL-003 NA
Testing for HTTP Parameter pollution OTG-INPVAL-004 OK
Testing for SQL Injection OTG-INPVAL-005 F
Testing for LDAP Injection OTG-INPVAL-006 NA
Testing for XML Injection OTG-INPVAL-008 NA
Testing for SSI Injection OTG-INPVAL-009 NA
Testing for XPath Injection OTG-INPVAL-010 NA
Testing for IMAP/SMTP Injection OTG-INPVAL-011 NA
Testing for Code Injection OTG-INPVAL-012 OK
Testing for Command Injection OTG-INPVAL-013 OK
Testing for Buffer Overflow OTG-INPVAL-014 OK
Testing for Incubated Vulnerability OTG-INPVAL-015 OK
Testing for HTTP Splitting/Smuggling OTG-INPVAL-016 OK
Testing for Information Disclosure OTG-ERR-001, OTG-ERR-002 OK
Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection OTG-CRYPST-001 NA
Testing for Padding Oracle OTG-CRYPST-002 NA
Testing for Sensitive information sent via unencrypted channels OTG-CRYPST-003 NA
Tests of business logic OTG-BUSLOGIC-001..009 OK
Testing for DOM-based Cross site scripting OTG-CLIENT-001 OK
Testing for JavaScript Execution OTG-CLIENT-002 OK
Testing for HTML Injection OTG-CLIENT-003 OK
Testing for Client Side URL Redirect OTG-CLIENT-004 OK
Testing for CSS Injection OTG-CLIENT-005 OK
Testing for Client Side Resource Manipulation OTG-CLIENT-006 OK
Test Cross Origin Resource Sharing OTG-CLIENT-007 OK
Testing for Cross site flashing OTG-CLIENT-008 OK
Testing for Clickjacking OTG-CLIENT-009 OK
Testing WebSockets OTG-CLIENT-010 NA
Test Web Messaging OTG-CLIENT-011 NA
Test Local Storage OTG-CLIENT-012 NA

OK (Nenhum problema encontrado); F (Teste falhou, verificar os resultados); NA (Teste não aplicado)

Resultados dos Testes

Verificação de Desempenho

Análise do teste

Durante todos os testes, o percentual de processamento manteve-se dentro dos padrões estabelecidos tendo grande utilização de memória. A média de fila em disco entra-se dentro do aconselhado. O tempo médio de resposta das requisições manteve-se no limite estabelecido, exceto o request de salvar que, em média, demora o dobro dos demais requests.

O sistema apresentou picos nos indicadores "Lazy Write Fluses/sec", "Disk Write/sec" e "Dirty Pages".

A aplicação suporta no máximo até 350 usuários simultâneos, devido a transação de salvar na tabela de cadastro de bens. Não foi possível continuar a realizar os testes devido a grande quantidade de deadlock, que ocorrem a partir de 2 usuários simultâneos. Os mesmos ainda resultam em outros erros de eventvalidation.

Durante os testes foi possível observar que a partir de 50 usuários simultâneos começa a ocorrer erro de conflito da chave estrangeira "FK_BemItemWorkFlow_BemItem". Segue abaixo os logs de erros encontrados:

  • Logs de erro do Conpat
- Log01
Exception Type: System.Data.SqlClient.SqlException
Exception: The INSERT statement conflicted with the FOREIGN KEY constraint "FK_BemItemWorkflow_BemItem". The conflict occurred in database "Conpat", table "dbo.BemItem".
The statement has been terminated.
Source: .Net SqlClient Data Provider
Stack Trace: 
  at MSTech.ConPat.BLL.BemItemWorkflowBO.SalvarWFlow(Int64 _bem_Id, Int32 _bit_Id, Int32 _biw_id, Int32 _bws_id, Guid _usu_id, String _bws_observacao, _WorkId _TipoWF, _PassosWF _Passo, Int64 _tmo_id, TalkDBTransaction banco) in d:\b\ControlePatrimonio\ControlePatrimonio_Main.Revision\src\ControlePatrimonio\Main\Src\MSTech.ConPat.BLL\BemItemWorkflowBO.cs:line 137
  at MSTech.ConPat.BLL.BemItemBO.AtualizarPlaquetas(Int32 uni_idPlaquetas, List`1 listaBensPlaqueta, Int32 cfg_id, Guid usu_idLogado) in d:\b\ControlePatrimonio\ControlePatrimonio_Main.Revision\src\ControlePatrimonio\Main\Src\MSTech.ConPat.BLL\BemItemBO.cs:line 875
  at WebConPat.AreaAdm.Cadastro.Bens.CadastrarPlaqueta.btnSalvar_Click(Object sender, EventArgs e) in d:\b\ControlePatrimonio\ControlePatrimonio_Main.Revision\src\ControlePatrimonio\Main\Src\WebConPat\AreaAdm\Cadastro\Bens\CadastrarPlaqueta.aspx.cs:line 173


- Log02
Exception Type: System.Data.SqlClient.SqlException
Exception: Transaction (Process ID 61) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.
Source: .Net SqlClient Data Provider
Stack Trace: 
  at MSTech.ConPat.BLL.BemPatrimonialBO.Save(BemPatrimonial entityBemPatrimonial, List`1 listBemArquivo, BemItem entityBemItem, List`1 listBemItemArquivo, Boolean IsMovBemPatrimonial, eAction actionLegado, DataTable dtDocumentos, String dirArquivo, String dirArquivoTemp, DataTable dtCentroDeCusto, List`1 listGarantia, Boolean importacaoServico, BemPatrimonialHistoricoDescricao bemPatrimonialHistoricoDescricao, Boolean descricaoMaiuscula, List`1 lstHistorico, eOrigem VS_Origem, PreBens preBem) in d:\b\ControlePatrimonio\ControlePatrimonio_Main.Revision\src\ControlePatrimonio\Main\Src\MSTech.ConPat.BLL\BemPatrimonialBO.cs:line 1129
  at WebConPat.AreaAdm.Cadastro.Bens.Cadastro._Salvar() in d:\b\ControlePatrimonio\ControlePatrimonio_Main.Revision\src\ControlePatrimonio\Main\Src\WebConPat\AreaAdm\Cadastro\Bens\Cadastro.aspx.cs:line 3363


- Log03
Inner Exception Type: System.ArgumentException
Inner Exception: Invalid postback or callback argument.  Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page EnableEventValidation="true" %> in a page.  For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them.  If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.
Inner Source:System.Web
Inner Stack Trace: 
  at System.Web.UI.ClientScriptManager.ValidateEvent(String uniqueId, String argument)
  at System.Web.UI.Control.ValidateEvent(String uniqueID, String eventArgument)
  at System.Web.UI.WebControls.TextBox.LoadPostData(String postDataKey, NameValueCollection postCollection)
  at System.Web.UI.Page.ProcessPostData(NameValueCollection postData, Boolean fBeforeLoad)
  at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
Exception Type: System.Web.HttpUnhandledException
Exception: Exception of type 'System.Web.HttpUnhandledException' was thrown.
Source: System.Web
Stack Trace: 
  at System.Web.UI.Page.HandleError(Exception e)
  at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  at System.Web.UI.Page.ProcessRequest()
  at System.Web.UI.Page.ProcessRequest(HttpContext context)
  at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
  • Logs de erro CoreSSO
- Log01
Exception Type: System.Xml.XmlException
Exception: Data at the root level is invalid. Line 1, position 1.
Source: System.Xml
Stack Trace: 
  at System.Xml.XmlTextReaderImpl.Throw(Exception e)
  at System.Xml.XmlTextReaderImpl.ParseRootLevelWhitespace()
  at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
  at System.Xml.XmlLoader.Load(XmlDocument doc, XmlReader reader, Boolean preserveWhitespace)
  at System.Xml.XmlDocument.Load(XmlReader reader)
  at System.Xml.XmlDocument.LoadXml(String xml)
  at MSTech.ConPat.Web.WebProject.LogOn.ProcessRequest(HttpContext context) in d:\b\ControlePatrimonio\ControlePatrimonio_Main.Revision\src\ControlePatrimonio\Main\Src\MSTech.ConPat.Web.WebProject\LogOn.cs:line 58


- Log02
Exception Type: System.NullReferenceException
Exception: Object reference not set to an instance of an object.
Source: WebConPat
Stack Trace: 
  at WebConPat.SelecionaUnidade.Page_Load(Object sender, EventArgs e) in d:\b\ControlePatrimonio\ControlePatrimonio_Main.Revision\src\ControlePatrimonio\Main\Src\WebConPat\SelecionaUnidade.aspx.cs:line 19

Cenários de uso

Cenário de uso #1 - Login
Ação realizada Think Time (segundos)
1 - Acessar tela de login 3
1 - Realizar login 7
1 - Selecionar sistema Transporte Escolar 5


Cenário de uso #2 - Cadastro de bem
Ação realizada Think Time (segundos)
2 - Acessar tela de consulta de bens 3
2 - Acessar tela de cadastro de bens 3
2 - Preencher "Tipo" 3
2 - Preencher campos de data 5
2 - Preencher campo valor 4
2 - Adicionar fornecedor 13
2 - Selecionar grupo de bens 7
2 - Adicionar documento 10
2 - Marcar bem como sem garantia 3
2 - Adicionar centro de custo 7
2 - Salvar cadastro 10


Cenário de uso #3 - Recebimento de bem
Ação realizada Think Time (segundos)
3 - Acessar home 3
3 - Expandir painel 3
3 - Clicar em "Envio de bens" 2
3 - Clicar em "Aguardando recebimento" 2
3 - Mudar status do item 8


Cenário de uso #4 - Incorporação do bem
Ação realizada Think Time (segundos)
4 - Acessar tela de movimentação manual de bens 5
4 - Selecionar movimentação de incorporação 3
4 - Pesquisar bens para incorporação 7
4 - Clicar em "Exibir itens" 2
4 - Clicar em "Confirmar seleção" 5
4 - Clicar em "Carregar dados" 4
4 - Salvar movimentação 10


Cenário de uso #5 - Logout
Ação realizada Think Time (segundos)
5 - Logout 5

Resultado dos testes

Nesta seção serão apresentados os resultados obtidos da execução dos testes.

  • Porcentagem de tempo do processador
Descrição: Mede a saturação do processador e mostra a quantidade de tempo despendida para processar as threads por todas as CPUs.
Limite recomendado: Abaixo de 75 %.
Análise: A aplicação demonstrou desempenho esperado.
2016-07-04 Conpat ResponseTime.png


  • Porcentagem de memória utilizada
Descrição: Indica a porcentagem de memória utilizada para uso dos processos.
Limite recomendado: Abaixo de 75 %.
Análise: A aplicação utiliza uma quantidade significativa de memória.
2016-07-04 Conpat MemoriaUtilizada.png


  • Kbytes totais pela interface de rede
Descrição: Indica quantos Kbytes foram enviados e recebidos a cada segundo pela interface de rede.
Limite recomendado: Menor que 5 Mbytes para uma rede de 100Mbps, menor que 50 Mbytes para uma rede de 1000 Mbps. (Quanto menor melhor).
Análise: Ocorre picos de envio e recebimento de Kbytes realizados pelo sistema.


2016-07-04 Conpat InterfaceTotalDeRede.png


  • Tempo médio de resposta das requisições
Descrição: Indica o tempo médio de resposta das requisições.
Limite recomendado: 5 segundos.
Análise: A aplicação demonstrou desempenho esperado próximo à 350 usuários, com uma quantidade superior de usuários os servidores ficam sobrecarregados, aumentando significativamente o tempo de resposta.
2016-07-04 Conpat TempoDeResposta.png
2016-07-04 Conpat TempoDeRespostaLegenda.png


  • Tempo de vazão
Descrição: Indica a quantidade total de request por segundo.
Limite recomendado: Quanto maior melhor.
A aplicação demonstrou desempenho esperado até atingir 400 usuários simultâneos.
2016-07-04 Conpat Vazao.png
2016-07-04 Conpat VazaoLegenda.png


  • Porcentagem de erro
Descrição: Indica a porcentagem de erro.
Limite recomendado: Quanto menor melhor.
A aplicação demonstrou grande porcentagem de erro.
2016-07-04 Conpat PorcentagemErros.png
Disponível em "http://wiki.mstech.com.br/index.php?title=Conpat_2.25.2.0&oldid=1744"