---
title: Operational runbook
summary: Deployment, health checks, logs, fault conditions, and error recovery procedures.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-22
---

# Operational runbook

This host is deployed to IIS in two variants — Internal and External — from one codebase and one route table; operators verify reachability with a WSDL fetch or a lightweight read-only call, and every failure surfaces to the caller as a detailed SOAP fault rather than an HTTP status code.

## Deployment

| Attribute | Value |
| --- | --- |
| Host | IIS |
| Site / virtual directory | Development root `http://localhost/wcf`; deployed addresses are set by the release pipeline and not present in this repository |
| Application pool | Identity `$(wcf.svc.username)`/`$(wcf.svc.password)` from `Architecture.ServiceAccounts.IIS`; .NET version not determined from source |
| Platform target | x64 |
| Build configurations | `Release` (Internal), `ReleaseExternal` (External) |
| Deployment mechanism | `pipelines/build.yml` builds both artifacts; `pipelines/release.yml` deploys them with independent `DeployInternal`/`DeployExternal` switches |
| Artifacts | `app-internal`, `app-external` |

## Environments and variants

| Environment | Variant | Base address | Environment track | Notes |
| --- | --- | --- | --- | --- |
| DEV | Internal | Not determined from source | DEV | Both deployment variants exist in every environment tier per `pipelines/release.yml`'s switches |
| DEV | External | Not determined from source | DEV | See above |
| TEST | Internal | Not determined from source | TEST | See above |
| TEST | External | Not determined from source | TEST | See above |
| PROD | Internal | Not determined from source | PROD | See above |
| PROD | External | Not determined from source | PROD | See above |

The variant-to-transform mapping is on [Activation and hosting](activation-hosting.md) and agrees with this table: `Release`/`Web.Release.config` produces the Internal artifact, `ReleaseExternal`/`Web.ReleaseExternal.config` produces the External artifact.

## Health verification

| Check | Request | Expected result |
| --- | --- | --- |
| Service metadata reachable | `GET <base address>/PreferenceService?wsdl` | WSDL document returned (`httpGetEnabled="true"`) |
| Service responds | SOAP request invoking `GetPreferences` (`PreferenceService`) | A `Preference[]` response, empty or populated, with no side effect |

`GetPreferences` is the lightest available read operation with no side effect; every other read operation either mutates state as a side effect (`WebContextService.Get` deletes the row it reads) or requires arguments that are not safe to invent for a health probe (`FileService.ReadFile`/`Length` require a real path; `SecurityService.GetUser` requires a real identity).

## Fault conditions

| Condition | What the caller receives | Operator action |
| --- | --- | --- |
| Operation succeeds | Response message | None |
| Invalid input message | Generic SOAP fault with full exception detail (`includeExceptionDetailInFaults="true"`) | Return the fault detail to the caller; no server-side action |
| Authorization failure | Not applicable — no authorization in code on this host | — |
| Unknown SOAP action | `ActionNotSupported` fault | Verify the operation name and namespace the caller is using |
| No service at the address | HTTP 404 from IIS before dispatch | Verify the route registration in `Global.asax.cs` and the deployed virtual directory |
| Unhandled exception in an operation | Generic SOAP fault with full exception detail (type, message, stack trace) | Escalate with the logged exception detail from `LogService` |

## Logs

| Surface | Location | Content | Retention |
| --- | --- | --- | --- |
| `LogService` (via `ErrorLogErrorHandler.HandleError`) | Not determined from source | `ApplicationExceptionDetail` — application name `"WCF"`, environment track, machine name, calling user, exception detail | Not determined from source |
| IIS log (`HttpContext.Current.Response.AppendToLog`) | IIS site log | `SecurityService` operation name and arguments (`userId`, `employeeId`, `customerId`, `groupName`, `role`) on every call | Governed by IIS log retention policy — not determined from source |

## Environment configuration

| Setting | Key | Purpose |
| --- | --- | --- |
| Oracle instance selection | `EnvironmentConfigKeys.OracleDatabase` | Selects the Oracle instance behind `CLM`/`IMG`/`EXTUR` |
| SQL Server instance selection | `EnvironmentConfigKeys.NetFrameworkSqlServer` | Selects the SQL Server instance behind `NETFRAMEWORK`/`APPM` |
| Legacy.Fax endpoint | `EnvironmentConfigKeys.FaxSoapServiceUrl` | Outbound fax gateway address |

See [Configuration](configuration.md) for the complete settings catalog, including the runtime resolution of database connections.

## Error scenarios

| Scenario | Symptom | Impact | Recovery |
| --- | --- | --- | --- |
| Environment API unavailable | Failure during the first per-request configuration read | Operations on the five environment-dependent services fail; `FileService` is unaffected | Verify Environment API availability for the configured track |
| Database connection resolution fails | Exception from `DbConnectionManager.Get*ConnectionString`, and faults from data-backed operations | `PreferenceService`, `WebContextService`, `ImagingService`, `SecurityService` operations fail | Verify the environment config key and schema argument, then confirm database availability |
| Legacy.Fax unavailable | Fault or timeout from `FaxServiceProxy.SendFax` | `FaxService.SendFax` fails; a partially-sent recipient loop may leave the staged file on disk | Verify Legacy.Fax availability and the resolved `FaxSoapServiceUrl` |
| Route not registered after a deployment | HTTP 404 at the service address | The affected service is unreachable | Verify `Application_Start` ran and the route name matches the deployed address |
| Application pool recycled under load | `AuthorizationCacheService`'s process-wide cache and `SecurityService.ldap_external` static field are reset; intermittent authorization-cache misses follow | Increased load on `EXTUR`/AD while the cache rebuilds | Expected behavior after a recycle; no operator action required |
| `ImagingService.QueueImage` fails after the document write but before the sidecar write | Document present without its `.idx` sidecar | Downstream imaging pipeline cannot index the document | Manually reconcile or re-queue the affected image |

## Monitoring and alerting

No telemetry, health-check endpoint, or alerting configuration was found in this repository for this host.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Activation and hosting](activation-hosting.md)
- [Operations](operations.md)
- [Faults and error pipeline](faults.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Tech debt](tech-debt.md)

## Sources
- src/WCF/SAIF.Services.WCF.Host/Global.asax.cs
- pipelines/build.yml
- pipelines/release.yml
- src/WCF/SAIF.Services.WCF.Host/Extensions/ErrorLogErrorHandler.cs
- src/WCF/SAIF.Services.WCF.Host/Services/Security/SecurityService.cs