IIS Crashes with a WSS event handler

Hi all, we develop a custom workflow engine based on Windows
Sharepoint Services 2.0 SP1 event handlers.
Everything works fine with a few documents, but as there are several
modifications done on events (workflow instance and metadata on
documents, in addition to several checks requiring reading in document
libraries), this requires several database access through the WSS
object model.
And when we launch the approval of 5 or 6 documents at once, a few of
these documents are processed and IIS then crashes with several error
messages (Event ID 1000, source: Windows Sharepoint Services 2.0
Error Reporting) which are :

Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
faulting module onetutil.dll, version 11.0.6361.0, stamp 410937b9,
debug? 0, fault address 0x000d2016.

Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
faulting module stswel.dll, version 11.0.6361.0, stamp 41094f14,
debug? 0, fault address 0x000c28ba.

Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
faulting module unknown, version 0.0.0.0, stamp 00000000, debug? 0,
fault address 0x0000000b.

Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
faulting module owssvr.dll, version 11.0.6361.0, stamp 41094f94,
debug? 0, fault address 0x00050abf.

Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
faulting module sqloledb.dll, version 2000.85.1022.0, stamp 3e80173b,
debug? 0, fault address 0x000070ad.

Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
faulting module oledb32.dll, version 2.80.1022.0, stamp 3e801a6e,
debug? 0, fault address 0x0000a85c.

The one involving onetutil.dll appears more than the others.

In addition, after having these crashes, so IIS restart a processus
when we try to restart a document approval, and we get several other
error messages "Unable to instantiate event handler" (still event ID
1000, source Windows Sharepoint Services) indicating that it's no
longer able to call our event handler class, and another error message
indicating that IIS can't read the web.config file correctly (this is
an error that there's not the appropriate configSection in the
web.config despite the fact that it really is there, and it was able
to read it before it crashes.. we use the configuration management
application block).

I executed IISSTATE, and here is the result :

Opened log file 'D:\APPLI\iisstate\output\IISState-5672.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Feb 24 17:53:52 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 5672

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
DLL (!FunctionName) that failed:




Thread ID: 21
System Thread ID: 17d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.46
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00 01c1fd04 07a0691b 0x69a1106
01 01c1fd14 07a0e981 0x7a0691b
02 01c1fd3c 792022f6 0x7a0e981
03 01c1fdc8 792023bd mscorsvr!MethodTable::CallFinalizer+0xee
04 01c1fddc 79201eb7 mscorsvr!CallFinalizer+0x84
05 01c1fe74 79202455 mscorsvr!CallFinalizer+0x245
06 01c1fe88 791cce61 mscorsvr!GCHeap::RestartEE+0x73
07 01c1fed0 79202428 mscorsvr!Thread::DoADCallBack+0x5c
08 01c1ff70 7923db5e mscorsvr!CallFinalizer+0x2ea
09 01c1ffb8 77e4a990 mscorsvr!GCHeap::FinalizerThreadStart+0x17c
0a 01c1ffec 00000000 kernel32!BaseThreadStart+0x34
Closing open log file D:\APPLI\iisstate\output\IISState-5672.log
Opened log file 'D:\APPLI\iisstate\output\IISState-5672.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Feb 24 17:55:54 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 5672

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 178c
Kernel Time: 0:0:0.78
User Time: 0:0:0.15
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0006fe58 77f43741 SharedUserData!SystemCallStub+0x4
01 0006fe5c 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 0006fecc 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 0006fedc 5a3635ae kernel32!WaitForSingleObject+0xf
04 0006feec 5a364d7d w3dt!WP_CONTEXT::RunMainThreadLoop+0xe
05 0006fef4 5a3a1d98 w3dt!UlAtqStartListen+0x2d
06 0006ff00 5a3a5d54 w3core!W3_SERVER::StartListen+0x8e
07 0006ff0c 010017af w3core!UlW3Start+0xea
08 0006ff44 0100195e w3wp!wmain+0x236
09 0006ffc0 77e4f38c w3wp!wmainCRTStartup+0x12f
0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23




Thread ID: 1
System Thread ID: a74
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 009bfea0 77f4372d SharedUserData!SystemCallStub+0x4
01 009bfea4 77f6c86c ntdll!NtWaitForMultipleObjects+0xc
02 009bff48 77f6d7f5 ntdll!EtwpWaitForMultipleObjectsEx+0xf7
03 009bffb8 77e4a990 ntdll!EtwpEventPump+0x27d
04 009bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 2
System Thread ID: 16e0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009fff9c 77f4262b SharedUserData!SystemCallStub+0x4
01 009fffa0 77f6b5b2 ntdll!NtDelayExecution+0xc
02 009fffb8 77e4a990 ntdll!RtlpTimerThread+0x45
03 009fffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 3
System Thread ID: a5c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00a3ff70 77f430c7 SharedUserData!SystemCallStub+0x4
01 00a3ff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
02 00a3ffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
03 00a3ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 4
System Thread ID: 17e4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00aafe20 77f4313f SharedUserData!SystemCallStub+0x4
01 00aafe24 77c57b85 ntdll!NtReplyWaitReceivePortEx+0xc
02 00aaff8c 77c60829 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
03 00aaff90 77c60771 RPCRT4!RecvLotsaCallsWrapper+0x9
04 00aaffb0 77c60857 RPCRT4!BaseCachedThreadRoutine+0x9c
05 00aaffb8 77e4a990 RPCRT4!ThreadStartRoutine+0x17
06 00aaffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 5
System Thread ID: 1188
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00aeff10 77f4262b SharedUserData!SystemCallStub+0x4
01 00aeff14 77e418ea ntdll!NtDelayExecution+0xc
02 00aeff7c 77e416ee kernel32!SleepEx+0x68
03 00aeff88 77162501 kernel32!Sleep+0xb
04 00aeff94 771625ea ole32!CROIDTable::WorkerThreadLoop+0x12
05 00aeff9c 77160000 ole32!CRpcThread::WorkerLoop+0x1e
06 00aeffac 77162653 ole32!_imp__InstallApplication (ole32+0x0)
07 00aeffb8 77e4a990 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1f
08 00aeffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 6
System Thread ID: 1734
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00caff28 77f430c7 SharedUserData!SystemCallStub+0x4
01 00caff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
02 00caff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
03 00caff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
04 00caffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
05 00caffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
06 00caffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 7
System Thread ID: a50
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00ceff28 77f430c7 SharedUserData!SystemCallStub+0x4
01 00ceff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
02 00ceff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
03 00ceff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
04 00ceffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
05 00ceffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
06 00ceffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 8
System Thread ID: 568
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d2ff28 77f430c7 SharedUserData!SystemCallStub+0x4
01 00d2ff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
02 00d2ff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
03 00d2ff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
04 00d2ffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
05 00d2ffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
06 00d2ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 9
System Thread ID: 155c
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d6ff28 77f430c7 SharedUserData!SystemCallStub+0x4
01 00d6ff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
02 00d6ff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
03 00d6ff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
04 00d6ffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
05 00d6ffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
06 00d6ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 10
System Thread ID: 1708
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e2fcec 77f4372d SharedUserData!SystemCallStub+0x4
01 00e2fcf0 77f75297 ntdll!NtWaitForMultipleObjects+0xc
02 00e2ffb8 77e4a990 ntdll!RtlpWaitThread+0x158
03 00e2ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 11
System Thread ID: d64
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 016eff14 77f43741 SharedUserData!SystemCallStub+0x4
01 016eff18 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 016eff88 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 016eff98 5a3a51f7 kernel32!WaitForSingleObject+0xf
04 016effb8 77e4a990 w3core!HTTP_COMPRESSION::CompressionThread+0x85
05 016effc4 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 12
System Thread ID: 14ec
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0173fe20 77f4313f SharedUserData!SystemCallStub+0x4
01 0173fe24 77c57b85 ntdll!NtReplyWaitReceivePortEx+0xc
02 0173ff8c 77c60829 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
03 0173ff90 77c60771 RPCRT4!RecvLotsaCallsWrapper+0x9
04 0173ffb0 77c60857 RPCRT4!BaseCachedThreadRoutine+0x9c
05 0173ffb8 77e4a990 RPCRT4!ThreadStartRoutine+0x17
06 0173ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 13
System Thread ID: 1388
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0177fec4 77f4372d SharedUserData!SystemCallStub+0x4
01 0177fec8 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 0177ff70 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 0177ff88 10001a4c kernel32!WaitForMultipleObjects+0x17
04 0177ffb8 77e4a990
stsfltr!VinclusionManager::ListenerThreadFunc+0x69
05 0177ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 14
System Thread ID: 1298
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0183ff54 77f430c7 SharedUserData!SystemCallStub+0x4
01 0183ff58 77e430bc ntdll!ZwRemoveIoCompletion+0xc
02 0183ff84 791e4108 kernel32!GetQueuedCompletionStatus+0x27
03 0183ffb8 77e4a990
mscorsvr!ThreadpoolMgr::CompletionPortThreadStart+0x49
04 0183ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 15
System Thread ID: 15f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0187feb4 77f4262b SharedUserData!SystemCallStub+0x4
01 0187feb8 77e418ea ntdll!NtDelayExecution+0xc
02 0187ff20 77e416ee kernel32!SleepEx+0x68
03 0187ff2c 791be01f kernel32!Sleep+0xb
04 0187ffb8 77e4a990 mscorsvr!ThreadpoolMgr::GateThreadStart+0x54
05 0187ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 16
System Thread ID: 16d8
Kernel Time: 0:0:0.296
User Time: 0:0:12.125
Thread Status: Thread is in a WAIT state.
Thread Type: SQL Query. Possible ASP page
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 018bd668 77f4372d SharedUserData!SystemCallStub+0x4
01 018bd66c 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 018bd714 7923cf46 kernel32!WaitForMultipleObjectsEx+0x11a
03 018bd7a0 7923d900
mscorsvr!GCHeap::FinalizerThreadWatchDogHelper+0x110
04 018bd7ac 7923d5f0 mscorsvr!GCHeap::FinalizerThreadWatchDog+0x122
05 018bd7cc 7923d680 mscorsvr!EEShutDown+0x118
06 018bd7d8 7923dac0 mscorsvr!ForceEEShutdown+0x49
07 018bd7e4 791795b7 mscorsvr!CorExitProcess+0x58
08 018bd7f4 77bc8b3b mscoree!CorExitProcess+0x46
09 018bd7fc 77bc8c40 msvcrt!__crtExitProcess+0x25
0a 018bd82c 77bc8c99 msvcrt!_cinit+0xce
0b 018bd83c 77baefb3 msvcrt!_exit+0xd
0c 018bd848 77bc5013 msvcrt!_amsg_exit+0x30
0d 018bd850 073d247e msvcrt!_purecall+0x7
0e 018bd890 073d255b sqloledb!CMultipleResults::GetResult+0x4d1
0f 018bd8c8 070d3b26 sqloledb!CImpIMultipleResults::GetResult+0x3b
10 018bd95c 070d3804 oledb32!CMultipleResults::DoGetResult+0x66
11 018bd9ac 334074ea oledb32!CMultipleResults::GetResult+0xe4
12 018bd9d8 33407dbb stswel!Voledb::GetNextResult+0x36
13 018bd9ec 329b07bc stswel!Voledb::GetNextResult+0x12
14 018bf104 329b0c4b OWSSVR!CSPRequest::HrRunMondoSproc+0x204
15 018bf138 329b24ab OWSSVR!CSPRequest::HrInitAppSession+0xd9
16 018bf368 329dd6e8 OWSSVR!CSPRequest::HrOpenSPRequest+0x9e
17 018bf3b4 069a0e28 OWSSVR!CSPRequest::GetFile+0x37
WARNING: Frame IP not in any known module. Following frames may be
wrong.
18 018bf54c 07a041a0 0x69a0e28
19 018bf56c 07a01ea1 0x7a041a0
1a 018bf5c8 06aff5a8 0x7a01ea1
1b 018bf650 069865e0 0x6aff5a8
1c 018bf710 791b31e1 0x69865e0
1d 018bf71c 791f85b1 mscorsvr!CallDescrWorker+0x30
1e 018bf8ec 01e918a2 mscorsvr!COMMember::InvokeMethod+0x95a
1f 00000002 00000000 0x1e918a2




Thread ID: 17
System Thread ID: 6bc
Kernel Time: 0:0:0.437
User Time: 0:0:16.93
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 018ff3f0 77f4372d SharedUserData!SystemCallStub+0x4
01 018ff3f4 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 018ff49c 7927146c kernel32!WaitForMultipleObjectsEx+0x11a
03 018ff4b4 791fd088 mscorsvr!GCHeap::WaitUntilGCComplete+0x30
04 018ff4c4 792a22c2 mscorsvr!Thread::RareDisablePreemptiveGC+0xb5
05 018ff4d4 019bb1f3 mscorsvr!OnStubScalarTripThread+0x10
WARNING: Frame IP not in any known module. Following frames may be
wrong.
06 018ff530 07a00470 0x19bb1f3
07 018ff5c4 06aff573 0x7a00470
08 018ff650 069865e0 0x6aff573
09 018ff710 791b31e1 0x69865e0
0a 018ff71c 791f85b1 mscorsvr!CallDescrWorker+0x30
0b 018ff8ec 01e918a2 mscorsvr!COMMember::InvokeMethod+0x95a
0c 00000002 00000000 0x1e918a2




Thread ID: 18
System Thread ID: 1604
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 019ffe74 77f4372d SharedUserData!SystemCallStub+0x4
01 019ffe78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 019fff20 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 019fff38 7922d3f3 kernel32!WaitForMultipleObjects+0x17
04 019fffa0 7922d36a mscorsvr!DebuggerRCThread::MainLoop+0x90
05 019fffb0 7922f0a4 mscorsvr!DebuggerRCThread::ThreadProc+0x68
06 019fffb8 77e4a990 mscorsvr!DebuggerRCThread::ThreadProcStatic+0xb
07 019fffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 19
System Thread ID: e40
Kernel Time: 0:0:0.0
User Time: 0:0:0.281
Thread Type: Other
# ChildEBP RetAddr
00 01b9ff14 77f43741 SharedUserData!SystemCallStub+0x4
01 01b9ff18 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 01b9ff88 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 01b9ff98 791fd4d7 kernel32!WaitForSingleObject+0xf
04 01b9ffb0 79225136 mscorsvr!gc_heap::gc_thread_function+0x22
05 01b9ffb8 77e4a990 mscorsvr!Thread::SetExposedContext+0x28
06 01b9ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 20
System Thread ID: 12a4
Kernel Time: 0:0:0.0
User Time: 0:0:0.203
Thread Type: Other
# ChildEBP RetAddr
00 01bdff14 77f43741 SharedUserData!SystemCallStub+0x4
01 01bdff18 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 01bdff88 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 01bdff98 791fd4d7 kernel32!WaitForSingleObject+0xf
04 01bdffb0 79225136 mscorsvr!gc_heap::gc_thread_function+0x22
05 01bdffb8 77e4a990 mscorsvr!Thread::SetExposedContext+0x28
06 01bdffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 21
System Thread ID: 17d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.46
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00 01c1fd04 07a0691b 0x69a1106
01 01c1fd14 07a0e981 0x7a0691b
02 01c1fd3c 792022f6 0x7a0e981
03 01c1fdc8 792023bd mscorsvr!MethodTable::CallFinalizer+0xee
04 01c1fddc 79201eb7 mscorsvr!CallFinalizer+0x84
05 01c1fe74 79202455 mscorsvr!CallFinalizer+0x245
06 01c1fe88 791cce61 mscorsvr!GCHeap::RestartEE+0x73
07 01c1fed0 79202428 mscorsvr!Thread::DoADCallBack+0x5c
08 01c1ff70 7923db5e mscorsvr!CallFinalizer+0x2ea
09 01c1ffb8 77e4a990 mscorsvr!GCHeap::FinalizerThreadStart+0x17c
0a 01c1ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 22
System Thread ID: 13c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01edff38 77f4262b SharedUserData!SystemCallStub+0x4
01 01edff3c 77e418ea ntdll!NtDelayExecution+0xc
02 01edffa4 791c066c kernel32!SleepEx+0x68
03 01edffb8 77e4a990 mscorsvr!ThreadpoolMgr::TimerThreadStart+0x30
04 01edffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 23
System Thread ID: 12e0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01f2ff54 77f430c7 SharedUserData!SystemCallStub+0x4
01 01f2ff58 77e430bc ntdll!ZwRemoveIoCompletion+0xc
02 01f2ff84 791e4108 kernel32!GetQueuedCompletionStatus+0x27
03 01f2ffb8 77e4a990
mscorsvr!ThreadpoolMgr::CompletionPortThreadStart+0x49
04 01f2ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 24
System Thread ID: 12b8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0831ff70 77f430c7 SharedUserData!SystemCallStub+0x4
01 0831ff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
02 0831ffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
03 0831ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 25
System Thread ID: 160
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0613fec4 77f4372d SharedUserData!SystemCallStub+0x4
01 0613fec8 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 0613ff70 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 0613ff88 75976644 kernel32!WaitForMultipleObjects+0x17
04 0613ffb8 77e4a990 USERENV!NotificationThread+0x5f
05 0613ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 26
System Thread ID: 1258
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 06c0fc74 77f4372d SharedUserData!SystemCallStub+0x4
01 06c0fc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 06c0fd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
03 06c0fd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 06c0fda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
05 06c0fe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
06 06c0fe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
07 06c0ff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
08 06c0ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
09 06c0ffb8 77e4a990 msvcrt!_endthreadex+0x95
0a 06c0ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 27
System Thread ID: 1584
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 06c9fc74 77f4372d SharedUserData!SystemCallStub+0x4
01 06c9fc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 06c9fd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
03 06c9fd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 06c9fda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
05 06c9fe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
06 06c9fe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
07 06c9ff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
08 06c9ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
09 06c9ffb8 77e4a990 msvcrt!_endthreadex+0x95
0a 06c9ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 28
System Thread ID: 11c4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 06d2fc74 77f4372d SharedUserData!SystemCallStub+0x4
01 06d2fc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 06d2fd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
03 06d2fd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 06d2fda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
05 06d2fe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
06 06d2fe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
07 06d2ff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
08 06d2ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
09 06d2ffb8 77e4a990 msvcrt!_endthreadex+0x95
0a 06d2ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 29
System Thread ID: 1634
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 06dbfc74 77f4372d SharedUserData!SystemCallStub+0x4
01 06dbfc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 06dbfd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
03 06dbfd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 06dbfda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
05 06dbfe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
06 06dbfe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
07 06dbff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
08 06dbff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
09 06dbffb8 77e4a990 msvcrt!_endthreadex+0x95
0a 06dbffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 30
System Thread ID: 11f4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0702fc88 77f4372d SharedUserData!SystemCallStub+0x4
01 0702fc8c 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 0702fd34 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
03 0702fd90 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 0702fdb8 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
05 0702fe20 3319b236 ole32!CoWaitForMultipleHandles+0xc5
06 0702fe54 333b9ec0 onetutil!VwaitForMultipleObjects+0xa0
07 0702ff80 331ce0ff stswel!VeventManager::ThreadHandlerProc+0xde
08 0702ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
09 0702ffb8 77e4a990 msvcrt!_endthreadex+0x95
0a 0702ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 31
System Thread ID: 844
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0748ff10 77f43741 SharedUserData!SystemCallStub+0x4
01 0748ff14 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 0748ff84 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 0748ff94 070a38a9 kernel32!WaitForSingleObject+0xf
04 0748ffb8 77e4a990 oledb32!ReleaseResourceThread+0x54
05 0748ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 32
System Thread ID: 17f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 074cff08 77f43741 SharedUserData!SystemCallStub+0x4
01 074cff0c 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 074cff7c 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 074cff8c 070a38b9 kernel32!WaitForSingleObject+0xf
04 074cffb8 77e4a990 oledb32!ResetResourceThread+0x84
05 074cffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 33
System Thread ID: 1060
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0750fd04 77f43741 SharedUserData!SystemCallStub+0x4
01 0750fd08 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 0750fd78 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 0750fd88 7561065c kernel32!WaitForSingleObject+0xf
04 0750ffb8 77e4a990 comsvcs!PingThread+0xea
05 0750ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 34
System Thread ID: e64
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0815fdf8 77f4372d SharedUserData!SystemCallStub+0x4
01 0815fdfc 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 0815fea4 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 0815febc 333f8e6a kernel32!WaitForMultipleObjects+0x17
04 0815ff78 331ced67 stswel!VvirusLiveUpdateThread::t_main+0x135
05 0815ff84 77bc91ed onetutil!Vthread::top+0xd
06 0815ffb8 77e4a990 msvcrt!_endthreadex+0x95
07 0815ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 35
System Thread ID: 1360
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 082dff70 77f430c7 SharedUserData!SystemCallStub+0x4
01 082dff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
02 082dffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
03 082dffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 36
System Thread ID: 1328
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 069eff70 77f430c7 SharedUserData!SystemCallStub+0x4
01 069eff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
02 069effb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
03 069effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 37
System Thread ID: 738
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 060fff70 77f430c7 SharedUserData!SystemCallStub+0x4
01 060fff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
02 060fffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
03 060fffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 38
System Thread ID: 1294
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0885ff10 77f43741 SharedUserData!SystemCallStub+0x4
01 0885ff14 77e41817 ntdll!ZwWaitForSingleObject+0xc
02 0885ff84 77e4168f kernel32!WaitForSingleObjectEx+0xac
03 0885ff94 791d3281 kernel32!WaitForSingleObject+0xf
04 0885ffb8 77e4a990 mscorsvr!ThreadpoolMgr::WorkerThreadStart+0x3a
05 0885ffec 00000000 kernel32!BaseThreadStart+0x34

Closing open log file D:\APPLI\iisstate\output\IISState-5672.log


As I see that there was crashes with sqloledb.dll and oledb32.dll, I
wonder if there is a problem about our SQL server machine. The
configuration is : one frontend WSS+SPS 2003 server, and another SQL
Server dedicated machine.
Do you have any idea ?
Thanks in advance !
Stephane Baudet.

Re: IIS Crashes with a WSS event handler

The problem isn't in SQL (or any other DB).

The IISState crash was in managed code that was being cleaned up (i.e. the
Finalizer was running). IISState wasn't able to get the executing .net
code. There may be other problems as well.

Next time run IISState with the same flags, but use -d as well to create a
dump. Post the log file(s) and we'll see if either IISState cathes the next
one or if we will need to review the dumps instead.


Pat

"Stephane Baudet" wrote in message
news:1526cbac.0502250111.26376e70@posting.google.com...
> Hi all, we develop a custom workflow engine based on Windows
> Sharepoint Services 2.0 SP1 event handlers.
> Everything works fine with a few documents, but as there are several
> modifications done on events (workflow instance and metadata on
> documents, in addition to several checks requiring reading in document
> libraries), this requires several database access through the WSS
> object model.
> And when we launch the approval of 5 or 6 documents at once, a few of
> these documents are processed and IIS then crashes with several error
> messages (Event ID 1000, source: Windows Sharepoint Services 2.0
> Error Reporting) which are :
>
> Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
> faulting module onetutil.dll, version 11.0.6361.0, stamp 410937b9,
> debug? 0, fault address 0x000d2016.
>
> Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
> faulting module stswel.dll, version 11.0.6361.0, stamp 41094f14,
> debug? 0, fault address 0x000c28ba.
>
> Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
> faulting module unknown, version 0.0.0.0, stamp 00000000, debug? 0,
> fault address 0x0000000b.
>
> Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
> faulting module owssvr.dll, version 11.0.6361.0, stamp 41094f94,
> debug? 0, fault address 0x00050abf.
>
> Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
> faulting module sqloledb.dll, version 2000.85.1022.0, stamp 3e80173b,
> debug? 0, fault address 0x000070ad.
>
> Faulting application w3wp.exe, version 6.0.3790.0, stamp 3e8000e6,
> faulting module oledb32.dll, version 2.80.1022.0, stamp 3e801a6e,
> debug? 0, fault address 0x0000a85c.
>
> The one involving onetutil.dll appears more than the others.
>
> In addition, after having these crashes, so IIS restart a processus
> when we try to restart a document approval, and we get several other
> error messages "Unable to instantiate event handler" (still event ID
> 1000, source Windows Sharepoint Services) indicating that it's no
> longer able to call our event handler class, and another error message
> indicating that IIS can't read the web.config file correctly (this is
> an error that there's not the appropriate configSection in the
> web.config despite the fact that it really is there, and it was able
> to read it before it crashes.. we use the configuration management
> application block).
>
> I executed IISSTATE, and here is the result :
>
> Opened log file 'D:\APPLI\iisstate\output\IISState-5672.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Thu Feb 24 17:53:52 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 5672
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
> IIS has crashed...
> Beginning Analysis
> DLL (!FunctionName) that failed:
>
>
>
>
> Thread ID: 21
> System Thread ID: 17d8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.46
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 00 01c1fd04 07a0691b 0x69a1106
> 01 01c1fd14 07a0e981 0x7a0691b
> 02 01c1fd3c 792022f6 0x7a0e981
> 03 01c1fdc8 792023bd mscorsvr!MethodTable::CallFinalizer+0xee
> 04 01c1fddc 79201eb7 mscorsvr!CallFinalizer+0x84
> 05 01c1fe74 79202455 mscorsvr!CallFinalizer+0x245
> 06 01c1fe88 791cce61 mscorsvr!GCHeap::RestartEE+0x73
> 07 01c1fed0 79202428 mscorsvr!Thread::DoADCallBack+0x5c
> 08 01c1ff70 7923db5e mscorsvr!CallFinalizer+0x2ea
> 09 01c1ffb8 77e4a990 mscorsvr!GCHeap::FinalizerThreadStart+0x17c
> 0a 01c1ffec 00000000 kernel32!BaseThreadStart+0x34
> Closing open log file D:\APPLI\iisstate\output\IISState-5672.log
> Opened log file 'D:\APPLI\iisstate\output\IISState-5672.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Thu Feb 24 17:55:54 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 5672
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
>
>
> Thread ID: 0
> System Thread ID: 178c
> Kernel Time: 0:0:0.78
> User Time: 0:0:0.15
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 0006fe58 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0006fe5c 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0006fecc 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0006fedc 5a3635ae kernel32!WaitForSingleObject+0xf
> 04 0006feec 5a364d7d w3dt!WP_CONTEXT::RunMainThreadLoop+0xe
> 05 0006fef4 5a3a1d98 w3dt!UlAtqStartListen+0x2d
> 06 0006ff00 5a3a5d54 w3core!W3_SERVER::StartListen+0x8e
> 07 0006ff0c 010017af w3core!UlW3Start+0xea
> 08 0006ff44 0100195e w3wp!wmain+0x236
> 09 0006ffc0 77e4f38c w3wp!wmainCRTStartup+0x12f
> 0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23
>
>
>
>
> Thread ID: 1
> System Thread ID: a74
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 009bfea0 77f4372d SharedUserData!SystemCallStub+0x4
> 01 009bfea4 77f6c86c ntdll!NtWaitForMultipleObjects+0xc
> 02 009bff48 77f6d7f5 ntdll!EtwpWaitForMultipleObjectsEx+0xf7
> 03 009bffb8 77e4a990 ntdll!EtwpEventPump+0x27d
> 04 009bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 2
> System Thread ID: 16e0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 009fff9c 77f4262b SharedUserData!SystemCallStub+0x4
> 01 009fffa0 77f6b5b2 ntdll!NtDelayExecution+0xc
> 02 009fffb8 77e4a990 ntdll!RtlpTimerThread+0x45
> 03 009fffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 3
> System Thread ID: a5c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00a3ff70 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 00a3ff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 00a3ffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
> 03 00a3ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 4
> System Thread ID: 17e4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 00aafe20 77f4313f SharedUserData!SystemCallStub+0x4
> 01 00aafe24 77c57b85 ntdll!NtReplyWaitReceivePortEx+0xc
> 02 00aaff8c 77c60829 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
> 03 00aaff90 77c60771 RPCRT4!RecvLotsaCallsWrapper+0x9
> 04 00aaffb0 77c60857 RPCRT4!BaseCachedThreadRoutine+0x9c
> 05 00aaffb8 77e4a990 RPCRT4!ThreadStartRoutine+0x17
> 06 00aaffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 5
> System Thread ID: 1188
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00aeff10 77f4262b SharedUserData!SystemCallStub+0x4
> 01 00aeff14 77e418ea ntdll!NtDelayExecution+0xc
> 02 00aeff7c 77e416ee kernel32!SleepEx+0x68
> 03 00aeff88 77162501 kernel32!Sleep+0xb
> 04 00aeff94 771625ea ole32!CROIDTable::WorkerThreadLoop+0x12
> 05 00aeff9c 77160000 ole32!CRpcThread::WorkerLoop+0x1e
> 06 00aeffac 77162653 ole32!_imp__InstallApplication (ole32+0x0)
> 07 00aeffb8 77e4a990 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1f
> 08 00aeffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 6
> System Thread ID: 1734
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00caff28 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 00caff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
> 02 00caff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
> 03 00caff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
> 04 00caffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
> 05 00caffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
> 06 00caffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 7
> System Thread ID: a50
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00ceff28 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 00ceff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
> 02 00ceff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
> 03 00ceff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
> 04 00ceffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
> 05 00ceffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
> 06 00ceffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 8
> System Thread ID: 568
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d2ff28 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 00d2ff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
> 02 00d2ff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
> 03 00d2ff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
> 04 00d2ffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
> 05 00d2ffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
> 06 00d2ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 9
> System Thread ID: 155c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.31
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d6ff28 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 00d6ff2c 77e430bc ntdll!ZwRemoveIoCompletion+0xc
> 02 00d6ff58 5a302360 kernel32!GetQueuedCompletionStatus+0x27
> 03 00d6ff90 5a302531 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x31
> 04 00d6ffa4 5a301d27 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x21
> 05 00d6ffb8 77e4a990 W3TP!THREAD_MANAGER::ThreadManagerThread+0x35
> 06 00d6ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 10
> System Thread ID: 1708
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00e2fcec 77f4372d SharedUserData!SystemCallStub+0x4
> 01 00e2fcf0 77f75297 ntdll!NtWaitForMultipleObjects+0xc
> 02 00e2ffb8 77e4a990 ntdll!RtlpWaitThread+0x158
> 03 00e2ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 11
> System Thread ID: d64
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 016eff14 77f43741 SharedUserData!SystemCallStub+0x4
> 01 016eff18 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 016eff88 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 016eff98 5a3a51f7 kernel32!WaitForSingleObject+0xf
> 04 016effb8 77e4a990 w3core!HTTP_COMPRESSION::CompressionThread+0x85
> 05 016effc4 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 12
> System Thread ID: 14ec
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0173fe20 77f4313f SharedUserData!SystemCallStub+0x4
> 01 0173fe24 77c57b85 ntdll!NtReplyWaitReceivePortEx+0xc
> 02 0173ff8c 77c60829 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
> 03 0173ff90 77c60771 RPCRT4!RecvLotsaCallsWrapper+0x9
> 04 0173ffb0 77c60857 RPCRT4!BaseCachedThreadRoutine+0x9c
> 05 0173ffb8 77e4a990 RPCRT4!ThreadStartRoutine+0x17
> 06 0173ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 13
> System Thread ID: 1388
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0177fec4 77f4372d SharedUserData!SystemCallStub+0x4
> 01 0177fec8 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0177ff70 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0177ff88 10001a4c kernel32!WaitForMultipleObjects+0x17
> 04 0177ffb8 77e4a990
> stsfltr!VinclusionManager::ListenerThreadFunc+0x69
> 05 0177ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 14
> System Thread ID: 1298
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0183ff54 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 0183ff58 77e430bc ntdll!ZwRemoveIoCompletion+0xc
> 02 0183ff84 791e4108 kernel32!GetQueuedCompletionStatus+0x27
> 03 0183ffb8 77e4a990
> mscorsvr!ThreadpoolMgr::CompletionPortThreadStart+0x49
> 04 0183ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 15
> System Thread ID: 15f0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0187feb4 77f4262b SharedUserData!SystemCallStub+0x4
> 01 0187feb8 77e418ea ntdll!NtDelayExecution+0xc
> 02 0187ff20 77e416ee kernel32!SleepEx+0x68
> 03 0187ff2c 791be01f kernel32!Sleep+0xb
> 04 0187ffb8 77e4a990 mscorsvr!ThreadpoolMgr::GateThreadStart+0x54
> 05 0187ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 16
> System Thread ID: 16d8
> Kernel Time: 0:0:0.296
> User Time: 0:0:12.125
> Thread Status: Thread is in a WAIT state.
> Thread Type: SQL Query. Possible ASP page
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 018bd668 77f4372d SharedUserData!SystemCallStub+0x4
> 01 018bd66c 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 018bd714 7923cf46 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 018bd7a0 7923d900
> mscorsvr!GCHeap::FinalizerThreadWatchDogHelper+0x110
> 04 018bd7ac 7923d5f0 mscorsvr!GCHeap::FinalizerThreadWatchDog+0x122
> 05 018bd7cc 7923d680 mscorsvr!EEShutDown+0x118
> 06 018bd7d8 7923dac0 mscorsvr!ForceEEShutdown+0x49
> 07 018bd7e4 791795b7 mscorsvr!CorExitProcess+0x58
> 08 018bd7f4 77bc8b3b mscoree!CorExitProcess+0x46
> 09 018bd7fc 77bc8c40 msvcrt!__crtExitProcess+0x25
> 0a 018bd82c 77bc8c99 msvcrt!_cinit+0xce
> 0b 018bd83c 77baefb3 msvcrt!_exit+0xd
> 0c 018bd848 77bc5013 msvcrt!_amsg_exit+0x30
> 0d 018bd850 073d247e msvcrt!_purecall+0x7
> 0e 018bd890 073d255b sqloledb!CMultipleResults::GetResult+0x4d1
> 0f 018bd8c8 070d3b26 sqloledb!CImpIMultipleResults::GetResult+0x3b
> 10 018bd95c 070d3804 oledb32!CMultipleResults::DoGetResult+0x66
> 11 018bd9ac 334074ea oledb32!CMultipleResults::GetResult+0xe4
> 12 018bd9d8 33407dbb stswel!Voledb::GetNextResult+0x36
> 13 018bd9ec 329b07bc stswel!Voledb::GetNextResult+0x12
> 14 018bf104 329b0c4b OWSSVR!CSPRequest::HrRunMondoSproc+0x204
> 15 018bf138 329b24ab OWSSVR!CSPRequest::HrInitAppSession+0xd9
> 16 018bf368 329dd6e8 OWSSVR!CSPRequest::HrOpenSPRequest+0x9e
> 17 018bf3b4 069a0e28 OWSSVR!CSPRequest::GetFile+0x37
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 18 018bf54c 07a041a0 0x69a0e28
> 19 018bf56c 07a01ea1 0x7a041a0
> 1a 018bf5c8 06aff5a8 0x7a01ea1
> 1b 018bf650 069865e0 0x6aff5a8
> 1c 018bf710 791b31e1 0x69865e0
> 1d 018bf71c 791f85b1 mscorsvr!CallDescrWorker+0x30
> 1e 018bf8ec 01e918a2 mscorsvr!COMMember::InvokeMethod+0x95a
> 1f 00000002 00000000 0x1e918a2
>
>
>
>
> Thread ID: 17
> System Thread ID: 6bc
> Kernel Time: 0:0:0.437
> User Time: 0:0:16.93
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 018ff3f0 77f4372d SharedUserData!SystemCallStub+0x4
> 01 018ff3f4 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 018ff49c 7927146c kernel32!WaitForMultipleObjectsEx+0x11a
> 03 018ff4b4 791fd088 mscorsvr!GCHeap::WaitUntilGCComplete+0x30
> 04 018ff4c4 792a22c2 mscorsvr!Thread::RareDisablePreemptiveGC+0xb5
> 05 018ff4d4 019bb1f3 mscorsvr!OnStubScalarTripThread+0x10
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 06 018ff530 07a00470 0x19bb1f3
> 07 018ff5c4 06aff573 0x7a00470
> 08 018ff650 069865e0 0x6aff573
> 09 018ff710 791b31e1 0x69865e0
> 0a 018ff71c 791f85b1 mscorsvr!CallDescrWorker+0x30
> 0b 018ff8ec 01e918a2 mscorsvr!COMMember::InvokeMethod+0x95a
> 0c 00000002 00000000 0x1e918a2
>
>
>
>
> Thread ID: 18
> System Thread ID: 1604
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 019ffe74 77f4372d SharedUserData!SystemCallStub+0x4
> 01 019ffe78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 019fff20 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 019fff38 7922d3f3 kernel32!WaitForMultipleObjects+0x17
> 04 019fffa0 7922d36a mscorsvr!DebuggerRCThread::MainLoop+0x90
> 05 019fffb0 7922f0a4 mscorsvr!DebuggerRCThread::ThreadProc+0x68
> 06 019fffb8 77e4a990 mscorsvr!DebuggerRCThread::ThreadProcStatic+0xb
> 07 019fffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 19
> System Thread ID: e40
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.281
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01b9ff14 77f43741 SharedUserData!SystemCallStub+0x4
> 01 01b9ff18 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 01b9ff88 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 01b9ff98 791fd4d7 kernel32!WaitForSingleObject+0xf
> 04 01b9ffb0 79225136 mscorsvr!gc_heap::gc_thread_function+0x22
> 05 01b9ffb8 77e4a990 mscorsvr!Thread::SetExposedContext+0x28
> 06 01b9ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 20
> System Thread ID: 12a4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.203
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01bdff14 77f43741 SharedUserData!SystemCallStub+0x4
> 01 01bdff18 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 01bdff88 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 01bdff98 791fd4d7 kernel32!WaitForSingleObject+0xf
> 04 01bdffb0 79225136 mscorsvr!gc_heap::gc_thread_function+0x22
> 05 01bdffb8 77e4a990 mscorsvr!Thread::SetExposedContext+0x28
> 06 01bdffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 21
> System Thread ID: 17d8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.46
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 00 01c1fd04 07a0691b 0x69a1106
> 01 01c1fd14 07a0e981 0x7a0691b
> 02 01c1fd3c 792022f6 0x7a0e981
> 03 01c1fdc8 792023bd mscorsvr!MethodTable::CallFinalizer+0xee
> 04 01c1fddc 79201eb7 mscorsvr!CallFinalizer+0x84
> 05 01c1fe74 79202455 mscorsvr!CallFinalizer+0x245
> 06 01c1fe88 791cce61 mscorsvr!GCHeap::RestartEE+0x73
> 07 01c1fed0 79202428 mscorsvr!Thread::DoADCallBack+0x5c
> 08 01c1ff70 7923db5e mscorsvr!CallFinalizer+0x2ea
> 09 01c1ffb8 77e4a990 mscorsvr!GCHeap::FinalizerThreadStart+0x17c
> 0a 01c1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 22
> System Thread ID: 13c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01edff38 77f4262b SharedUserData!SystemCallStub+0x4
> 01 01edff3c 77e418ea ntdll!NtDelayExecution+0xc
> 02 01edffa4 791c066c kernel32!SleepEx+0x68
> 03 01edffb8 77e4a990 mscorsvr!ThreadpoolMgr::TimerThreadStart+0x30
> 04 01edffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 23
> System Thread ID: 12e0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01f2ff54 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 01f2ff58 77e430bc ntdll!ZwRemoveIoCompletion+0xc
> 02 01f2ff84 791e4108 kernel32!GetQueuedCompletionStatus+0x27
> 03 01f2ffb8 77e4a990
> mscorsvr!ThreadpoolMgr::CompletionPortThreadStart+0x49
> 04 01f2ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 24
> System Thread ID: 12b8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0831ff70 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 0831ff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 0831ffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
> 03 0831ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 25
> System Thread ID: 160
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0613fec4 77f4372d SharedUserData!SystemCallStub+0x4
> 01 0613fec8 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0613ff70 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0613ff88 75976644 kernel32!WaitForMultipleObjects+0x17
> 04 0613ffb8 77e4a990 USERENV!NotificationThread+0x5f
> 05 0613ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 26
> System Thread ID: 1258
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 06c0fc74 77f4372d SharedUserData!SystemCallStub+0x4
> 01 06c0fc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 06c0fd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 06c0fd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 06c0fda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
> 05 06c0fe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
> 06 06c0fe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
> 07 06c0ff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
> 08 06c0ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
> 09 06c0ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 0a 06c0ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 27
> System Thread ID: 1584
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 06c9fc74 77f4372d SharedUserData!SystemCallStub+0x4
> 01 06c9fc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 06c9fd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 06c9fd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 06c9fda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
> 05 06c9fe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
> 06 06c9fe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
> 07 06c9ff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
> 08 06c9ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
> 09 06c9ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 0a 06c9ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 28
> System Thread ID: 11c4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 06d2fc74 77f4372d SharedUserData!SystemCallStub+0x4
> 01 06d2fc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 06d2fd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 06d2fd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 06d2fda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
> 05 06d2fe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
> 06 06d2fe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
> 07 06d2ff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
> 08 06d2ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
> 09 06d2ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 0a 06d2ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 29
> System Thread ID: 1634
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 06dbfc74 77f4372d SharedUserData!SystemCallStub+0x4
> 01 06dbfc78 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 06dbfd20 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 06dbfd7c 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 06dbfda4 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
> 05 06dbfe0c 3319b236 ole32!CoWaitForMultipleHandles+0xc5
> 06 06dbfe40 331ce8d0 onetutil!VwaitForMultipleObjects+0xa0
> 07 06dbff80 331ce0ff onetutil!COWSThreadPool::ThreadHandlerProc+0x85
> 08 06dbff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
> 09 06dbffb8 77e4a990 msvcrt!_endthreadex+0x95
> 0a 06dbffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 30
> System Thread ID: 11f4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0702fc88 77f4372d SharedUserData!SystemCallStub+0x4
> 01 0702fc8c 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0702fd34 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0702fd90 77161edd USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 0702fdb8 771d36eb ole32!CCliModalLoop::BlockFn+0x7e
> 05 0702fe20 3319b236 ole32!CoWaitForMultipleHandles+0xc5
> 06 0702fe54 333b9ec0 onetutil!VwaitForMultipleObjects+0xa0
> 07 0702ff80 331ce0ff stswel!VeventManager::ThreadHandlerProc+0xde
> 08 0702ff84 77bc91ed onetutil!COWSThread::CallThreadProc+0x9
> 09 0702ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 0a 0702ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 31
> System Thread ID: 844
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0748ff10 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0748ff14 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0748ff84 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0748ff94 070a38a9 kernel32!WaitForSingleObject+0xf
> 04 0748ffb8 77e4a990 oledb32!ReleaseResourceThread+0x54
> 05 0748ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 32
> System Thread ID: 17f0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 074cff08 77f43741 SharedUserData!SystemCallStub+0x4
> 01 074cff0c 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 074cff7c 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 074cff8c 070a38b9 kernel32!WaitForSingleObject+0xf
> 04 074cffb8 77e4a990 oledb32!ResetResourceThread+0x84
> 05 074cffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 33
> System Thread ID: 1060
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 0750fd04 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0750fd08 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0750fd78 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0750fd88 7561065c kernel32!WaitForSingleObject+0xf
> 04 0750ffb8 77e4a990 comsvcs!PingThread+0xea
> 05 0750ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 34
> System Thread ID: e64
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0815fdf8 77f4372d SharedUserData!SystemCallStub+0x4
> 01 0815fdfc 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0815fea4 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0815febc 333f8e6a kernel32!WaitForMultipleObjects+0x17
> 04 0815ff78 331ced67 stswel!VvirusLiveUpdateThread::t_main+0x135
> 05 0815ff84 77bc91ed onetutil!Vthread::top+0xd
> 06 0815ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 07 0815ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 35
> System Thread ID: 1360
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 082dff70 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 082dff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 082dffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
> 03 082dffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 36
> System Thread ID: 1328
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 069eff70 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 069eff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 069effb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
> 03 069effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 37
> System Thread ID: 738
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 060fff70 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 060fff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 060fffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
> 03 060fffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 38
> System Thread ID: 1294
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0885ff10 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0885ff14 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0885ff84 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0885ff94 791d3281 kernel32!WaitForSingleObject+0xf
> 04 0885ffb8 77e4a990 mscorsvr!ThreadpoolMgr::WorkerThreadStart+0x3a
> 05 0885ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Closing open log file D:\APPLI\iisstate\output\IISState-5672.log
>
>
> As I see that there was crashes with sqloledb.dll and oledb32.dll, I
> wonder if there is a problem about our SQL server machine. The
> configuration is : one frontend WSS+SPS 2003 server, and another SQL
> Server dedicated machine.
> Do you have any idea ?
> Thanks in advance !
> Stephane Baudet.

Re: IIS Crashes with a WSS event handler

Hi Pat, thanks for your reply.
I have done another IISState reporting with a dump. It's a 143Mb file,
and even 30Mb after zipping it.
How can I send it to you ? Please write me directly at
bodzebod@hotmail.com.
Thanks in advance !
Stephane Baudet

"Pat [MSFT]" wrote in message news:<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>...
> The problem isn't in SQL (or any other DB).
>
> The IISState crash was in managed code that was being cleaned up (i.e. the
> Finalizer was running). IISState wasn't able to get the executing .net
> code. There may be other problems as well.
>
> Next time run IISState with the same flags, but use -d as well to create a
> dump. Post the log file(s) and we'll see if either IISState cathes the next
> one or if we will need to review the dumps instead.
>
>
> Pat
>

Re: IIS Crashes with a WSS event handler

You can do a first pass yourself by following these steps:

Review the IISState Log:
It should say, at the to that a thread has crashed. Note the thread number
(e.g. thread 12).

1) Download the debugging pack (www.microsoft.com/ddk/debugging) - We update
it a lot, so even if you already have it, verify that you have the latest.
2) Create a symbols directory (e.g. c:\symbols
3) Run WinDBG and open the dump file ()
4) Once the dump is opened, type: .sympath
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
5) Type .reload
6) Type ~12s (substitute the thread number noted from the iisstate
log)
7) Type !\clr10\sos.ClrStack

Post the output from step 7.

Pat



"Stephane Baudet" wrote in message
news:1526cbac.0502280138.4e5c8313@posting.google.com...
> Hi Pat, thanks for your reply.
> I have done another IISState reporting with a dump. It's a 143Mb file,
> and even 30Mb after zipping it.
> How can I send it to you ? Please write me directly at
> bodzebod@hotmail.com.
> Thanks in advance !
> Stephane Baudet
>
> "Pat [MSFT]" wrote in message
> news:<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>...
>> The problem isn't in SQL (or any other DB).
>>
>> The IISState crash was in managed code that was being cleaned up (i.e.
>> the
>> Finalizer was running). IISState wasn't able to get the executing .net
>> code. There may be other problems as well.
>>
>> Next time run IISState with the same flags, but use -d as well to create
>> a
>> dump. Post the log file(s) and we'll see if either IISState cathes the
>> next
>> one or if we will need to review the dumps instead.
>>
>>
>> Pat
>>

Re: IIS Crashes with a WSS event handler

Hi Pat, I've first tried to perform what you said but I kept having
the following error message :

0:018> !\clr10\sos.ClrStack
The call to LoadLibrary(\clr10\sos) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.

After having verified that I do get the symbols, I found another
thread in newsgroups where you previously replied to somebody else
about this issue.
My code is executed on Windows Server 2003, and therefore have the
..NET runtime 1.1, and not 1.0.
So I copied the sos.dll located at
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322 to c:\ and executed the
command : !c:\sos.ClrStack , and I got the code that crashed !

Here is the complete output :

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\APPLI\iisstate\output\1836-1109583069.dmp]
User Mini Dump File with Full Memory: Only application data is
available

Windows Server 2003 Version 3790 MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Debug session time: Mon Feb 28 10:31:10.000 2005 (GMT+1)
System Uptime: 4 days 18:40:27.281
Process Uptime: 0 days 0:03:00.000
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols;c: \windows\symbols
Executable search path is:
............................................................ ............................................................ ............
(72c.1030): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
edi=01bdfe94
eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
06ac096a 3b10 cmp edx,[eax]
ds:0023:00000000=????????
0:018> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
0:018> .reload
0:018> ~18s
eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
edi=01bdfe94
eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
06ac096a 3b10 cmp edx,[eax]
ds:0023:00000000=????????
0:018> !c:\sos.ClrStack
succeeded
Loaded Son of Strike data table version 5 from
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
Thread 18
ESP EIP
01bdfcc4 06ac096a [FRAME: ComPlusMethodFrameStandalone] [DEFAULT]
[hasThis] Void Microsoft.SharePoint.Library.SPRequestInternalClass.ReleaseR esources()
01bdfcd4 078c696f [DEFAULT] [hasThis] Void
Microsoft.SharePoint.Library.a.a()
at [+0x2f] [+0xb]
01bdfd0c 078c691b [DEFAULT] [hasThis] Void
Microsoft.SharePoint.SPWeb.Close()
at [+0x1b] [+0x18]
01bdfd1c 078cf381 [DEFAULT] [hasThis] Void
SPWebServiceForWorkflow.SPWorkflow.Finalize()
at [+0x29] [+0x13]
01bdfe94 792022f6 [FRAME: ContextTransitionFrame]
01bdfef0 792022f6 [FRAME: GCFrame]


I see where it can crash in my code now. I'll try to see if I can
handle it better and I'll keep you informed.
Thanks a lot !! See you !
Stephane Baudet

"Pat [MSFT]" wrote in message news:...
> You can do a first pass yourself by following these steps:
>
> Review the IISState Log:
> It should say, at the to that a thread has crashed. Note the thread number
> (e.g. thread 12).
>
> 1) Download the debugging pack (www.microsoft.com/ddk/debugging) - We update
> it a lot, so even if you already have it, verify that you have the latest.
> 2) Create a symbols directory (e.g. c:\symbols
> 3) Run WinDBG and open the dump file ()
> 4) Once the dump is opened, type: .sympath
> srv*c:\symbols*http://msdl.microsoft.com/download/symbols
> 5) Type .reload
> 6) Type ~12s (substitute the thread number noted from the iisstate
> log)
> 7) Type !\clr10\sos.ClrStack
>
> Post the output from step 7.
>
> Pat
>
>
>
> "Stephane Baudet" wrote in message
> news:1526cbac.0502280138.4e5c8313@posting.google.com...
> > Hi Pat, thanks for your reply.
> > I have done another IISState reporting with a dump. It's a 143Mb file,
> > and even 30Mb after zipping it.
> > How can I send it to you ? Please write me directly at
> > bodzebod@hotmail.com.
> > Thanks in advance !
> > Stephane Baudet
> >
> > "Pat [MSFT]" wrote in message
> > news:<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>...
> >> The problem isn't in SQL (or any other DB).
> >>
> >> The IISState crash was in managed code that was being cleaned up (i.e.
> >> the
> >> Finalizer was running). IISState wasn't able to get the executing .net
> >> code. There may be other problems as well.
> >>
> >> Next time run IISState with the same flags, but use -d as well to create
> >> a
> >> dump. Post the log file(s) and we'll see if either IISState cathes the
> >> next
> >> one or if we will need to review the dumps instead.
> >>
> >>
> >> Pat
> >>

Re: IIS Crashes with a WSS event handler

Well, eventually, I don't see what's the problem in my code. I didn't
override the Finalize() method.
I think the microsoft sharepoint team would be able to reply, do you
think so ?
Stephane Baudet.


From: bodzebod@hotmail.com (Stephane Baudet)
Newsgroups: microsoft.public.inetserver.iis
Subject: Re: IIS Crashes with a WSS event handler
References: <1526cbac.0502250111.26376e70@posting.google.com>
<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>
<1526cbac.0502280138.4e5c8313@posting.google.com>

NNTP-Posting-Host: 195.6.59.36
Message-ID: <1526cbac.0503010107.33c41ac6@posting.google.com>

Hi Pat, I've first tried to perform what you said but I kept having
the following error message :

0:018> !\clr10\sos.ClrStack
The call to LoadLibrary(\clr10\sos) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.

After having verified that I do get the symbols, I found another
thread in newsgroups where you previously replied to somebody else
about this issue.
My code is executed on Windows Server 2003, and therefore have the
..NET runtime 1.1, and not 1.0.
So I copied the sos.dll located at
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322 to c:\ and executed the
command : !c:\sos.ClrStack , and I got the code that crashed !

Here is the complete output :

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\APPLI\iisstate\output\1836-1109583069.dmp]
User Mini Dump File with Full Memory: Only application data is
available

Windows Server 2003 Version 3790 MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Debug session time: Mon Feb 28 10:31:10.000 2005 (GMT+1)
System Uptime: 4 days 18:40:27.281
Process Uptime: 0 days 0:03:00.000
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols;c: \windows\symbols
Executable search path is:
............................................................ ............................................................ ............
(72c.1030): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
edi=01bdfe94
eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
06ac096a 3b10 cmp edx,[eax]
ds:0023:00000000=????????
0:018> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
0:018> .reload
0:018> ~18s
eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
edi=01bdfe94
eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
06ac096a 3b10 cmp edx,[eax]
ds:0023:00000000=????????
0:018> !c:\sos.ClrStack
succeeded
Loaded Son of Strike data table version 5 from
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
Thread 18
ESP EIP
01bdfcc4 06ac096a [FRAME: ComPlusMethodFrameStandalone] [DEFAULT]
[hasThis] Void
Microsoft.SharePoint.Library.SPRequestInternalClass.ReleaseR esources()
01bdfcd4 078c696f [DEFAULT] [hasThis] Void
Microsoft.SharePoint.Library.a.a()
at [+0x2f] [+0xb]
01bdfd0c 078c691b [DEFAULT] [hasThis] Void
Microsoft.SharePoint.SPWeb.Close()
at [+0x1b] [+0x18]
01bdfd1c 078cf381 [DEFAULT] [hasThis] Void
SPWebServiceForWorkflow.SPWorkflow.Finalize()
at [+0x29] [+0x13]
01bdfe94 792022f6 [FRAME: ContextTransitionFrame]
01bdfef0 792022f6 [FRAME: GCFrame]


I see where it can crash in my code now. I'll try to see if I can
handle it better and I'll keep you informed.
Thanks a lot !! See you !
Stephane Baudet

"Pat [MSFT]" wrote in message
news:...
> You can do a first pass yourself by following these steps:
>
> Review the IISState Log:
> It should say, at the to that a thread has crashed. Note the thread number
> (e.g. thread 12).
>
> 1) Download the debugging pack (www.microsoft.com/ddk/debugging) - We update
> it a lot, so even if you already have it, verify that you have the latest.
> 2) Create a symbols directory (e.g. c:\symbols
> 3) Run WinDBG and open the dump file ()
> 4) Once the dump is opened, type: .sympath
> srv*c:\symbols*http://msdl.microsoft.com/download/symbols
> 5) Type .reload
> 6) Type ~12s (substitute the thread number noted from the iisstate
> log)
> 7) Type !\clr10\sos.ClrStack
>
> Post the output from step 7.
>
> Pat
>
>
>
> "Stephane Baudet" wrote in message
> news:1526cbac.0502280138.4e5c8313@posting.google.com...
> > Hi Pat, thanks for your reply.
> > I have done another IISState reporting with a dump. It's a 143Mb file,
> > and even 30Mb after zipping it.
> > How can I send it to you ? Please write me directly at
> > bodzebod@hotmail.com.
> > Thanks in advance !
> > Stephane Baudet
> >
> > "Pat [MSFT]" wrote in message
> > news:<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>...
> >> The problem isn't in SQL (or any other DB).
> >>
> >> The IISState crash was in managed code that was being cleaned up (i.e.
> >> the
> >> Finalizer was running). IISState wasn't able to get the executing .net
> >> code. There may be other problems as well.
> >>
> >> Next time run IISState with the same flags, but use -d as well to create
> >> a
> >> dump. Post the log file(s) and we'll see if either IISState cathes the
> >> next
> >> one or if we will need to review the dumps instead.
> >>
> >>
> >> Pat
> >>

Re: IIS Crashes with a WSS event handler

Well, last word ;) I located the feature that make iis crash and we
were wondering if we were to remove it as it is quite slow (it seems
to consume a lot of resources).
As for now, thanks to your help, I proved that it also make IIS crash,
so we did decided to remove it definitively.
So everything's ok now. Thanks again for your help !
Stephane Baudet


From: bodzebod@hotmail.com (Stephane Baudet)
Newsgroups: microsoft.public.inetserver.iis
Subject: Re: IIS Crashes with a WSS event handler
References: <1526cbac.0502250111.26376e70@posting.google.com>
<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>
<1526cbac.0502280138.4e5c8313@posting.google.com>

NNTP-Posting-Host: 195.6.59.36
Message-ID: <1526cbac.0503010116.2ebaa3e9@posting.google.com>

Well, eventually, I don't see what's the problem in my code. I didn't
override the Finalize() method.
I think the microsoft sharepoint team would be able to reply, do you
think so ?
Stephane Baudet.


From: bodzebod@hotmail.com (Stephane Baudet)
Newsgroups: microsoft.public.inetserver.iis
Subject: Re: IIS Crashes with a WSS event handler
References: <1526cbac.0502250111.26376e70@posting.google.com>
<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>
<1526cbac.0502280138.4e5c8313@posting.google.com>

NNTP-Posting-Host: 195.6.59.36
Message-ID: <1526cbac.0503010107.33c41ac6@posting.google.com>

Hi Pat, I've first tried to perform what you said but I kept having
the following error message :

0:018> !\clr10\sos.ClrStack
The call to LoadLibrary(\clr10\sos) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.

After having verified that I do get the symbols, I found another
thread in newsgroups where you previously replied to somebody else
about this issue.
My code is executed on Windows Server 2003, and therefore have the
..NET runtime 1.1, and not 1.0.
So I copied the sos.dll located at
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322 to c:\ and executed the
command : !c:\sos.ClrStack , and I got the code that crashed !

Here is the complete output :

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\APPLI\iisstate\output\1836-1109583069.dmp]
User Mini Dump File with Full Memory: Only application data is
available

Windows Server 2003 Version 3790 MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Debug session time: Mon Feb 28 10:31:10.000 2005 (GMT+1)
System Uptime: 4 days 18:40:27.281
Process Uptime: 0 days 0:03:00.000
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols;c: \windows\symbols
Executable search path is:
............................................................ ............................................................ ............
(72c.1030): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
edi=01bdfe94
eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
06ac096a 3b10 cmp edx,[eax]
ds:0023:00000000=????????
0:018> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
0:018> .reload
0:018> ~18s
eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
edi=01bdfe94
eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
06ac096a 3b10 cmp edx,[eax]
ds:0023:00000000=????????
0:018> !c:\sos.ClrStack
succeeded
Loaded Son of Strike data table version 5 from
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
Thread 18
ESP EIP
01bdfcc4 06ac096a [FRAME: ComPlusMethodFrameStandalone] [DEFAULT]
[hasThis] Void
Microsoft.SharePoint.Library.SPRequestInternalClass.ReleaseR esources()
01bdfcd4 078c696f [DEFAULT] [hasThis] Void
Microsoft.SharePoint.Library.a.a()
at [+0x2f] [+0xb]
01bdfd0c 078c691b [DEFAULT] [hasThis] Void
Microsoft.SharePoint.SPWeb.Close()
at [+0x1b] [+0x18]
01bdfd1c 078cf381 [DEFAULT] [hasThis] Void
SPWebServiceForWorkflow.SPWorkflow.Finalize()
at [+0x29] [+0x13]
01bdfe94 792022f6 [FRAME: ContextTransitionFrame]
01bdfef0 792022f6 [FRAME: GCFrame]


I see where it can crash in my code now. I'll try to see if I can
handle it better and I'll keep you informed.
Thanks a lot !! See you !
Stephane Baudet

"Pat [MSFT]" wrote in message
news:...
> You can do a first pass yourself by following these steps:
>
> Review the IISState Log:
> It should say, at the to that a thread has crashed. Note the thread number
> (e.g. thread 12).
>
> 1) Download the debugging pack (www.microsoft.com/ddk/debugging) - We update
> it a lot, so even if you already have it, verify that you have the latest.
> 2) Create a symbols directory (e.g. c:\symbols
> 3) Run WinDBG and open the dump file ()
> 4) Once the dump is opened, type: .sympath
> srv*c:\symbols*http://msdl.microsoft.com/download/symbols
> 5) Type .reload
> 6) Type ~12s (substitute the thread number noted from the iisstate
> log)
> 7) Type !\clr10\sos.ClrStack
>
> Post the output from step 7.
>
> Pat
>
>
>
> "Stephane Baudet" wrote in message
> news:1526cbac.0502280138.4e5c8313@posting.google.com...
> > Hi Pat, thanks for your reply.
> > I have done another IISState reporting with a dump. It's a 143Mb file,
> > and even 30Mb after zipping it.
> > How can I send it to you ? Please write me directly at
> > bodzebod@hotmail.com.
> > Thanks in advance !
> > Stephane Baudet
> >
> > "Pat [MSFT]" wrote in message
> > news:<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>...
> >> The problem isn't in SQL (or any other DB).
> >>
> >> The IISState crash was in managed code that was being cleaned up (i.e.
> >> the
> >> Finalizer was running). IISState wasn't able to get the executing .net
> >> code. There may be other problems as well.
> >>
> >> Next time run IISState with the same flags, but use -d as well to create
> >> a
> >> dump. Post the log file(s) and we'll see if either IISState cathes the
> >> next
> >> one or if we will need to review the dumps instead.
> >>
> >>
> >> Pat
> >>

Re: IIS Crashes with a WSS event handler

This is a crash in the sharepoint code (i.e. a bug). You will need to
contact MS-Support and see if there is a fix.

Pat

"Stephane Baudet" wrote in message
news:1526cbac.0503010107.33c41ac6@posting.google.com...
> Hi Pat, I've first tried to perform what you said but I kept having
> the following error message :
>
> 0:018> !\clr10\sos.ClrStack
> The call to LoadLibrary(\clr10\sos) failed, Win32 error 2
> "The system cannot find the file specified."
> Please check your debugger configuration and/or network access.
>
> After having verified that I do get the symbols, I found another
> thread in newsgroups where you previously replied to somebody else
> about this issue.
> My code is executed on Windows Server 2003, and therefore have the
> .NET runtime 1.1, and not 1.0.
> So I copied the sos.dll located at
> C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322 to c:\ and executed the
> command : !c:\sos.ClrStack , and I got the code that crashed !
>
> Here is the complete output :
>
> Microsoft (R) Windows Debugger Version 6.4.0007.2
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [D:\APPLI\iisstate\output\1836-1109583069.dmp]
> User Mini Dump File with Full Memory: Only application data is
> available
>
> Windows Server 2003 Version 3790 MP (2 procs) Free x86 compatible
> Product: Server, suite: TerminalServer SingleUserTS
> Debug session time: Mon Feb 28 10:31:10.000 2005 (GMT+1)
> System Uptime: 4 days 18:40:27.281
> Process Uptime: 0 days 0:03:00.000
> Symbol search path is:
> srv*c:\symbols*http://msdl.microsoft.com/download/symbols;c: \windows\symbols
> Executable search path is:
> ............................................................ ............................................................ ...........
> (72c.1030): Access violation - code c0000005 (!!! second chance !!!)
> eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
> edi=01bdfe94
> eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
> na po nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
> efl=00010206
> 06ac096a 3b10 cmp edx,[eax]
> ds:0023:00000000=????????
> 0:018> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
> Symbol search path is:
> srv*c:\symbols*http://msdl.microsoft.com/download/symbols
> 0:018> .reload
> 0:018> ~18s
> eax=00000000 ebx=000d0650 ecx=06a7be88 edx=00086030 esi=01bdfcc4
> edi=01bdfe94
> eip=06ac096a esp=01bdfca8 ebp=01bdfd04 iopl=0 nv up ei pl nz
> na po nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
> efl=00010206
> 06ac096a 3b10 cmp edx,[eax]
> ds:0023:00000000=????????
> 0:018> !c:\sos.ClrStack
> succeeded
> Loaded Son of Strike data table version 5 from
> "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
> Thread 18
> ESP EIP
> 01bdfcc4 06ac096a [FRAME: ComPlusMethodFrameStandalone] [DEFAULT]
> [hasThis] Void
> Microsoft.SharePoint.Library.SPRequestInternalClass.ReleaseR esources()
> 01bdfcd4 078c696f [DEFAULT] [hasThis] Void
> Microsoft.SharePoint.Library.a.a()
> at [+0x2f] [+0xb]
> 01bdfd0c 078c691b [DEFAULT] [hasThis] Void
> Microsoft.SharePoint.SPWeb.Close()
> at [+0x1b] [+0x18]
> 01bdfd1c 078cf381 [DEFAULT] [hasThis] Void
> SPWebServiceForWorkflow.SPWorkflow.Finalize()
> at [+0x29] [+0x13]
> 01bdfe94 792022f6 [FRAME: ContextTransitionFrame]
> 01bdfef0 792022f6 [FRAME: GCFrame]
>
>
> I see where it can crash in my code now. I'll try to see if I can
> handle it better and I'll keep you informed.
> Thanks a lot !! See you !
> Stephane Baudet
>
> "Pat [MSFT]" wrote in message
> news:...
>> You can do a first pass yourself by following these steps:
>>
>> Review the IISState Log:
>> It should say, at the to that a thread has crashed. Note the thread
>> number
>> (e.g. thread 12).
>>
>> 1) Download the debugging pack (www.microsoft.com/ddk/debugging) - We
>> update
>> it a lot, so even if you already have it, verify that you have the
>> latest.
>> 2) Create a symbols directory (e.g. c:\symbols
>> 3) Run WinDBG and open the dump file ()
>> 4) Once the dump is opened, type: .sympath
>> srv*c:\symbols*http://msdl.microsoft.com/download/symbols
>> 5) Type .reload
>> 6) Type ~12s (substitute the thread number noted from the
>> iisstate
>> log)
>> 7) Type !\clr10\sos.ClrStack
>>
>> Post the output from step 7.
>>
>> Pat
>>
>>
>>
>> "Stephane Baudet" wrote in message
>> news:1526cbac.0502280138.4e5c8313@posting.google.com...
>> > Hi Pat, thanks for your reply.
>> > I have done another IISState reporting with a dump. It's a 143Mb file,
>> > and even 30Mb after zipping it.
>> > How can I send it to you ? Please write me directly at
>> > bodzebod@hotmail.com.
>> > Thanks in advance !
>> > Stephane Baudet
>> >
>> > "Pat [MSFT]" wrote in message
>> > news:<#ua5MWIHFHA.3612@TK2MSFTNGP09.phx.gbl>...
>> >> The problem isn't in SQL (or any other DB).
>> >>
>> >> The IISState crash was in managed code that was being cleaned up (i.e.
>> >> the
>> >> Finalizer was running). IISState wasn't able to get the executing
>> >> .net
>> >> code. There may be other problems as well.
>> >>
>> >> Next time run IISState with the same flags, but use -d as well to
>> >> create
>> >> a
>> >> dump. Post the log file(s) and we'll see if either IISState cathes
>> >> the
>> >> next
>> >> one or if we will need to review the dumps instead.
>> >>
>> >>
>> >> Pat
>> >>

Re: IIS Crashes with a WSS event handler

http://support.microsoft.com/kb/867811

*** Sent via Developersdex http://www.developersdex.com ***