W3WP Crashing

I am trying to troubleshoot as to why our w3wp process crashes.

Attached is an IISState output. It does not create a log file though unless
I run it without the -sc and -hc options.
In this file all the information except for the last 3 lines is output
immediately.
Then upon the w3wp crashing the last 3 lines are output.
Also when I hit Control-C to end IISState it crashes inetinfo causing it to
restart.
Is this suppose happen?

When the w3wp process crashes we get in the System Event Log:
Source: W3SVC EventID: 1009 A process serving application pool
'DefaultAppPool' terminated unexpectedly. The process id was '508'. The
process exit code was '0xc0000006'.
or
Source: W3SVC EventID: 1011 A process serving application pool
'DefaultAppPool' suffered a fatal communication error with the World Wide
Web Publishing Service. The process id was '3196'. The data field contains
the error number. The data is 0000: 6d 00 07 80

In this particular case the second event is what was generated. However,
most of the time the first event is generated.
When w3wp crashes another one is started to replace it. However, the web
application uses session variables which
are lost on the crash and the user is forced to log into the web application
again which is a nuisance for the users.

Here is the specifics as to what the web application we are using was
running on:
- to 06/26/2004 - Dual 500 MHz with NT4 SP6
06/26/2004 to 03/05/2005 - Dual 2.8 with SBS 2003 Premium
03/05/2005 to present - Dual 3.0 Dual 3.0 with 2003 Web Server

On NT we did not have any issues with the web application at all.
However, the web application is constantly being enhanced and there are more
users using it.

Specifics of the web application is that it is asp pages that use an Access
database.
We have installed the hot fix in the following kb:
http://support.microsoft.com/default.aspx?scid=kb;en-us;8383 06&Product=iis60
On a few occasions we had to restart IIS manually to get the web application
functioning again and so far we have not had this problem show up again.

The web application typically uses the database in the following way:
Const DBConnection = "Provider=Microsoft.Jet.OLEDB.4.0;Data
Source=D:\Database.mdb;"
set cnn = CreateObject("ADODB.Connection")
cnn.Open DBConnection
set RecSet = CreateObject("ADODB.Recordset")
....
RecSet.Close
set RecSet = nothing
cnn.close
set cnn = nothing

Thanks,

Re: W3WP Crashing

Sorry, forgot to attach iisstate information and the news server seems to
not like me posting it.
Here it is inline:

C:\iisstate>iisstate -p 2808 -d -hc
Symbol search path is:
SRV*C:\iisstate\symbols*http://msdl.microsoft.com/downloa
d/symbols

Microsoft (R) Windows Debugger Version 6.2.0013.1
Copyright (c) Microsoft Corporation. All rights reserved.

sxd av
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
*** wait with pending attach
The call to LoadLibrary(exts) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.
Symbol search path is:
SRV*C:\iisstate\symbols*http://msdl.microsoft.com/downloa
d/symbols
Executable search path is:
ModLoad: 01000000 01006000 C:\WINDOWS\system32\inetsrv\inetinfo.exe
ModLoad: 77f40000 77ffa000 C:\WINDOWS\system32\ntdll.dll
ModLoad: 77e40000 77f34000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77ba0000 77bf4000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77da0000 77e30000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77c50000 77cf5000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77d00000 77d8f000 C:\WINDOWS\system32\USER32.dll
ModLoad: 77c00000 77c44000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 64700000 64731000 C:\WINDOWS\system32\inetsrv\IISUTIL.dll
ModLoad: 77160000 77286000 C:\WINDOWS\system32\ole32.dll
ModLoad: 5d760000 5d765000 C:\WINDOWS\system32\inetsrv\rpcref.dll
ModLoad: 647b0000 647d4000 C:\WINDOWS\system32\IisRTL.DLL
ModLoad: 71c00000 71c18000 C:\WINDOWS\system32\WS2_32.dll
ModLoad: 71bf0000 71bf8000 C:\WINDOWS\system32\WS2HELP.dll
ModLoad: 649f0000 649f8000 C:\WINDOWS\system32\inetsrv\iisadmin.dll
ModLoad: 5b890000 5b917000 C:\WINDOWS\system32\VSSAPI.DLL
ModLoad: 76a80000 76a98000 C:\WINDOWS\system32\ATL.DLL
ModLoad: 770e0000 7715d000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 71c40000 71c93000 C:\WINDOWS\system32\NETAPI32.dll
ModLoad: 6e0b0000 6e0bf000 C:\WINDOWS\system32\inetsrv\COADMIN.dll
ModLoad: 71430000 71440000 C:\WINDOWS\system32\ADMWPROX.dll
ModLoad: 648b0000 649ed000 C:\WINDOWS\system32\inetsrv\IISCFG.DLL
ModLoad: 76c60000 76c80000 C:\WINDOWS\system32\NTMARTA.DLL
ModLoad: 76f10000 76f3f000 C:\WINDOWS\system32\WLDAP32.dll
ModLoad: 5ccf0000 5cd00000 C:\WINDOWS\system32\SAMLIB.dll
ModLoad: 76f90000 7700e000 C:\WINDOWS\system32\CLBCatQ.DLL
ModLoad: 77010000 770d6000 C:\WINDOWS\system32\COMRes.dll
ModLoad: 77b90000 77b98000 C:\WINDOWS\system32\VERSION.dll
ModLoad: 620a0000 620d9000 C:\WINDOWS\system32\inetsrv\metadata.dll
ModLoad: 7c340000 7c494000 C:\WINDOWS\system32\msxml3.dll
ModLoad: 77290000 772d9000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 70c60000 70cb4000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.WinHTTP_659
5b64144ccf1df_5.1.0.0_x-ww_E0651936\WINHTTP.dll
ModLoad: 0ffd0000 0fffd000 C:\WINDOWS\system32\rsaenh.dll
ModLoad: 76b70000 76b7b000 C:\WINDOWS\system32\PSAPI.DLL
ModLoad: 77380000 77b5f000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 70ad0000 70bb6000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Cont
rols_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\comctl32.dll
ModLoad: 761b0000 76248000 C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 76190000 761a2000 C:\WINDOWS\system32\MSASN1.dll
ModLoad: 5b630000 5b63d000 C:\WINDOWS\system32\inetsrv\svcext.dll
ModLoad: 71f60000 71f64000 C:\WINDOWS\system32\Security.dll
ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\SECUR32.DLL
ModLoad: 64830000 64840000 C:\WINDOWS\system32\IISMAP.dll
ModLoad: 5a120000 5a130000 C:\WINDOWS\system32\inetsrv\wamreg.dll
ModLoad: 76ad0000 76b0e000 C:\WINDOWS\system32\es.dll
ModLoad: 76300000 76514000 C:\WINDOWS\system32\msi.dll
(af8.878): Unknown exception - code 800706bf (first chance)
(af8.9b0): Unknown exception - code 800706ba (first chance)
(af8.878): Unknown exception - code 800706ba (first chance)

Re: W3WP Crashing

Okay I was able to run IISState against the w3wp process and it created a
log and dump file.
They may be obtained here:
http://TemWare.Com/iisstate-log.zip (size 3,397 bytes)
http://TemWare.Com/iisstate-dmp.zip (size 21,104,087 bytes)

I appreciate if anyone can tell me why w3wp is crashing or what my next step
should be to find out.

Thanks,


"MS User" wrote in message
news:zBF%d.7815$Ba6.413@fe37.usenetserver.com...
> I am trying to troubleshoot as to why our w3wp process crashes.
>
> Attached is an IISState output. It does not create a log file though
unless
> I run it without the -sc and -hc options.
> In this file all the information except for the last 3 lines is output
> immediately.
> Then upon the w3wp crashing the last 3 lines are output.
> Also when I hit Control-C to end IISState it crashes inetinfo causing it
to
> restart.
> Is this suppose happen?
>
> When the w3wp process crashes we get in the System Event Log:
> Source: W3SVC EventID: 1009 A process serving application pool
> 'DefaultAppPool' terminated unexpectedly. The process id was '508'. The
> process exit code was '0xc0000006'.
> or
> Source: W3SVC EventID: 1011 A process serving application pool
> 'DefaultAppPool' suffered a fatal communication error with the World Wide
> Web Publishing Service. The process id was '3196'. The data field
contains
> the error number. The data is 0000: 6d 00 07 80
>
> In this particular case the second event is what was generated. However,
> most of the time the first event is generated.
> When w3wp crashes another one is started to replace it. However, the web
> application uses session variables which
> are lost on the crash and the user is forced to log into the web
application
> again which is a nuisance for the users.
>
> Here is the specifics as to what the web application we are using was
> running on:
> - to 06/26/2004 - Dual 500 MHz with NT4 SP6
> 06/26/2004 to 03/05/2005 - Dual 2.8 with SBS 2003 Premium
> 03/05/2005 to present - Dual 3.0 Dual 3.0 with 2003 Web Server
>
> On NT we did not have any issues with the web application at all.
> However, the web application is constantly being enhanced and there are
more
> users using it.
>
> Specifics of the web application is that it is asp pages that use an
Access
> database.
> We have installed the hot fix in the following kb:
>
http://support.microsoft.com/default.aspx?scid=kb;en-us;8383 06&Product=iis60
> On a few occasions we had to restart IIS manually to get the web
application
> functioning again and so far we have not had this problem show up again.
>
> The web application typically uses the database in the following way:
> Const DBConnection = "Provider=Microsoft.Jet.OLEDB.4.0;Data
> Source=D:\Database.mdb;"
> set cnn = CreateObject("ADODB.Connection")
> cnn.Open DBConnection
> set RecSet = CreateObject("ADODB.Recordset")
> ...
> RecSet.Close
> set RecSet = nothing
> cnn.close
> set cnn = nothing
>
> Thanks,
>
>
>

Re: W3WP Crashing

Just wondering if anyone can shed any light as to the crashes.
I saw that a few people have downloaded the log.
It is driving us crazy as prior to 2003 we had no problems at all.
Again the log file is http://temware.com/iisstate-log.zip
Looking at the log myself I see this in the thread that caused the crash.
WARNING: Frame IP not in any known module. Following frames may be wrong.
I've read some stuff about heap corruption and this message would seem to
indicate that.
I also saw that you would then have to debug the dump file.
Can anyone point me to the steps to do this?

I have also produced a log file before a crash and no threads contain this
warning.
So now I am going to do a log right before a crash and then a log when it
crashes to see what the thread was doing prior.

Thanks,


"MS User" wrote in message
news:zBF%d.7815$Ba6.413@fe37.usenetserver.com...
> I am trying to troubleshoot as to why our w3wp process crashes.
>
> Attached is an IISState output. It does not create a log file though
unless
> I run it without the -sc and -hc options.
> In this file all the information except for the last 3 lines is output
> immediately.
> Then upon the w3wp crashing the last 3 lines are output.
> Also when I hit Control-C to end IISState it crashes inetinfo causing it
to
> restart.
> Is this suppose happen?
>
> When the w3wp process crashes we get in the System Event Log:
> Source: W3SVC EventID: 1009 A process serving application pool
> 'DefaultAppPool' terminated unexpectedly. The process id was '508'. The
> process exit code was '0xc0000006'.
> or
> Source: W3SVC EventID: 1011 A process serving application pool
> 'DefaultAppPool' suffered a fatal communication error with the World Wide
> Web Publishing Service. The process id was '3196'. The data field
contains
> the error number. The data is 0000: 6d 00 07 80
>
> In this particular case the second event is what was generated. However,
> most of the time the first event is generated.
> When w3wp crashes another one is started to replace it. However, the web
> application uses session variables which
> are lost on the crash and the user is forced to log into the web
application
> again which is a nuisance for the users.
>
> Here is the specifics as to what the web application we are using was
> running on:
> - to 06/26/2004 - Dual 500 MHz with NT4 SP6
> 06/26/2004 to 03/05/2005 - Dual 2.8 with SBS 2003 Premium
> 03/05/2005 to present - Dual 3.0 Dual 3.0 with 2003 Web Server
>
> On NT we did not have any issues with the web application at all.
> However, the web application is constantly being enhanced and there are
more
> users using it.
>
> Specifics of the web application is that it is asp pages that use an
Access
> database.
> We have installed the hot fix in the following kb:
>
http://support.microsoft.com/default.aspx?scid=kb;en-us;8383 06&Product=iis60
> On a few occasions we had to restart IIS manually to get the web
application
> functioning again and so far we have not had this problem show up again.
>
> The web application typically uses the database in the following way:
> Const DBConnection = "Provider=Microsoft.Jet.OLEDB.4.0;Data
> Source=D:\Database.mdb;"
> set cnn = CreateObject("ADODB.Connection")
> cnn.Open DBConnection
> set RecSet = CreateObject("ADODB.Recordset")
> ...
> RecSet.Close
> set RecSet = nothing
> cnn.close
> set cnn = nothing
>
> Thanks,
>
>
>

Re: W3WP Crashing

"MS User" wrote in message
news:jG50e.13$Hj1.0@fe37.usenetserver.com...
> So now I am going to do a log right before a crash and then a log when it
> crashes to see what the thread was doing prior.

Okay I just captured this. Thread 24 was given as the reason for failure.
About 1 minute before the crash the log said:
Thread ID: 24
System Thread ID: c88
Kernel Time: 0:0:1.265
User Time: 0:0:9.78
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 07e0fdcc 77f4372d SharedUserData!SystemCallStub+0x4
01 07e0fdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 07e0fe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
03 07e0fed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 07e0fef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d
05 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3
06 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
07 07e0ffec 00000000 kernel32!BaseThreadStart+0x34

When it crashed the log said:
Thread ID: 24
System Thread ID: c88
Kernel Time: 0:0:1.265
User Time: 0:0:9.78
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 07e0fda4 77d0612f 0x2217147e
01 07e0fdd0 77d069a5 USER32!InternalCallWinProc+0x1b
02 07e0fe48 77d06689 USER32!UserCallWinProcCheckWow+0x151
03 07e0feb0 77d06704 USER32!DispatchMessageWorker+0x327
04 07e0febc 75633854 USER32!DispatchMessageW+0xb
05 07e0fed4 756337ad comsvcs!CSTAQueueLessMessageWork::DoWork+0x45
06 07e0fee8 75633f71 comsvcs!CSTAThread::DoWork+0x14
07 07e0ff04 7563423b comsvcs!CSTAThread::ProcessQueueWork+0x30
08 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x17a
09 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
0a 07e0ffec 00000000 kernel32!BaseThreadStart+0x34

********

All other parts of the log files were identical except a couple threads had
slightly different kernel and user times
and thread 14 at the crash said:
Thread ID: 14
System Thread ID: 244
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** WARNING: Unable to verify checksum for C:\WINDOWS\system32\PDM.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\PDM.DLL -
Thread Status: Thread is in a WAIT state.
Thread Type: PDM (Debugger) Thread.
# ChildEBP RetAddr
00 024efd84 77f4372d SharedUserData!SystemCallStub+0x4
01 024efd88 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 024efe30 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
03 024efe8c 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 024efea8 4a00886c USER32!MsgWaitForMultipleObjects+0x1d
05 024eff8c 4a008a85 PDM+0x886c
06 024effb4 4a008a09 PDM+0x8a85
07 024effb8 77e4a990 PDM+0x8a09
08 024effec 00000000 kernel32!BaseThreadStart+0x34

Before the crash is said the same as above except the Warning and Error line
said:
*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to export symbols
or -

I suppose this is just a because of IISState running.

Re: W3WP Crashing

With IIS6, you should rarely need to restart IIS to get things working.
Recycling the Application Pool that contains the troublesome application
should be sufficient.

At this point, something run by your application is crashing. That's what
the events tell you (the first one, with error 0xc0000005, indicates an
"access violation" [i.e. generic sort of crash]), and the second one with
HRESULT 0x8007006d = Win32 109 = "the pipe has been ended.", which basically
indicates "loss of communication with w3wp.exe" [which could come from a
crash]).

Thread 24 crashed because it was told to make a function call into a piece
of memory that didn't contain any functions. So, it's not exactly the
problem -- it is a symptom -- we need to find either:
1. who told the thread to make that call
2. who corrupted a piece of memory such that the thread made the bad call

I don't have the time right now, but if you retitle this thread as "IISState
Log Analysis Needed" and make the ZIP files available, it would catch Pat's
eye if he has time. Otherwise, you'll need to contact Microsoft PSS for them
to take a look. If the issue ends up as a Microsoft issue, you won't be
charged, but otherwise, you will. Realize that with a jump from NT4 to WS03
is a period of nearly a decade, and some things may have accidentally worked
all this time, or it may be a new bug.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"MS User" wrote in message
news:WK60e.16$Hj1.13@fe37.usenetserver.com...
"MS User" wrote in message
news:jG50e.13$Hj1.0@fe37.usenetserver.com...
> So now I am going to do a log right before a crash and then a log when it
> crashes to see what the thread was doing prior.

Okay I just captured this. Thread 24 was given as the reason for failure.
About 1 minute before the crash the log said:
Thread ID: 24
System Thread ID: c88
Kernel Time: 0:0:1.265
User Time: 0:0:9.78
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 07e0fdcc 77f4372d SharedUserData!SystemCallStub+0x4
01 07e0fdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 07e0fe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
03 07e0fed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 07e0fef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d
05 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3
06 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
07 07e0ffec 00000000 kernel32!BaseThreadStart+0x34

When it crashed the log said:
Thread ID: 24
System Thread ID: c88
Kernel Time: 0:0:1.265
User Time: 0:0:9.78
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 07e0fda4 77d0612f 0x2217147e
01 07e0fdd0 77d069a5 USER32!InternalCallWinProc+0x1b
02 07e0fe48 77d06689 USER32!UserCallWinProcCheckWow+0x151
03 07e0feb0 77d06704 USER32!DispatchMessageWorker+0x327
04 07e0febc 75633854 USER32!DispatchMessageW+0xb
05 07e0fed4 756337ad comsvcs!CSTAQueueLessMessageWork::DoWork+0x45
06 07e0fee8 75633f71 comsvcs!CSTAThread::DoWork+0x14
07 07e0ff04 7563423b comsvcs!CSTAThread::ProcessQueueWork+0x30
08 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x17a
09 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
0a 07e0ffec 00000000 kernel32!BaseThreadStart+0x34

********

All other parts of the log files were identical except a couple threads had
slightly different kernel and user times
and thread 14 at the crash said:
Thread ID: 14
System Thread ID: 244
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** WARNING: Unable to verify checksum for C:\WINDOWS\system32\PDM.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\PDM.DLL -
Thread Status: Thread is in a WAIT state.
Thread Type: PDM (Debugger) Thread.
# ChildEBP RetAddr
00 024efd84 77f4372d SharedUserData!SystemCallStub+0x4
01 024efd88 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
02 024efe30 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
03 024efe8c 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 024efea8 4a00886c USER32!MsgWaitForMultipleObjects+0x1d
05 024eff8c 4a008a85 PDM+0x886c
06 024effb4 4a008a09 PDM+0x8a85
07 024effb8 77e4a990 PDM+0x8a09
08 024effec 00000000 kernel32!BaseThreadStart+0x34

Before the crash is said the same as above except the Warning and Error line
said:
*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to export symbols
or -

I suppose this is just a because of IISState running.

Re: W3WP Crashing

Thanks for the reply David.

I have posted a new message under the subject "IISState Output (For Ken or
any Msft)".

Hopefully, Pat or Ken can take a look.

Thanks again,

Michael Temari
Michael@TemWare.Com

"David Wang [Msft]" wrote in message
news:e4HRe0BMFHA.2988@TK2MSFTNGP14.phx.gbl...
> With IIS6, you should rarely need to restart IIS to get things working.
> Recycling the Application Pool that contains the troublesome application
> should be sufficient.
>
> At this point, something run by your application is crashing. That's what
> the events tell you (the first one, with error 0xc0000005, indicates an
> "access violation" [i.e. generic sort of crash]), and the second one with
> HRESULT 0x8007006d = Win32 109 = "the pipe has been ended.", which
basically
> indicates "loss of communication with w3wp.exe" [which could come from a
> crash]).
>
> Thread 24 crashed because it was told to make a function call into a piece
> of memory that didn't contain any functions. So, it's not exactly the
> problem -- it is a symptom -- we need to find either:
> 1. who told the thread to make that call
> 2. who corrupted a piece of memory such that the thread made the bad call
>
> I don't have the time right now, but if you retitle this thread as
"IISState
> Log Analysis Needed" and make the ZIP files available, it would catch
Pat's
> eye if he has time. Otherwise, you'll need to contact Microsoft PSS for
them
> to take a look. If the issue ends up as a Microsoft issue, you won't be
> charged, but otherwise, you will. Realize that with a jump from NT4 to
WS03
> is a period of nearly a decade, and some things may have accidentally
worked
> all this time, or it may be a new bug.
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
> "MS User" wrote in message
> news:WK60e.16$Hj1.13@fe37.usenetserver.com...
> "MS User" wrote in message
> news:jG50e.13$Hj1.0@fe37.usenetserver.com...
> > So now I am going to do a log right before a crash and then a log when
it
> > crashes to see what the thread was doing prior.
>
> Okay I just captured this. Thread 24 was given as the reason for failure.
> About 1 minute before the crash the log said:
> Thread ID: 24
> System Thread ID: c88
> Kernel Time: 0:0:1.265
> User Time: 0:0:9.78
> Thread Status: Thread is in a WAIT state.
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 07e0fdcc 77f4372d SharedUserData!SystemCallStub+0x4
> 01 07e0fdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 07e0fe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 07e0fed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 07e0fef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d
> 05 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3
> 06 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 07 07e0ffec 00000000 kernel32!BaseThreadStart+0x34
>
> When it crashed the log said:
> Thread ID: 24
> System Thread ID: c88
> Kernel Time: 0:0:1.265
> User Time: 0:0:9.78
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 00 07e0fda4 77d0612f 0x2217147e
> 01 07e0fdd0 77d069a5 USER32!InternalCallWinProc+0x1b
> 02 07e0fe48 77d06689 USER32!UserCallWinProcCheckWow+0x151
> 03 07e0feb0 77d06704 USER32!DispatchMessageWorker+0x327
> 04 07e0febc 75633854 USER32!DispatchMessageW+0xb
> 05 07e0fed4 756337ad comsvcs!CSTAQueueLessMessageWork::DoWork+0x45
> 06 07e0fee8 75633f71 comsvcs!CSTAThread::DoWork+0x14
> 07 07e0ff04 7563423b comsvcs!CSTAThread::ProcessQueueWork+0x30
> 08 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x17a
> 09 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 0a 07e0ffec 00000000 kernel32!BaseThreadStart+0x34
>
> ********
>
> All other parts of the log files were identical except a couple threads
had
> slightly different kernel and user times
> and thread 14 at the crash said:
> Thread ID: 14
> System Thread ID: 244
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** WARNING: Unable to verify checksum for C:\WINDOWS\system32\PDM.DLL
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
for
> C:\WINDOWS\system32\PDM.DLL -
> Thread Status: Thread is in a WAIT state.
> Thread Type: PDM (Debugger) Thread.
> # ChildEBP RetAddr
> 00 024efd84 77f4372d SharedUserData!SystemCallStub+0x4
> 01 024efd88 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 024efe30 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 024efe8c 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 024efea8 4a00886c USER32!MsgWaitForMultipleObjects+0x1d
> 05 024eff8c 4a008a85 PDM+0x886c
> 06 024effb4 4a008a09 PDM+0x8a85
> 07 024effb8 77e4a990 PDM+0x8a09
> 08 024effec 00000000 kernel32!BaseThreadStart+0x34
>
> Before the crash is said the same as above except the Warning and Error
line
> said:
> *** WARNING: Unable to verify checksum for
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> or -
>
> I suppose this is just a because of IISState running.
>
>
>
>

Re: W3WP Crashing

We've seen this before. Thread 24 has crashed b/c a dll has unloaded itself
out from under IIS. If you create a .dmp file and open it with WinDBG you
may get the dll name.


Pat

"MS User" wrote in message
news:WK60e.16$Hj1.13@fe37.usenetserver.com...
> "MS User" wrote in message
> news:jG50e.13$Hj1.0@fe37.usenetserver.com...
>> So now I am going to do a log right before a crash and then a log when it
>> crashes to see what the thread was doing prior.
>
> Okay I just captured this. Thread 24 was given as the reason for failure.
> About 1 minute before the crash the log said:
> Thread ID: 24
> System Thread ID: c88
> Kernel Time: 0:0:1.265
> User Time: 0:0:9.78
> Thread Status: Thread is in a WAIT state.
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 07e0fdcc 77f4372d SharedUserData!SystemCallStub+0x4
> 01 07e0fdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 07e0fe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 07e0fed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 07e0fef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d
> 05 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3
> 06 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 07 07e0ffec 00000000 kernel32!BaseThreadStart+0x34
>
> When it crashed the log said:
> Thread ID: 24
> System Thread ID: c88
> Kernel Time: 0:0:1.265
> User Time: 0:0:9.78
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 00 07e0fda4 77d0612f 0x2217147e
> 01 07e0fdd0 77d069a5 USER32!InternalCallWinProc+0x1b
> 02 07e0fe48 77d06689 USER32!UserCallWinProcCheckWow+0x151
> 03 07e0feb0 77d06704 USER32!DispatchMessageWorker+0x327
> 04 07e0febc 75633854 USER32!DispatchMessageW+0xb
> 05 07e0fed4 756337ad comsvcs!CSTAQueueLessMessageWork::DoWork+0x45
> 06 07e0fee8 75633f71 comsvcs!CSTAThread::DoWork+0x14
> 07 07e0ff04 7563423b comsvcs!CSTAThread::ProcessQueueWork+0x30
> 08 07e0ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x17a
> 09 07e0ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 0a 07e0ffec 00000000 kernel32!BaseThreadStart+0x34
>
> ********
>
> All other parts of the log files were identical except a couple threads
> had
> slightly different kernel and user times
> and thread 14 at the crash said:
> Thread ID: 14
> System Thread ID: 244
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** WARNING: Unable to verify checksum for C:\WINDOWS\system32\PDM.DLL
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\system32\PDM.DLL -
> Thread Status: Thread is in a WAIT state.
> Thread Type: PDM (Debugger) Thread.
> # ChildEBP RetAddr
> 00 024efd84 77f4372d SharedUserData!SystemCallStub+0x4
> 01 024efd88 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 024efe30 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 024efe8c 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 024efea8 4a00886c USER32!MsgWaitForMultipleObjects+0x1d
> 05 024eff8c 4a008a85 PDM+0x886c
> 06 024effb4 4a008a09 PDM+0x8a85
> 07 024effb8 77e4a990 PDM+0x8a09
> 08 024effec 00000000 kernel32!BaseThreadStart+0x34
>
> Before the crash is said the same as above except the Warning and Error
> line
> said:
> *** WARNING: Unable to verify checksum for
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> or -
>
> I suppose this is just a because of IISState running.
>
>
>