W3SVC counters & w3wp.exe Event Frustration!

ENVIRONMENT:
==========
Windows Server 2003 SE SP-2 / IIS 6.0
Celeron 1.8 GHz 512MB Ram
MySQL 4.1 / PHP 5.1.6

I have separate application pools configured for high traffic and PHP sites.
Other sites that are low traffic and strictly HTML all share the Default
Application Pool.

Although this system is understandably being pushed to it’s resource limits,
everything has been running pretty well for a long time considering. I will
upgrade when I can afford it. In the meantime I must make this system work as
best I can until then.

ISSUES:
=====
I have had the following event warnings and errors for months without
resolve. I have researched this and posted all over the internet and the best
advice I get is to apply a patch that is already present on my system and
included in SP-2. I believe this issue is the underlying cause that is
responsible for other recent performance problems such as high CPU
utilization buy some high traffic PHP sites, one in particular that began
only after a unexpected shutdown on the 9th.

TYPICAL SYSTEM LOG EVENTS Daily & Frequent:
===============================
Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1009
Description:
A process serving application pool 'WEBSITE NAME' terminated unexpectedly.
The process id was '4660'. The process exit code was '0xc0000005'.

TYPICAL APPLICATION LOG EVENTS Daily & Frequent:
==================================
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application w3wp.exe, version 6.0.3790.3959, faulting module
unknown, version 0.0.0.0, fault address 0x01335f90.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Description:
Windows cannot unload your classes registry file - it is still in use by
other applications or services. The file will be unloaded when it is no
longer in use.

Event Type: Error
Event Source: W3CTRS
Event Category: None
Event ID: 2001
Description:
It has taken too long to refresh the W3SVC counters, the stale counters are
being used instead.

TYPICL APPLICATION LOG EVENTS THAT HAPPEN EVERY SEVERAL DAYS Same Events in
same sequence:
===================================================
Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Description:
The configuration information of the performance library
"C:\WINDOWS\system32\aspperf.dll" for the "ASP" service does not match the
trusted performance library information stored in the registry. The functions
in this library will not be treated as trusted.

Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Description:
The configuration information of the performance library
"C:\WINDOWS\system32\infoctrs.dll" for the "InetInfo" service does not match
the trusted performance library information stored in the registry. The
functions in this library will not be treated as trusted.

Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Description:
The configuration information of the performance library
"C:\WINDOWS\system32\perfts.dll" for the "TermService" service does not match
the trusted performance library information stored in the registry. The
functions in this library will not be treated as trusted.

THEN EVENTUALLY ONE OF THESE: And a Crash
===============================
Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1076
Date: 7/9/2007
Time: 7:27:37 AM
Description:
The reason supplied by user SERVER\USER for the last unexpected shutdown of
this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)
Comment: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)

Re: W3SVC counters & w3wp.exe Event Frustration!

The only ones that really matter are the crashes and blue screens. The
others are not relevant to your real issues..

Please first read this blog entry:
http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Diagnose_an_AppPool_Crash.aspx

The causes of your frustration are due to at least two different
things:
1. web application having bugs and crashing
2. server hardware having bugs and blue screening

Unfortunately, you're not going to solve #2 without changing server
hardware. The bluescreen 0x7F with first parameter value of 8,
indicates either faulty hardware or a kernel stack overflow, with the
first one being much more common.

You cannot solve #1 without using debug tools like DebugDiag or
IISDiag (see my blog article) to gather a crash memory dump of the
issue to identify the specific code with the logical error.
Unfortunately, when there are custom applications involved, there is
little chance for anyone to just search the Internet to find the
correct solution and install a patch. The only way to resolve the
issue is to use a tool like DebugDiag or IISDiag to identify the cause
of the crash -- THEN you go searching the internet for fixes of that
cause.

Hopefully, my suggestion makes sense. First figure out exactly what
caused the crash, then look for its resolution. Instead of just
randomly searching the Internet for random resolutions to unknown
crashes.

It's kinda like you go to a doctor to get specific diagnosis and
treatment for an illness, instead of just searching the Internet for
your symptoms and trying all the treatments.

Question: Which one would you actually do onto yourself? Which one are
you doing onto the server? And why do you mistreat your server? Do you
think the server's not going to get back at you for the
mistreatment? ;-)

I vote for getting the crash diagnosed... I'm not promising that this
solves your issues because you may have multiple bugs causing crashes
under heavy load, in which case your choices are to upgrade hardware
to decrease load and chance of hitting the bugs, or to identify and
fix the bugs so that you don't hit them under load. But at least you'd
know what is going on.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//





On Jul 14, 12:16 pm, Jody wrote:
> ENVIRONMENT:
> ==========
> Windows Server 2003 SE SP-2 / IIS 6.0
> Celeron 1.8 GHz 512MB Ram
> MySQL 4.1 / PHP 5.1.6
>
> I have separate application pools configured for high traffic and PHP sites.
> Other sites that are low traffic and strictly HTML all share the Default
> Application Pool.
>
> Although this system is understandably being pushed to it's resource limits,
> everything has been running pretty well for a long time considering. I will
> upgrade when I can afford it. In the meantime I must make this system work as
> best I can until then.
>
> ISSUES:
> =====
> I have had the following event warnings and errors for months without
> resolve. I have researched this and posted all over the internet and the best
> advice I get is to apply a patch that is already present on my system and
> included in SP-2. I believe this issue is the underlying cause that is
> responsible for other recent performance problems such as high CPU
> utilization buy some high traffic PHP sites, one in particular that began
> only after a unexpected shutdown on the 9th.
>
> TYPICAL SYSTEM LOG EVENTS Daily & Frequent:
> ===============================
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1009
> Description:
> A process serving application pool 'WEBSITE NAME' terminated unexpectedly.
> The process id was '4660'. The process exit code was '0xc0000005'.
>
> TYPICAL APPLICATION LOG EVENTS Daily & Frequent:
> ==================================
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Description:
> Faulting application w3wp.exe, version 6.0.3790.3959, faulting module
> unknown, version 0.0.0.0, fault address 0x01335f90.
>
> Event Type: Warning
> Event Source: Userenv
> Event Category: None
> Event ID: 1524
> Description:
> Windows cannot unload your classes registry file - it is still in use by
> other applications or services. The file will be unloaded when it is no
> longer in use.
>
> Event Type: Error
> Event Source: W3CTRS
> Event Category: None
> Event ID: 2001
> Description:
> It has taken too long to refresh the W3SVC counters, the stale counters are
> being used instead.
>
> TYPICL APPLICATION LOG EVENTS THAT HAPPEN EVERY SEVERAL DAYS Same Events in
> same sequence:
> ===================================================
> Event Type: Warning
> Event Source: Perflib
> Event Category: None
> Event ID: 2003
> Description:
> The configuration information of the performance library
> "C:\WINDOWS\system32\aspperf.dll" for the "ASP" service does not match the
> trusted performance library information stored in the registry. The functions
> in this library will not be treated as trusted.
>
> Event Type: Warning
> Event Source: Perflib
> Event Category: None
> Event ID: 2003
> Description:
> The configuration information of the performance library
> "C:\WINDOWS\system32\infoctrs.dll" for the "InetInfo" service does not match
> the trusted performance library information stored in the registry. The
> functions in this library will not be treated as trusted.
>
> Event Type: Warning
> Event Source: Perflib
> Event Category: None
> Event ID: 2003
> Description:
> The configuration information of the performance library
> "C:\WINDOWS\system32\perfts.dll" for the "TermService" service does not match
> the trusted performance library information stored in the registry. The
> functions in this library will not be treated as trusted.
>
> THEN EVENTUALLY ONE OF THESE: And a Crash
> ===============================
> Event Type: Warning
> Event Source: USER32
> Event Category: None
> Event ID: 1076
> Date: 7/9/2007
> Time: 7:27:37 AM
> Description:
> The reason supplied by user SERVER\USER for the last unexpected shutdown of
> this computer is: System Failure: Stop error
> Reason Code: 0x805000f
> Bug ID:
> Bugcheck String: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)
> Comment: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)

Re: W3SVC counters & w3wp.exe Event Frustration!

Dear David,

Thank you for taking the time to post. Your comments are good ones and you
make some very good points. I will work from your advice and look at your
article.

Thanks
Jody

"David Wang" wrote:

> The only ones that really matter are the crashes and blue screens. The
> others are not relevant to your real issues..
>
> Please first read this blog entry:
> http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Diagnose_an_AppPool_Crash.aspx
>
> The causes of your frustration are due to at least two different
> things:
> 1. web application having bugs and crashing
> 2. server hardware having bugs and blue screening
>
> Unfortunately, you're not going to solve #2 without changing server
> hardware. The bluescreen 0x7F with first parameter value of 8,
> indicates either faulty hardware or a kernel stack overflow, with the
> first one being much more common.
>
> You cannot solve #1 without using debug tools like DebugDiag or
> IISDiag (see my blog article) to gather a crash memory dump of the
> issue to identify the specific code with the logical error.
> Unfortunately, when there are custom applications involved, there is
> little chance for anyone to just search the Internet to find the
> correct solution and install a patch. The only way to resolve the
> issue is to use a tool like DebugDiag or IISDiag to identify the cause
> of the crash -- THEN you go searching the internet for fixes of that
> cause.
>
> Hopefully, my suggestion makes sense. First figure out exactly what
> caused the crash, then look for its resolution. Instead of just
> randomly searching the Internet for random resolutions to unknown
> crashes.
>
> It's kinda like you go to a doctor to get specific diagnosis and
> treatment for an illness, instead of just searching the Internet for
> your symptoms and trying all the treatments.
>
> Question: Which one would you actually do onto yourself? Which one are
> you doing onto the server? And why do you mistreat your server? Do you
> think the server's not going to get back at you for the
> mistreatment? ;-)
>
> I vote for getting the crash diagnosed... I'm not promising that this
> solves your issues because you may have multiple bugs causing crashes
> under heavy load, in which case your choices are to upgrade hardware
> to decrease load and chance of hitting the bugs, or to identify and
> fix the bugs so that you don't hit them under load. But at least you'd
> know what is going on.
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //
>
>
>
>
>
> On Jul 14, 12:16 pm, Jody wrote:
> > ENVIRONMENT:
> > ==========
> > Windows Server 2003 SE SP-2 / IIS 6.0
> > Celeron 1.8 GHz 512MB Ram
> > MySQL 4.1 / PHP 5.1.6
> >
> > I have separate application pools configured for high traffic and PHP sites.
> > Other sites that are low traffic and strictly HTML all share the Default
> > Application Pool.
> >
> > Although this system is understandably being pushed to it's resource limits,
> > everything has been running pretty well for a long time considering. I will
> > upgrade when I can afford it. In the meantime I must make this system work as
> > best I can until then.
> >
> > ISSUES:
> > =====
> > I have had the following event warnings and errors for months without
> > resolve. I have researched this and posted all over the internet and the best
> > advice I get is to apply a patch that is already present on my system and
> > included in SP-2. I believe this issue is the underlying cause that is
> > responsible for other recent performance problems such as high CPU
> > utilization buy some high traffic PHP sites, one in particular that began
> > only after a unexpected shutdown on the 9th.
> >
> > TYPICAL SYSTEM LOG EVENTS Daily & Frequent:
> > ===============================
> > Event Type: Warning
> > Event Source: W3SVC
> > Event Category: None
> > Event ID: 1009
> > Description:
> > A process serving application pool 'WEBSITE NAME' terminated unexpectedly.
> > The process id was '4660'. The process exit code was '0xc0000005'.
> >
> > TYPICAL APPLICATION LOG EVENTS Daily & Frequent:
> > ==================================
> > Event Type: Error
> > Event Source: Application Error
> > Event Category: (100)
> > Event ID: 1000
> > Description:
> > Faulting application w3wp.exe, version 6.0.3790.3959, faulting module
> > unknown, version 0.0.0.0, fault address 0x01335f90.
> >
> > Event Type: Warning
> > Event Source: Userenv
> > Event Category: None
> > Event ID: 1524
> > Description:
> > Windows cannot unload your classes registry file - it is still in use by
> > other applications or services. The file will be unloaded when it is no
> > longer in use.
> >
> > Event Type: Error
> > Event Source: W3CTRS
> > Event Category: None
> > Event ID: 2001
> > Description:
> > It has taken too long to refresh the W3SVC counters, the stale counters are
> > being used instead.
> >
> > TYPICL APPLICATION LOG EVENTS THAT HAPPEN EVERY SEVERAL DAYS Same Events in
> > same sequence:
> > ===================================================
> > Event Type: Warning
> > Event Source: Perflib
> > Event Category: None
> > Event ID: 2003
> > Description:
> > The configuration information of the performance library
> > "C:\WINDOWS\system32\aspperf.dll" for the "ASP" service does not match the
> > trusted performance library information stored in the registry. The functions
> > in this library will not be treated as trusted.
> >
> > Event Type: Warning
> > Event Source: Perflib
> > Event Category: None
> > Event ID: 2003
> > Description:
> > The configuration information of the performance library
> > "C:\WINDOWS\system32\infoctrs.dll" for the "InetInfo" service does not match
> > the trusted performance library information stored in the registry. The
> > functions in this library will not be treated as trusted.
> >
> > Event Type: Warning
> > Event Source: Perflib
> > Event Category: None
> > Event ID: 2003
> > Description:
> > The configuration information of the performance library
> > "C:\WINDOWS\system32\perfts.dll" for the "TermService" service does not match
> > the trusted performance library information stored in the registry. The
> > functions in this library will not be treated as trusted.
> >
> > THEN EVENTUALLY ONE OF THESE: And a Crash
> > ===============================
> > Event Type: Warning
> > Event Source: USER32
> > Event Category: None
> > Event ID: 1076
> > Date: 7/9/2007
> > Time: 7:27:37 AM
> > Description:
> > The reason supplied by user SERVER\USER for the last unexpected shutdown of
> > this computer is: System Failure: Stop error
> > Reason Code: 0x805000f
> > Bug ID:
> > Bugcheck String: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)
> > Comment: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)
>
>
>