Website crash iisstate log help

am 19.10.2007 20:40:42 von tim.cavins

I have a website that runs on the .net 1.1 framework. The site crashes
randomly and I am having difficulty locating the root cause.

I have run iisstate after the most recent crash but I do not know how
to interpret the dump file. The file is below. Any help is
appreciated.

The one that I am looking at is:

Thread ID: 26
System Thread ID: 14cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
-
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
PDB symbol for mscorwks.dll not loaded
failed to load from resource.Failed to load SOS data.
No valid SOS data table found.

The site is supposed to run on the 1.1 framework and that's what it
shows under the ASP.net tab in IIS. We do have another site on the
same server that is running on the 2.0 framework. Could something on
that site be causing this other one to crash or think its supposed to
be using the 2.0 framework?

Opened log file 'C:\iisstate\output\IISState-8104.log'

***********************
Starting new log output
IISState version 3.3.1

Fri Oct 19 14:01:33 2007

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 8104

Note: Thread times are formatted as HH:MM:SS.ms

***********************

Thread ID: 0
System Thread ID: 186c
Kernel Time: 0:0:0.109
User Time: 0:0:0.109
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\ntdll.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\kernel32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for c:\windows\system32\inetsrv\w3dt.dll -
*** ERROR: Module load completed but symbols could not be loaded for c:
\windows\system32\inetsrv\w3wp.exe
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=+0x1b31
03 0006ff44 01001a27 w3wp+0x187c
04 0006ffc0 77e6f23b w3wp+0x1a27
05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209

Thread ID: 1
System Thread ID: 1dec
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
01 0063ffb8 77e64829 ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
+0x301
02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 2
System Thread ID: 1b60
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00ccffb8 77e64829 ntdll!KiFastSystemCallRet
01 00ccffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 3
System Thread ID: 1da0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00d0ffb8 77e64829 ntdll!KiFastSystemCallRet
01 00d0ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 4
System Thread ID: 1b84
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\RPCRT4.dll -
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: *** ERROR: Symbol file could not be found. Defaulted
to export symbols for \\?\C:\WINDOWS\system32\inetsrv\asp.dll -
ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\ole32.dll -
OLE32.dll Symbols not found. Unable to proceed with DCOM check.
Continuing other analysis.

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00d7ff84 77c88792 ntdll!KiFastSystemCallRet
01 00d7ff8c 77c8872d RPCRT4!I_RpcFree+0xbd0
02 00d7ffac 77c7b110 RPCRT4!I_RpcFree+0xb6b
03 00d7ffb8 77e64829 RPCRT4!NdrFullPointerInsertRefId+0x3ba
04 00d7ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 5
System Thread ID: 144
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00dbff74 77e424ed ntdll!KiFastSystemCallRet
01 00dbff84 776bbb0f kernel32!Sleep+0xf
02 00dbffac 776b1704 ole32!CoFreeUnusedLibrariesEx+0x1c0
03 00dbffb8 77e64829 ole32!CoRegisterChannelHook+0x538
04 00dbffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 6
System Thread ID: 124c
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for c:\windows\system32\inetsrv\W3TP.dll -
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00f7ff54 5a30248e ntdll!KiFastSystemCallRet
01 00f7ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
02 00f7ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 00f7ffb8 77e64829 W3TP+0x1da9
04 00f7ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 7
System Thread ID: 1048
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00fbff54 5a30248e ntdll!KiFastSystemCallRet
01 00fbff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
02 00fbffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 00fbffb8 77e64829 W3TP+0x1da9
04 00fbffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 8
System Thread ID: 1bc4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00ffff54 5a30248e ntdll!KiFastSystemCallRet
01 00ffff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
02 00ffffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 00ffffb8 77e64829 W3TP+0x1da9
04 00ffffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 9
System Thread ID: 1bf4
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0104ff54 5a30248e ntdll!KiFastSystemCallRet
01 0104ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
02 0104ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 0104ffb8 77e64829 W3TP+0x1da9
04 0104ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 10
System Thread ID: 10c8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0110ffb8 77e64829 ntdll!KiFastSystemCallRet
01 0110ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 11
System Thread ID: 14d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\MFC42.DLL -
*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\msvcrt.dll -
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 015cfe30 77e61c8d ntdll!KiFastSystemCallRet
01 015cfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
02 015cfe54 73ed70e3 MFC42!Ordinal4168+0x13
03 015cfe64 0150f171 MFC42!Ordinal4167+0x13
04 015cff18 73f122d7 AuthxDB!HouseKeep+0x1e60b
05 015cff84 77bcb530 MFC42!Ordinal1184+0x167
06 015cffb8 77e64829 msvcrt!endthreadex+0xa3
07 015cffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 12
System Thread ID: 174c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0161fe14 77e61c8d ntdll!KiFastSystemCallRet
01 0161fe28 73ed6e63 kernel32!WaitForSingleObject+0x12
02 0161fe38 73ed70e3 MFC42!Ordinal4168+0x13
03 0161fe48 0150f7c1 MFC42!Ordinal4167+0x13
04 0161ff18 73f122d7 AuthxDB!HouseKeep+0x1ec5b
05 0161ff84 77bcb530 MFC42!Ordinal1184+0x167
06 0161ffb8 77e64829 msvcrt!endthreadex+0xa3
07 0161ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 13
System Thread ID: 16ec
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 016dfe30 77e61c8d ntdll!KiFastSystemCallRet
01 016dfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
02 016dfe54 73ed70e3 MFC42!Ordinal4168+0x13
03 016dfe64 0150ffe5 MFC42!Ordinal4167+0x13
04 016dff18 73f122d7 AuthxDB!HouseKeep+0x1f47f
05 016dff84 77bcb530 MFC42!Ordinal1184+0x167
06 016dffb8 77e64829 msvcrt!endthreadex+0xa3
07 016dffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 14
System Thread ID: 950
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for -
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0171fe6c 77e61c8d ntdll!KiFastSystemCallRet
01 0171fe80 73ed6e63 kernel32!WaitForSingleObject+0x12
02 0171fe90 73ed70e3 MFC42!Ordinal4168+0x13
03 0171fea0 1001a13f MFC42!Ordinal4167+0x13
04 0171ff18 73f122d7 authXflt+0x1a13f
05 0171ff84 77bcb530 MFC42!Ordinal1184+0x167
06 0171ffb8 77e64829 msvcrt!endthreadex+0xa3
07 0171ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 15
System Thread ID: b38
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for c:\windows\system32\inetsrv\w3core.dll -
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 01fefaf8 77e61c8d ntdll!KiFastSystemCallRet
01 01fefb0c 5a3b820f kernel32!WaitForSingleObject+0x12
02 01feffb8 77e64829 w3core!W3_FILE_INFO_CACHE::GetFileCache+0xd8bc
03 01feffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 16
System Thread ID: 13a4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

OLE32.dll Symbols not found. Unable to proceed with DCOM check.
Continuing other analysis.

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0202ff84 77c88792 ntdll!KiFastSystemCallRet
01 0202ff8c 77c8872d RPCRT4!I_RpcFree+0xbd0
02 0202ffac 77c7b110 RPCRT4!I_RpcFree+0xb6b
03 0202ffb8 77e64829 RPCRT4!NdrFullPointerInsertRefId+0x3ba
04 0202ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 17
System Thread ID: 8d0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0206ffb8 77e64829 ntdll!KiFastSystemCallRet
01 0206ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 18
System Thread ID: 14bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 02d3ff80 77e61c8d ntdll!KiFastSystemCallRet
01 02d3ff94 709fc803 kernel32!WaitForSingleObject+0x12
02 02d3ffb4 709fc7db asp!GetExtensionVersion+0x2e79
03 02d3ffec 00000000 asp!GetExtensionVersion+0x2e51

Thread ID: 19
System Thread ID: ba8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\USER32.dll -
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0306fec8 7739bbd1 ntdll!KiFastSystemCallRet
01 0306ff24 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 0306ff40 709fb8be USER32!MsgWaitForMultipleObjects+0x1f
03 0306ff84 77bcb530 asp!GetExtensionVersion+0x1f34
04 0306ffb8 77e64829 msvcrt!endthreadex+0xa3
05 0306ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 20
System Thread ID: 1324
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 030aff68 77e61c8d ntdll!KiFastSystemCallRet
01 030aff7c 709fe8ef kernel32!WaitForSingleObject+0x12
02 030affb8 77e64829 asp!GetExtensionVersion+0x4f65
03 030affec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 21
System Thread ID: 16c4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\comsvcs.dll -
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0310ff5c 77e61c8d ntdll!KiFastSystemCallRet
01 0310ff70 4a77921b kernel32!WaitForSingleObject+0x12
02 0310ff84 77bcb530 comsvcs!CoCreateActivity+0x2759
03 0310ffb8 77e64829 msvcrt!endthreadex+0xa3
04 0310ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 22
System Thread ID: 17b0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0314ff54 77e61c8d ntdll!KiFastSystemCallRet
01 0314ff68 4a778cb6 kernel32!WaitForSingleObject+0x12
02 0314ff84 77bcb530 comsvcs!CoCreateActivity+0x21f4
03 0314ffb8 77e64829 msvcrt!endthreadex+0xa3
04 0314ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 23
System Thread ID: ee0
Kernel Time: 0:0:0.125
User Time: 0:0:0.250
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0318fe78 7739bbd1 ntdll!KiFastSystemCallRet
01 0318fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 0318fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
03 0318ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
04 0318ffb8 77e64829 msvcrt!endthreadex+0xa3
05 0318ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 24
System Thread ID: 1030
Kernel Time: 0:0:0.15
User Time: 0:0:0.93
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 031cfe78 7739bbd1 ntdll!KiFastSystemCallRet
01 031cfed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 031cfef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
03 031cff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
04 031cffb8 77e64829 msvcrt!endthreadex+0xa3
05 031cffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 25
System Thread ID: 1574
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0320fe78 7739bbd1 ntdll!KiFastSystemCallRet
01 0320fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 0320fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
03 0320ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
04 0320ffb8 77e64829 msvcrt!endthreadex+0xa3
05 0320ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 26
System Thread ID: 14cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
-
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
PDB symbol for mscorwks.dll not loaded
failed to load from resource.Failed to load SOS data.
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 03a2fedc 77e62fbe ntdll!KiFastSystemCallRet
01 03a2fef8 79f0cf96 kernel32!WaitForMultipleObjects+0x18
02 03a2ff58 79f0cef3 mscorwks!GetIdentityAuthority+0x9d9e
03 03a2ff88 79f0ce36 mscorwks!GetIdentityAuthority+0x9cfb
04 03a2ffb8 77e64829 mscorwks!GetIdentityAuthority+0x9c3e
05 03a2ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 27
System Thread ID: c2c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 05b0fd78 77e62fbe ntdll!KiFastSystemCallRet
01 05b0fd94 79f12341 kernel32!WaitForMultipleObjects+0x18
02 00000003 00000000 mscorwks!IEE+0x2a4b

Thread ID: 28
System Thread ID: c74
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0600ff34 79f66a87 ntdll!KiFastSystemCallRet
01 0600ffb0 79f66a18 mscorwks!GetMetaDataPublicInterfaceFromInternal
+0xa40
02 0600ffec 00000000 mscorwks!GetMetaDataPublicInterfaceFromInternal
+0x9d1

Thread ID: 29
System Thread ID: e4c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\assembly\GAC_32\System.Data
\2.0.0.0__b77a5c561934e089\System.Data.dll -
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0617ff84 65001897 ntdll!KiFastSystemCallRet
01 0617ffb8 77e64829 System_Data!DllBidInitialize+0xe40b
02 0617ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 30
System Thread ID: bac
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0678fd74 77e61c8d ntdll!KiFastSystemCallRet
01 0678fd88 4a756c3b kernel32!WaitForSingleObject+0x12
02 0678ffb8 77e64829 comsvcs!DispManGetContext+0x270
03 0678ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 31
System Thread ID: 1428
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 073cfe78 7739bbd1 ntdll!KiFastSystemCallRet
01 073cfed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 073cfef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
03 073cff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
04 073cffb8 77e64829 msvcrt!endthreadex+0xa3
05 073cffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 32
System Thread ID: 11f8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 075efe28 79f798a6 ntdll!KiFastSystemCallRet
01 062a6348 0880b220 mscorwks!ClrCreateManagedInstance+0xeec
02 062a6348 0880b220 0x880b220
03 79f04514 7a0db6a3 0x880b220
04 7a15dd57 000cc280 mscorwks!CoUninitializeCor+0x78d
05 004002b8 00000000 0xcc280

Thread ID: 33
System Thread ID: 12b8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0762fe20 79f56e05 ntdll!KiFastSystemCallRet
01 0762fe54 79f56dd5 mscorwks!DllGetClassObjectInternal+0x290ad
02 0762fe88 79f409c5 mscorwks!DllGetClassObjectInternal+0x2907d
03 0762ffb8 77e64829 mscorwks!DllGetClassObjectInternal+0x12c6d
04 0762ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 34
System Thread ID: 1028
Kernel Time: 0:0:0.218
User Time: 0:0:2.171
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0766fc74 79e718fd ntdll!KiFastSystemCallRet
01 0766fcb8 79e718c6 mscorwks+0x18fd
02 0766fd08 79e7187c mscorwks+0x18c6
03 0766fd98 79f8b495 mscorwks+0x187c
04 0766fe14 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
05 0766ffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
06 0766ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 35
System Thread ID: d58
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 076efc2c 79e718fd ntdll!KiFastSystemCallRet
01 076efc70 79e718c6 mscorwks+0x18fd
02 076efcc0 79e7187c mscorwks+0x18c6
03 076efd20 00000000 mscorwks+0x187c

Thread ID: 36
System Thread ID: 16e8
Kernel Time: 0:0:0.125
User Time: 0:0:1.578
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 091cfb74 79e718fd ntdll!KiFastSystemCallRet
01 091cfbb8 79e718c6 mscorwks+0x18fd
02 091cfc08 79e7187c mscorwks+0x18c6
03 091cfc98 79f8b495 mscorwks+0x187c
04 091cfd14 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
05 091cffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
06 091cffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 37
System Thread ID: 1770
Kernel Time: 0:0:0.62
User Time: 0:0:0.250
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0964faf4 79e718fd ntdll!KiFastSystemCallRet
01 0964fb38 79e718c6 mscorwks+0x18fd
02 0964fb88 79e7187c mscorwks+0x18c6
03 0964fc18 79f8b495 mscorwks+0x187c
04 0964fc94 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
05 0964ffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
06 0964ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 38
System Thread ID: b78
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Managed Thread. Possible ASP.Net page or other .Net
worker
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0969fa74 79e718fd ntdll!KiFastSystemCallRet
01 0969fab8 79e718c6 mscorwks+0x18fd
02 0969fb08 79e7187c mscorwks+0x18c6
03 0969fb98 79f8b495 mscorwks+0x187c
04 0969fc14 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
05 0969ffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
06 0969ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 39
System Thread ID: b24
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 09ebfe78 7739bbd1 ntdll!KiFastSystemCallRet
01 09ebfed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 09ebfef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
03 09ebff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
04 09ebffb8 77e64829 msvcrt!endthreadex+0xa3
05 09ebffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 40
System Thread ID: 15ec
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 09f1fe78 7739bbd1 ntdll!KiFastSystemCallRet
01 09f1fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 09f1fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
03 09f1ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
04 09f1ffb8 77e64829 msvcrt!endthreadex+0xa3
05 09f1ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 41
System Thread ID: 1748
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 09f9ffb8 77e64829 ntdll!KiFastSystemCallRet
01 09f9ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 42
System Thread ID: 121c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 06f6fe78 7739bbd1 ntdll!KiFastSystemCallRet
01 06f6fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
02 06f6fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
03 06f6ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
04 06f6ffb8 77e64829 msvcrt!endthreadex+0xa3
05 06f6ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 43
System Thread ID: 116c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 09e7ffb8 77e64829 ntdll!KiFastSystemCallRet
01 09e7ffec 00000000 kernel32!GetModuleHandleA+0xdf

Thread ID: 44
System Thread ID: 84
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 09f5ffb8 77e64829 ntdll!KiFastSystemCallRet
01 09f5ffec 00000000 kernel32!GetModuleHandleA+0xdf

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating C:\iisstate\output\8104-1192817316.dmp - mini user dump

*****

Closing open log file C:\iisstate\output\IISState-8104.log

Thanks,

Tim

Re: Website crash iisstate log help

am 19.10.2007 21:03:32 von David Wang

You need to run IISState *before* the crash happens, so that IISState
can catch the crash when it happens to log its results.

Please follow its instructions to configure access to symbols.

The websites using ASP.Net 1.1 and 2.0 should be in different
Application Pools. If not, then that is the problem.

If the websites are in different Application Pools, then they should
not be causing the other to crash or change its .Net Framework
version.

You are running a couple of 3rd party ISAPI Filters and Extensions
(AuthXFlt and AuthXDB) for custom authentication. I consider 3rd party
ISAPI DLLs suspect until proven otherwise.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

On Oct 19, 11:40 am, tim.cav...@gmail.com wrote:
> I have a website that runs on the .net 1.1 framework. The site crashes
> randomly and I am having difficulty locating the root cause.
>
> I have run iisstate after the most recent crash but I do not know how
> to interpret the dump file. The file is below. Any help is
> appreciated.
>
> The one that I am looking at is:
>
> Thread ID: 26
> System Thread ID: 14cc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> -
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> PDB symbol for mscorwks.dll not loaded
> failed to load from resource.Failed to load SOS data.
> No valid SOS data table found.
>
> The site is supposed to run on the 1.1 framework and that's what it
> shows under the ASP.net tab in IIS. We do have another site on the
> same server that is running on the 2.0 framework. Could something on
> that site be causing this other one to crash or think its supposed to
> be using the 2.0 framework?
>
> Opened log file 'C:\iisstate\output\IISState-8104.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Fri Oct 19 14:01:33 2007
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 8104
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
> Thread ID: 0
> System Thread ID: 186c
> Kernel Time: 0:0:0.109
> User Time: 0:0:0.109
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\ntdll.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\kernel32.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for c:\windows\system32\inetsrv\w3dt.dll -
> *** ERROR: Module load completed but symbols could not be loaded for c:
> \windows\system32\inetsrv\w3wp.exe
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
> 01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
> 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=+0x1b31
> 03 0006ff44 01001a27 w3wp+0x187c
> 04 0006ffc0 77e6f23b w3wp+0x1a27
> 05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209
>
> Thread ID: 1
> System Thread ID: 1dec
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
> 01 0063ffb8 77e64829 ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
> +0x301
> 02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 2
> System Thread ID: 1b60
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00ccffb8 77e64829 ntdll!KiFastSystemCallRet
> 01 00ccffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 3
> System Thread ID: 1da0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00d0ffb8 77e64829 ntdll!KiFastSystemCallRet
> 01 00d0ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 4
> System Thread ID: 1b84
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\RPCRT4.dll -
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: *** ERROR: Symbol file could not be found. Defaulted
> to export symbols for \\?\C:\WINDOWS\system32\inetsrv\asp.dll -
> ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\ole32.dll -
> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> Continuing other analysis.
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00d7ff84 77c88792 ntdll!KiFastSystemCallRet
> 01 00d7ff8c 77c8872d RPCRT4!I_RpcFree+0xbd0
> 02 00d7ffac 77c7b110 RPCRT4!I_RpcFree+0xb6b
> 03 00d7ffb8 77e64829 RPCRT4!NdrFullPointerInsertRefId+0x3ba
> 04 00d7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 5
> System Thread ID: 144
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00dbff74 77e424ed ntdll!KiFastSystemCallRet
> 01 00dbff84 776bbb0f kernel32!Sleep+0xf
> 02 00dbffac 776b1704 ole32!CoFreeUnusedLibrariesEx+0x1c0
> 03 00dbffb8 77e64829 ole32!CoRegisterChannelHook+0x538
> 04 00dbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 6
> System Thread ID: 124c
> Kernel Time: 0:0:0.31
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for c:\windows\system32\inetsrv\W3TP.dll -
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00f7ff54 5a30248e ntdll!KiFastSystemCallRet
> 01 00f7ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> 02 00f7ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 00f7ffb8 77e64829 W3TP+0x1da9
> 04 00f7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 7
> System Thread ID: 1048
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.15
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00fbff54 5a30248e ntdll!KiFastSystemCallRet
> 01 00fbff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> 02 00fbffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 00fbffb8 77e64829 W3TP+0x1da9
> 04 00fbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 8
> System Thread ID: 1bc4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00ffff54 5a30248e ntdll!KiFastSystemCallRet
> 01 00ffff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> 02 00ffffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 00ffffb8 77e64829 W3TP+0x1da9
> 04 00ffffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 9
> System Thread ID: 1bf4
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.15
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0104ff54 5a30248e ntdll!KiFastSystemCallRet
> 01 0104ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> 02 0104ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 0104ffb8 77e64829 W3TP+0x1da9
> 04 0104ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 10
> System Thread ID: 10c8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0110ffb8 77e64829 ntdll!KiFastSystemCallRet
> 01 0110ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 11
> System Thread ID: 14d8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\MFC42.DLL -
> *** WARNING: Unable to verify checksum for
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\msvcrt.dll -
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 015cfe30 77e61c8d ntdll!KiFastSystemCallRet
> 01 015cfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> 02 015cfe54 73ed70e3 MFC42!Ordinal4168+0x13
> 03 015cfe64 0150f171 MFC42!Ordinal4167+0x13
> 04 015cff18 73f122d7 AuthxDB!HouseKeep+0x1e60b
> 05 015cff84 77bcb530 MFC42!Ordinal1184+0x167
> 06 015cffb8 77e64829 msvcrt!endthreadex+0xa3
> 07 015cffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 12
> System Thread ID: 174c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0161fe14 77e61c8d ntdll!KiFastSystemCallRet
> 01 0161fe28 73ed6e63 kernel32!WaitForSingleObject+0x12
> 02 0161fe38 73ed70e3 MFC42!Ordinal4168+0x13
> 03 0161fe48 0150f7c1 MFC42!Ordinal4167+0x13
> 04 0161ff18 73f122d7 AuthxDB!HouseKeep+0x1ec5b
> 05 0161ff84 77bcb530 MFC42!Ordinal1184+0x167
> 06 0161ffb8 77e64829 msvcrt!endthreadex+0xa3
> 07 0161ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 13
> System Thread ID: 16ec
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 016dfe30 77e61c8d ntdll!KiFastSystemCallRet
> 01 016dfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> 02 016dfe54 73ed70e3 MFC42!Ordinal4168+0x13
> 03 016dfe64 0150ffe5 MFC42!Ordinal4167+0x13
> 04 016dff18 73f122d7 AuthxDB!HouseKeep+0x1f47f
> 05 016dff84 77bcb530 MFC42!Ordinal1184+0x167
> 06 016dffb8 77e64829 msvcrt!endthreadex+0xa3
> 07 016dffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 14
> System Thread ID: 950
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** WARNING: Unable to verify checksum for
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for -
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0171fe6c 77e61c8d ntdll!KiFastSystemCallRet
> 01 0171fe80 73ed6e63 kernel32!WaitForSingleObject+0x12
> 02 0171fe90 73ed70e3 MFC42!Ordinal4168+0x13
> 03 0171fea0 1001a13f MFC42!Ordinal4167+0x13
> 04 0171ff18 73f122d7 authXflt+0x1a13f
> 05 0171ff84 77bcb530 MFC42!Ordinal1184+0x167
> 06 0171ffb8 77e64829 msvcrt!endthreadex+0xa3
> 07 0171ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 15
> System Thread ID: b38
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for c:\windows\system32\inetsrv\w3core.dll -
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 01fefaf8 77e61c8d ntdll!KiFastSystemCallRet
> 01 01fefb0c 5a3b820f kernel32!WaitForSingleObject+0x12
> 02 01feffb8 77e64829 w3core!W3_FILE_INFO_CACHE::GetFileCache+0xd8bc
> 03 01feffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 16
> System Thread ID: 13a4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> Continuing other analysis.
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0202ff84 77c88792 ntdll!KiFastSystemCallRet
> 01 0202ff8c 77c8872d RPCRT4!I_RpcFree+0xbd0
> 02 0202ffac 77c7b110 RPCRT4!I_RpcFree+0xb6b
> 03 0202ffb8 77e64829 RPCRT4!NdrFullPointerInsertRefId+0x3ba
> 04 0202ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 17
> System Thread ID: 8d0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0206ffb8 77e64829 ntdll!KiFastSystemCallRet
> 01 0206ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 18
> System Thread ID: 14bc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 02d3ff80 77e61c8d ntdll!KiFastSystemCallRet
> 01 02d3ff94 709fc803 kernel32!WaitForSingleObject+0x12
> 02 02d3ffb4 709fc7db asp!GetExtensionVersion+0x2e79
> 03 02d3ffec 00000000 asp!GetExtensionVersion+0x2e51
>
> Thread ID: 19
> System Thread ID: ba8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\USER32.dll -
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0306fec8 7739bbd1 ntdll!KiFastSystemCallRet
> 01 0306ff24 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 0306ff40 709fb8be USER32!MsgWaitForMultipleObjects+0x1f
> 03 0306ff84 77bcb530 asp!GetExtensionVersion+0x1f34
> 04 0306ffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 0306ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 20
> System Thread ID: 1324
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 030aff68 77e61c8d ntdll!KiFastSystemCallRet
> 01 030aff7c 709fe8ef kernel32!WaitForSingleObject+0x12
> 02 030affb8 77e64829 asp!GetExtensionVersion+0x4f65
> 03 030affec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 21
> System Thread ID: 16c4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\comsvcs.dll -
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0310ff5c 77e61c8d ntdll!KiFastSystemCallRet
> 01 0310ff70 4a77921b kernel32!WaitForSingleObject+0x12
> 02 0310ff84 77bcb530 comsvcs!CoCreateActivity+0x2759
> 03 0310ffb8 77e64829 msvcrt!endthreadex+0xa3
> 04 0310ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 22
> System Thread ID: 17b0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0314ff54 77e61c8d ntdll!KiFastSystemCallRet
> 01 0314ff68 4a778cb6 kernel32!WaitForSingleObject+0x12
> 02 0314ff84 77bcb530 comsvcs!CoCreateActivity+0x21f4
> 03 0314ffb8 77e64829 msvcrt!endthreadex+0xa3
> 04 0314ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 23
> System Thread ID: ee0
> Kernel Time: 0:0:0.125
> User Time: 0:0:0.250
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0318fe78 7739bbd1 ntdll!KiFastSystemCallRet
> 01 0318fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 0318fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
> 03 0318ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
> 04 0318ffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 0318ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 24
> System Thread ID: 1030
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.93
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 031cfe78 7739bbd1 ntdll!KiFastSystemCallRet
> 01 031cfed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 031cfef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
> 03 031cff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
> 04 031cffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 031cffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 25
> System Thread ID: 1574
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.31
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0320fe78 7739bbd1 ntdll!KiFastSystemCallRet
> 01 0320fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 0320fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
> 03 0320ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
> 04 0320ffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 0320ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 26
> System Thread ID: 14cc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> -
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> PDB symbol for mscorwks.dll not loaded
> failed to load from resource.Failed to load SOS data.
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 03a2fedc 77e62fbe ntdll!KiFastSystemCallRet
> 01 03a2fef8 79f0cf96 kernel32!WaitForMultipleObjects+0x18
> 02 03a2ff58 79f0cef3 mscorwks!GetIdentityAuthority+0x9d9e
> 03 03a2ff88 79f0ce36 mscorwks!GetIdentityAuthority+0x9cfb
> 04 03a2ffb8 77e64829 mscorwks!GetIdentityAuthority+0x9c3e
> 05 03a2ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 27
> System Thread ID: c2c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 05b0fd78 77e62fbe ntdll!KiFastSystemCallRet
> 01 05b0fd94 79f12341 kernel32!WaitForMultipleObjects+0x18
> 02 00000003 00000000 mscorwks!IEE+0x2a4b
>
> Thread ID: 28
> System Thread ID: c74
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0600ff34 79f66a87 ntdll!KiFastSystemCallRet
> 01 0600ffb0 79f66a18 mscorwks!GetMetaDataPublicInterfaceFromInternal
> +0xa40
> 02 0600ffec 00000000 mscorwks!GetMetaDataPublicInterfaceFromInternal
> +0x9d1
>
> Thread ID: 29
> System Thread ID: e4c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\assembly\GAC_32\System.Data
> \2.0.0.0__b77a5c561934e089\System.Data.dll -
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0617ff84 65001897 ntdll!KiFastSystemCallRet
> 01 0617ffb8 77e64829 System_Data!DllBidInitialize+0xe40b
> 02 0617ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 30
> System Thread ID: bac
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0678fd74 77e61c8d ntdll!KiFastSystemCallRet
> 01 0678fd88 4a756c3b kernel32!WaitForSingleObject+0x12
> 02 0678ffb8 77e64829 comsvcs!DispManGetContext+0x270
> 03 0678ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 31
> System Thread ID: 1428
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.31
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 073cfe78 7739bbd1 ntdll!KiFastSystemCallRet
> 01 073cfed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 073cfef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
> 03 073cff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
> 04 073cffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 073cffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 32
> System Thread ID: 11f8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 075efe28 79f798a6 ntdll!KiFastSystemCallRet
> 01 062a6348 0880b220 mscorwks!ClrCreateManagedInstance+0xeec
> 02 062a6348 0880b220 0x880b220
> 03 79f04514 7a0db6a3 0x880b220
> 04 7a15dd57 000cc280 mscorwks!CoUninitializeCor+0x78d
> 05 004002b8 00000000 0xcc280
>
> Thread ID: 33
> System Thread ID: 12b8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0762fe20 79f56e05 ntdll!KiFastSystemCallRet
> 01 0762fe54 79f56dd5 mscorwks!DllGetClassObjectInternal+0x290ad
> 02 0762fe88 79f409c5 mscorwks!DllGetClassObjectInternal+0x2907d
> 03 0762ffb8 77e64829 mscorwks!DllGetClassObjectInternal+0x12c6d
> 04 0762ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 34
> System Thread ID: 1028
> Kernel Time: 0:0:0.218
> User Time: 0:0:2.171
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0766fc74 79e718fd ntdll!KiFastSystemCallRet
> 01 0766fcb8 79e718c6 mscorwks+0x18fd
> 02 0766fd08 79e7187c mscorwks+0x18c6
> 03 0766fd98 79f8b495 mscorwks+0x187c
> 04 0766fe14 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
> 05 0766ffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
> 06 0766ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 35
> System Thread ID: d58
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 076efc2c 79e718fd ntdll!KiFastSystemCallRet
> 01 076efc70 79e718c6 mscorwks+0x18fd
> 02 076efcc0 79e7187c mscorwks+0x18c6
> 03 076efd20 00000000 mscorwks+0x187c
>
> Thread ID: 36
> System Thread ID: 16e8
> Kernel Time: 0:0:0.125
> User Time: 0:0:1.578
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 091cfb74 79e718fd ntdll!KiFastSystemCallRet
> 01 091cfbb8 79e718c6 mscorwks+0x18fd
> 02 091cfc08 79e7187c mscorwks+0x18c6
> 03 091cfc98 79f8b495 mscorwks+0x187c
> 04 091cfd14 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
> 05 091cffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
> 06 091cffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 37
> System Thread ID: 1770
> Kernel Time: 0:0:0.62
> User Time: 0:0:0.250
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0964faf4 79e718fd ntdll!KiFastSystemCallRet
> 01 0964fb38 79e718c6 mscorwks+0x18fd
> 02 0964fb88 79e7187c mscorwks+0x18c6
> 03 0964fc18 79f8b495 mscorwks+0x187c
> 04 0964fc94 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
> 05 0964ffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
> 06 0964ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 38
> System Thread ID: b78
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> worker
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0969fa74 79e718fd ntdll!KiFastSystemCallRet
> 01 0969fab8 79e718c6 mscorwks+0x18fd
> 02 0969fb08 79e7187c mscorwks+0x18c6
> 03 0969fb98 79f8b495 mscorwks+0x187c
> 04 0969fc14 79ed8e36 mscorwks!CompareAssemblyIdentity+0xb5ce
> 05 0969ffb8 77e64829 mscorwks!CreateApplicationContext+0x517c
> 06 0969ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 39
> System Thread ID: b24
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 09ebfe78 7739bbd1 ntdll!KiFastSystemCallRet
> 01 09ebfed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 09ebfef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
> 03 09ebff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
> 04 09ebffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 09ebffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 40
> System Thread ID: 15ec
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.15
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 09f1fe78 7739bbd1 ntdll!KiFastSystemCallRet
> 01 09f1fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 09f1fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
> 03 09f1ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
> 04 09f1ffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 09f1ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 41
> System Thread ID: 1748
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 09f9ffb8 77e64829 ntdll!KiFastSystemCallRet
> 01 09f9ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 42
> System Thread ID: 121c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 06f6fe78 7739bbd1 ntdll!KiFastSystemCallRet
> 01 06f6fed4 7739ce36 USER32!MsgWaitForMultipleObjectsEx+0xd7
> 02 06f6fef0 4a77cb28 USER32!MsgWaitForMultipleObjects+0x1f
> 03 06f6ff84 77bcb530 comsvcs!DllUnregisterServer+0xfb6
> 04 06f6ffb8 77e64829 msvcrt!endthreadex+0xa3
> 05 06f6ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 43
> System Thread ID: 116c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 09e7ffb8 77e64829 ntdll!KiFastSystemCallRet
> 01 09e7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> Thread ID: 44
> System Thread ID: 84
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 09f5ffb8 77e64829 ntdll!KiFastSystemCallRet
> 01 09f5ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> *****
>
> Dump name is formatted as: PID-Timestamp.dmp
>
> Creating C:\iisstate\output\8104-1192817316.dmp - mini user dump
>
> *****
>
> Closing open log file C:\iisstate\output\IISState-8104.log
>
> Thanks,
>
> Tim

Re: Website crash iisstate log help

am 19.10.2007 21:52:50 von tim.cavins

Got a dump file at the time of the crash.

Ran !analyze -v and here's the output. Any help is greatly
appreciated.

Tim

!analyze -v
************************************************************ ***************=
****
*
*
* Exception
Analysis *
*
*
************************************************************ ***************=
****

***** OS symbols are WRONG. Please fix symbols to do analysis.

************************************************************ *************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: ntdll!_PEB
***
***
***
************************************************************ *************
************************************************************ *************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: ntdll!_PEB
***
***
***
************************************************************ *************

FAULTING_IP:
mscorsvr!CoUninitializeEE+1660
79241fac 8b07 mov eax,dword ptr [edi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 029df928
Attempt to read from address 029df928

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

PROCESS_NAME: w3wp.exe

FAULTING_MODULE: 7c800000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP: 46205108

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 029df928

BUGCHECK_STR: ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
+0x1660
0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3701
0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3737
0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x365b
0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
+0x1771a
0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
+0x17756
0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3d25
0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x42a0
0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
+0x24
0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
+0x45
0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
0006fff0 00000000 010018f8 00000000 78746341 kernel32!
ProcessIdToSessionId+0x209

STACK_COMMAND: ~0s; .ecxr ; kb

FOLLOWUP_IP:
mscorsvr!CoUninitializeEE+1660
79241fac 8b07 mov eax,dword ptr [edi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mscorsvr!CoUninitializeEE+1660

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mscorsvr

IMAGE_NAME: mscorsvr.dll

FAULTING_THREAD: 00000d88

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

On Oct 19, 3:03 pm, David Wang wrote:
> You need to run IISState *before* the crash happens, so that IISState
> can catch the crash when it happens to log its results.
>
> Please follow its instructions to configure access to symbols.
>
> The websites using ASP.Net 1.1 and 2.0 should be in different
> Application Pools. If not, then that is the problem.
>
> If the websites are in different Application Pools, then they should
> not be causing the other to crash or change its .Net Framework
> version.
>
> You are running a couple of 3rd party ISAPI Filters and Extensions
> (AuthXFlt and AuthXDB) for custom authentication. I consider 3rd party
> ISAPI DLLs suspect until proven otherwise.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Oct 19, 11:40 am, tim.cav...@gmail.com wrote:
>
>
>
> > I have a website that runs on the .net 1.1 framework. The site crashes
> > randomly and I am having difficulty locating the root cause.
>
> > I have run iisstate after the most recent crash but I do not know how
> > to interpret the dump file. The file is below. Any help is
> > appreciated.
>
> > The one that I am looking at is:
>
> > Thread ID: 26
> > System Thread ID: 14cc
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> > -
> > Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> > worker
> > PDB symbol for mscorwks.dll not loaded
> > failed to load from resource.Failed to load SOS data.
> > No valid SOS data table found.
>
> > The site is supposed to run on the 1.1 framework and that's what it
> > shows under the ASP.net tab in IIS. We do have another site on the
> > same server that is running on the 2.0 framework. Could something on
> > that site be causing this other one to crash or think its supposed to
> > be using the 2.0 framework?
>
> > Opened log file 'C:\iisstate\output\IISState-8104.log'
>
> > ***********************
> > Starting new log output
> > IISState version 3.3.1
>
> > Fri Oct 19 14:01:33 2007
>
> > OS =3D Windows 2003 Server
> > Executable: w3wp.exe
> > PID =3D 8104
>
> > Note: Thread times are formatted as HH:MM:SS.ms
>
> > ***********************
>
> > Thread ID: 0
> > System Thread ID: 186c
> > Kernel Time: 0:0:0.109
> > User Time: 0:0:0.109
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\ntdll.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\kernel32.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for c:\windows\system32\inetsrv\w3dt.dll -
> > *** ERROR: Module load completed but symbols could not be loaded for c:
> > \windows\system32\inetsrv\w3wp.exe
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
> > 01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
> > 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=3D+0x1b31
> > 03 0006ff44 01001a27 w3wp+0x187c
> > 04 0006ffc0 77e6f23b w3wp+0x1a27
> > 05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209
>
> > Thread ID: 1
> > System Thread ID: 1dec
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
> > 01 0063ffb8 77e64829 ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
> > +0x301
> > 02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 2
> > System Thread ID: 1b60
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00ccffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 00ccffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 3
> > System Thread ID: 1da0
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00d0ffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 00d0ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 4
> > System Thread ID: 1b84
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.15
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\RPCRT4.dll -
> > Thread Type: Possible ASP page. Possible DCOM activity
> > Executing Page: *** ERROR: Symbol file could not be found. Defaulted
> > to export symbols for \\?\C:\WINDOWS\system32\inetsrv\asp.dll -
> > ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
>
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\ole32.dll -
> > OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> > Continuing other analysis.
>
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00d7ff84 77c88792 ntdll!KiFastSystemCallRet
> > 01 00d7ff8c 77c8872d RPCRT4!I_RpcFree+0xbd0
> > 02 00d7ffac 77c7b110 RPCRT4!I_RpcFree+0xb6b
> > 03 00d7ffb8 77e64829 RPCRT4!NdrFullPointerInsertRefId+0x3ba
> > 04 00d7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 5
> > System Thread ID: 144
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00dbff74 77e424ed ntdll!KiFastSystemCallRet
> > 01 00dbff84 776bbb0f kernel32!Sleep+0xf
> > 02 00dbffac 776b1704 ole32!CoFreeUnusedLibrariesEx+0x1c0
> > 03 00dbffb8 77e64829 ole32!CoRegisterChannelHook+0x538
> > 04 00dbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 6
> > System Thread ID: 124c
> > Kernel Time: 0:0:0.31
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for c:\windows\system32\inetsrv\W3TP.dll -
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00f7ff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00f7ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00f7ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00f7ffb8 77e64829 W3TP+0x1da9
> > 04 00f7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 7
> > System Thread ID: 1048
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.15
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00fbff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00fbff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00fbffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00fbffb8 77e64829 W3TP+0x1da9
> > 04 00fbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 8
> > System Thread ID: 1bc4
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00ffff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00ffff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00ffffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00ffffb8 77e64829 W3TP+0x1da9
> > 04 00ffffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 9
> > System Thread ID: 1bf4
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.15
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0104ff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 0104ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 0104ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 0104ffb8 77e64829 W3TP+0x1da9
> > 04 0104ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 10
> > System Thread ID: 10c8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0110ffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 0110ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 11
> > System Thread ID: 14d8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\MFC42.DLL -
> > *** WARNING: Unable to verify checksum for
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\msvcrt.dll -
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 015cfe30 77e61c8d ntdll!KiFastSystemCallRet
> > 01 015cfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 015cfe54 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 015cfe64 0150f171 MFC42!Ordinal4167+0x13
> > 04 015cff18 73f122d7 AuthxDB!HouseKeep+0x1e60b
> > 05 015cff84 77bcb530 MFC42!Ordinal1184+0x167
> > 06 015cffb8 77e64829 msvcrt!endthreadex+0xa3
> > 07 015cffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 12
> > System Thread ID: 174c
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0161fe14 77e61c8d ntdll!KiFastSystemCallRet
> > 01 0161fe28 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 0161fe38 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 0161fe48 0150f7c1 MFC42!Ordinal4167+0x13
> > 04 0161ff18 73f122d7 AuthxDB!HouseKeep+0x1ec5b
> > 05 0161ff84 77bcb530 MFC42!Ordinal1184+0x167
> > 06 0161ffb8 77e64829 msvcrt!endthreadex+0xa3
> > 07 0161ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 13
> > System Thread ID: 16ec
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 016dfe30 77e61c8d ntdll!KiFastSystemCallRet
> > 01 016dfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 016dfe54 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 016dfe64 0150ffe5
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 19.10.2007 22:04:25 von tim.cavins

Got a dump file at the time of a crash and ran !analyze -v on it.

The following is the output. Any help is greatly appreciated.

Tim

0:000> !analyze -v
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -
************************************************************ ***************=
****
*
*
* Exception
Analysis *
*
*
************************************************************ ***************=
****

*** ERROR: Symbol file could not be found. Defaulted to export
symbols for mscoree.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for msvcrt.dll -
*** ERROR: Module load completed but symbols could not be loaded for
w3wp.exe
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for kernel32.dll -
***** OS symbols are WRONG. Please fix symbols to do analysis.

************************************************************ *************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: ntdll!_PEB
***
***
***
************************************************************ *************
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ole32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for mfc42.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for comsvcs.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for user32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for browscap.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for LeakTrack.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for userenv.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for rpcrt4.dll -
************************************************************ *************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: ntdll!_PEB
***
***
***
************************************************************ *************

FAULTING_IP:
mscorsvr!CoUninitializeEE+1660
79241fac 8b07 mov eax,dword ptr [edi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 029df928
Attempt to read from address 029df928

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

PROCESS_NAME: w3wp.exe

FAULTING_MODULE: 7c800000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP: 46205108

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 029df928

BUGCHECK_STR: ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
+0x1660
0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3701
0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3737
0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x365b
0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
+0x1771a
0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
+0x17756
0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3d25
0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x42a0
0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
+0x24
0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
+0x45
0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
0006fff0 00000000 010018f8 00000000 78746341 kernel32!
ProcessIdToSessionId+0x209

STACK_COMMAND: ~0s; .ecxr ; kb

FOLLOWUP_IP:
mscorsvr!CoUninitializeEE+1660
79241fac 8b07 mov eax,dword ptr [edi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mscorsvr!CoUninitializeEE+1660

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mscorsvr

IMAGE_NAME: mscorsvr.dll

FAULTING_THREAD: 00000d88

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

On Oct 19, 3:03 pm, David Wang wrote:
> You need to run IISState *before* the crash happens, so that IISState
> can catch the crash when it happens to log its results.
>
> Please follow its instructions to configure access to symbols.
>
> The websites using ASP.Net 1.1 and 2.0 should be in different
> Application Pools. If not, then that is the problem.
>
> If the websites are in different Application Pools, then they should
> not be causing the other to crash or change its .Net Framework
> version.
>
> You are running a couple of 3rd party ISAPI Filters and Extensions
> (AuthXFlt and AuthXDB) for custom authentication. I consider 3rd party
> ISAPI DLLs suspect until proven otherwise.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Oct 19, 11:40 am, tim.cav...@gmail.com wrote:
>
>
>
> > I have a website that runs on the .net 1.1 framework. The site crashes
> > randomly and I am having difficulty locating the root cause.
>
> > I have run iisstate after the most recent crash but I do not know how
> > to interpret the dump file. The file is below. Any help is
> > appreciated.
>
> > The one that I am looking at is:
>
> > Thread ID: 26
> > System Thread ID: 14cc
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> > -
> > Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> > worker
> > PDB symbol for mscorwks.dll not loaded
> > failed to load from resource.Failed to load SOS data.
> > No valid SOS data table found.
>
> > The site is supposed to run on the 1.1 framework and that's what it
> > shows under the ASP.net tab in IIS. We do have another site on the
> > same server that is running on the 2.0 framework. Could something on
> > that site be causing this other one to crash or think its supposed to
> > be using the 2.0 framework?
>
> > Opened log file 'C:\iisstate\output\IISState-8104.log'
>
> > ***********************
> > Starting new log output
> > IISState version 3.3.1
>
> > Fri Oct 19 14:01:33 2007
>
> > OS =3D Windows 2003 Server
> > Executable: w3wp.exe
> > PID =3D 8104
>
> > Note: Thread times are formatted as HH:MM:SS.ms
>
> > ***********************
>
> > Thread ID: 0
> > System Thread ID: 186c
> > Kernel Time: 0:0:0.109
> > User Time: 0:0:0.109
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\ntdll.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\kernel32.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for c:\windows\system32\inetsrv\w3dt.dll -
> > *** ERROR: Module load completed but symbols could not be loaded for c:
> > \windows\system32\inetsrv\w3wp.exe
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
> > 01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
> > 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=3D+0x1b31
> > 03 0006ff44 01001a27 w3wp+0x187c
> > 04 0006ffc0 77e6f23b w3wp+0x1a27
> > 05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209
>
> > Thread ID: 1
> > System Thread ID: 1dec
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
> > 01 0063ffb8 77e64829 ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
> > +0x301
> > 02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 2
> > System Thread ID: 1b60
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00ccffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 00ccffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 3
> > System Thread ID: 1da0
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00d0ffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 00d0ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 4
> > System Thread ID: 1b84
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.15
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\RPCRT4.dll -
> > Thread Type: Possible ASP page. Possible DCOM activity
> > Executing Page: *** ERROR: Symbol file could not be found. Defaulted
> > to export symbols for \\?\C:\WINDOWS\system32\inetsrv\asp.dll -
> > ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
>
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\ole32.dll -
> > OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> > Continuing other analysis.
>
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00d7ff84 77c88792 ntdll!KiFastSystemCallRet
> > 01 00d7ff8c 77c8872d RPCRT4!I_RpcFree+0xbd0
> > 02 00d7ffac 77c7b110 RPCRT4!I_RpcFree+0xb6b
> > 03 00d7ffb8 77e64829 RPCRT4!NdrFullPointerInsertRefId+0x3ba
> > 04 00d7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 5
> > System Thread ID: 144
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00dbff74 77e424ed ntdll!KiFastSystemCallRet
> > 01 00dbff84 776bbb0f kernel32!Sleep+0xf
> > 02 00dbffac 776b1704 ole32!CoFreeUnusedLibrariesEx+0x1c0
> > 03 00dbffb8 77e64829 ole32!CoRegisterChannelHook+0x538
> > 04 00dbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 6
> > System Thread ID: 124c
> > Kernel Time: 0:0:0.31
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for c:\windows\system32\inetsrv\W3TP.dll -
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00f7ff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00f7ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00f7ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00f7ffb8 77e64829 W3TP+0x1da9
> > 04 00f7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 7
> > System Thread ID: 1048
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.15
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00fbff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00fbff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00fbffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00fbffb8 77e64829 W3TP+0x1da9
> > 04 00fbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 8
> > System Thread ID: 1bc4
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00ffff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00ffff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00ffffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00ffffb8 77e64829 W3TP+0x1da9
> > 04 00ffffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 9
> > System Thread ID: 1bf4
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.15
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0104ff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 0104ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 0104ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 0104ffb8 77e64829 W3TP+0x1da9
> > 04 0104ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 10
> > System Thread ID: 10c8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0110ffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 0110ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 11
> > System Thread ID: 14d8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\MFC42.DLL -
> > *** WARNING: Unable to verify checksum for
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\msvcrt.dll -
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 015cfe30 77e61c8d ntdll!KiFastSystemCallRet
> > 01 015cfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 015cfe54 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 015cfe64 0150f171 MFC42!Ordinal4167+0x13
> > 04 015cff18 73f122d7 AuthxDB!HouseKeep+0x1e60b
> > 05 015cff84 77bcb530 MFC42!Ordinal1184+0x167
> > 06 015cffb8 77e64829 msvcrt!endthreadex+0xa3
> > 07 015cffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 12
> > System Thread ID: 174c
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0161fe14 77e61c8d ntdll!KiFastSystemCallRet
> > 01 0161fe28 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 0161fe38 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 0161fe48 0150f7c1 MFC42!Ordinal4167+0x13
> > 04 0161ff18 73f122d7 AuthxDB!HouseKeep+0x1ec5b
> > 05 0161ff84 77bcb530 MFC42!Ordinal1184+0x167
> > 06 0161ffb8 77e64829 msvcrt!endthreadex+0xa3
> > 07 0161ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 13
> > System Thread ID: 16ec
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 016dfe30 77e61c8d ntdll!KiFastSystemCallRet
> > 01 016dfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 016dfe54 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 016dfe64 0150ffe5
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 19.10.2007 22:07:51 von tim.cavins

Here's the !analyze -v output from a dump file created at the time of
a crash.

Tim

0:000> !analyze -v
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -
************************************************************ ***************=
****
*
*
* Exception
Analysis *
*
*
************************************************************ ***************=
****

*** ERROR: Symbol file could not be found. Defaulted to export
symbols for mscoree.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for msvcrt.dll -
*** ERROR: Module load completed but symbols could not be loaded for
w3wp.exe
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for kernel32.dll -
***** OS symbols are WRONG. Please fix symbols to do analysis.

************************************************************ *************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: ntdll!_PEB
***
***
***
************************************************************ *************
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ole32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for mfc42.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for comsvcs.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for user32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for browscap.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for LeakTrack.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for userenv.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for rpcrt4.dll -
************************************************************ *************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: ntdll!_PEB
***
***
***
************************************************************ *************

FAULTING_IP:
mscorsvr!CoUninitializeEE+1660
79241fac 8b07 mov eax,dword ptr [edi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 029df928
Attempt to read from address 029df928

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

PROCESS_NAME: w3wp.exe

FAULTING_MODULE: 7c800000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP: 46205108

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 029df928

BUGCHECK_STR: ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
+0x1660
0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3701
0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3737
0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x365b
0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
+0x1771a
0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
+0x17756
0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x3d25
0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
GetMetaDataPublicInterfaceFromInternal+0x42a0
0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
+0x24
0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
+0x45
0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
0006fff0 00000000 010018f8 00000000 78746341 kernel32!
ProcessIdToSessionId+0x209

STACK_COMMAND: ~0s; .ecxr ; kb

FOLLOWUP_IP:
mscorsvr!CoUninitializeEE+1660
79241fac 8b07 mov eax,dword ptr [edi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mscorsvr!CoUninitializeEE+1660

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mscorsvr

IMAGE_NAME: mscorsvr.dll

FAULTING_THREAD: 00000d88

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

On Oct 19, 3:03 pm, David Wang wrote:
> You need to run IISState *before* the crash happens, so that IISState
> can catch the crash when it happens to log its results.
>
> Please follow its instructions to configure access to symbols.
>
> The websites using ASP.Net 1.1 and 2.0 should be in different
> Application Pools. If not, then that is the problem.
>
> If the websites are in different Application Pools, then they should
> not be causing the other to crash or change its .Net Framework
> version.
>
> You are running a couple of 3rd party ISAPI Filters and Extensions
> (AuthXFlt and AuthXDB) for custom authentication. I consider 3rd party
> ISAPI DLLs suspect until proven otherwise.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Oct 19, 11:40 am, tim.cav...@gmail.com wrote:
>
>
>
> > I have a website that runs on the .net 1.1 framework. The site crashes
> > randomly and I am having difficulty locating the root cause.
>
> > I have run iisstate after the most recent crash but I do not know how
> > to interpret the dump file. The file is below. Any help is
> > appreciated.
>
> > The one that I am looking at is:
>
> > Thread ID: 26
> > System Thread ID: 14cc
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> > -
> > Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> > worker
> > PDB symbol for mscorwks.dll not loaded
> > failed to load from resource.Failed to load SOS data.
> > No valid SOS data table found.
>
> > The site is supposed to run on the 1.1 framework and that's what it
> > shows under the ASP.net tab in IIS. We do have another site on the
> > same server that is running on the 2.0 framework. Could something on
> > that site be causing this other one to crash or think its supposed to
> > be using the 2.0 framework?
>
> > Opened log file 'C:\iisstate\output\IISState-8104.log'
>
> > ***********************
> > Starting new log output
> > IISState version 3.3.1
>
> > Fri Oct 19 14:01:33 2007
>
> > OS =3D Windows 2003 Server
> > Executable: w3wp.exe
> > PID =3D 8104
>
> > Note: Thread times are formatted as HH:MM:SS.ms
>
> > ***********************
>
> > Thread ID: 0
> > System Thread ID: 186c
> > Kernel Time: 0:0:0.109
> > User Time: 0:0:0.109
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\ntdll.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\kernel32.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for c:\windows\system32\inetsrv\w3dt.dll -
> > *** ERROR: Module load completed but symbols could not be loaded for c:
> > \windows\system32\inetsrv\w3wp.exe
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
> > 01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
> > 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=3D+0x1b31
> > 03 0006ff44 01001a27 w3wp+0x187c
> > 04 0006ffc0 77e6f23b w3wp+0x1a27
> > 05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209
>
> > Thread ID: 1
> > System Thread ID: 1dec
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
> > 01 0063ffb8 77e64829 ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
> > +0x301
> > 02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 2
> > System Thread ID: 1b60
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00ccffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 00ccffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 3
> > System Thread ID: 1da0
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00d0ffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 00d0ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 4
> > System Thread ID: 1b84
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.15
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\RPCRT4.dll -
> > Thread Type: Possible ASP page. Possible DCOM activity
> > Executing Page: *** ERROR: Symbol file could not be found. Defaulted
> > to export symbols for \\?\C:\WINDOWS\system32\inetsrv\asp.dll -
> > ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
>
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\ole32.dll -
> > OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> > Continuing other analysis.
>
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00d7ff84 77c88792 ntdll!KiFastSystemCallRet
> > 01 00d7ff8c 77c8872d RPCRT4!I_RpcFree+0xbd0
> > 02 00d7ffac 77c7b110 RPCRT4!I_RpcFree+0xb6b
> > 03 00d7ffb8 77e64829 RPCRT4!NdrFullPointerInsertRefId+0x3ba
> > 04 00d7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 5
> > System Thread ID: 144
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00dbff74 77e424ed ntdll!KiFastSystemCallRet
> > 01 00dbff84 776bbb0f kernel32!Sleep+0xf
> > 02 00dbffac 776b1704 ole32!CoFreeUnusedLibrariesEx+0x1c0
> > 03 00dbffb8 77e64829 ole32!CoRegisterChannelHook+0x538
> > 04 00dbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 6
> > System Thread ID: 124c
> > Kernel Time: 0:0:0.31
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for c:\windows\system32\inetsrv\W3TP.dll -
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00f7ff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00f7ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00f7ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00f7ffb8 77e64829 W3TP+0x1da9
> > 04 00f7ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 7
> > System Thread ID: 1048
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.15
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00fbff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00fbff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00fbffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00fbffb8 77e64829 W3TP+0x1da9
> > 04 00fbffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 8
> > System Thread ID: 1bc4
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 00ffff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 00ffff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 00ffffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 00ffffb8 77e64829 W3TP+0x1da9
> > 04 00ffffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 9
> > System Thread ID: 1bf4
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.15
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0104ff54 5a30248e ntdll!KiFastSystemCallRet
> > 01 0104ff8c 5a3026ac W3TP!THREAD_POOL::PostCompletion+0x89
> > 02 0104ffa0 5a301da9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> > 03 0104ffb8 77e64829 W3TP+0x1da9
> > 04 0104ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 10
> > System Thread ID: 10c8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0110ffb8 77e64829 ntdll!KiFastSystemCallRet
> > 01 0110ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 11
> > System Thread ID: 14d8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\MFC42.DLL -
> > *** WARNING: Unable to verify checksum for
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for C:\WINDOWS\system32\msvcrt.dll -
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 015cfe30 77e61c8d ntdll!KiFastSystemCallRet
> > 01 015cfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 015cfe54 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 015cfe64 0150f171 MFC42!Ordinal4167+0x13
> > 04 015cff18 73f122d7 AuthxDB!HouseKeep+0x1e60b
> > 05 015cff84 77bcb530 MFC42!Ordinal1184+0x167
> > 06 015cffb8 77e64829 msvcrt!endthreadex+0xa3
> > 07 015cffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 12
> > System Thread ID: 174c
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 0161fe14 77e61c8d ntdll!KiFastSystemCallRet
> > 01 0161fe28 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 0161fe38 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 0161fe48 0150f7c1 MFC42!Ordinal4167+0x13
> > 04 0161ff18 73f122d7 AuthxDB!HouseKeep+0x1ec5b
> > 05 0161ff84 77bcb530 MFC42!Ordinal1184+0x167
> > 06 0161ffb8 77e64829 msvcrt!endthreadex+0xa3
> > 07 0161ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > Thread ID: 13
> > System Thread ID: 16ec
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 00 016dfe30 77e61c8d ntdll!KiFastSystemCallRet
> > 01 016dfe44 73ed6e63 kernel32!WaitForSingleObject+0x12
> > 02 016dfe54 73ed70e3 MFC42!Ordinal4168+0x13
> > 03 016dfe64 0150ffe5
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 20.10.2007 06:49:00 von David Wang

Please make symbols available to properly resolve the stack backtrace.

You do not have access to symbols to run !analyze.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

On Oct 19, 1:04 pm, tim.cav...@gmail.com wrote:
> Got a dump file at the time of a crash and ran !analyze -v on it.
>
> The following is the output. Any help is greatly appreciated.
>
> Tim
>
> 0:000> !analyze -v
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for ntdll.dll -
> ************************************************************ *************=
**=AD****
> *
> *
> * Exception
> Analysis *
> *
> *
> ************************************************************ *************=
**=AD****
>
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for mscoree.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for msvcrt.dll -
> *** ERROR: Module load completed but symbols could not be loaded for
> w3wp.exe
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for kernel32.dll -
> ***** OS symbols are WRONG. Please fix symbols to do analysis.
>
> ************************************************************ *************
> ***
> ***
> ***
> ***
> *** Your debugger is not using the correct symbols
> ***
> ***
> ***
> *** In order for this command to work properly, your symbol path
> ***
> *** must point to .pdb files that have full type information.
> ***
> ***
> ***
> *** Certain .pdb files (such as the public OS symbols) do not
> ***
> *** contain the required information. Contact the group that
> ***
> *** provided you with these symbols if you need this command to
> ***
> *** work.
> ***
> ***
> ***
> *** Type referenced: ntdll!_PEB
> ***
> ***
> ***
> ************************************************************ *************
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for ole32.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for mfc42.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for comsvcs.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for user32.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for browscap.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for LeakTrack.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for userenv.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for rpcrt4.dll -
> ************************************************************ *************
> ***
> ***
> ***
> ***
> *** Your debugger is not using the correct symbols
> ***
> ***
> ***
> *** In order for this command to work properly, your symbol path
> ***
> *** must point to .pdb files that have full type information.
> ***
> ***
> ***
> *** Certain .pdb files (such as the public OS symbols) do not
> ***
> *** contain the required information. Contact the group that
> ***
> *** provided you with these symbols if you need this command to
> ***
> *** work.
> ***
> ***
> ***
> *** Type referenced: ntdll!_PEB
> ***
> ***
> ***
> ************************************************************ *************
>
> FAULTING_IP:
> mscorsvr!CoUninitializeEE+1660
> 79241fac 8b07 mov eax,dword ptr [edi]
>
> EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000000
> Parameter[1]: 029df928
> Attempt to read from address 029df928
>
> DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> PROCESS_NAME: w3wp.exe
>
> FAULTING_MODULE: 7c800000 ntdll
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> READ_ADDRESS: 029df928
>
> BUGCHECK_STR: ACCESS_VIOLATION
>
> LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> STACK_TEXT:
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
> +0x1660
> 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
> GetMetaDataPublicInterfaceFromInternal+0x3701
> 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> GetMetaDataPublicInterfaceFromInternal+0x3737
> 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> GetMetaDataPublicInterfaceFromInternal+0x365b
> 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
> +0x1771a
> 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
> +0x17756
> 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> GetMetaDataPublicInterfaceFromInternal+0x3d25
> 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> GetMetaDataPublicInterfaceFromInternal+0x42a0
> 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
> +0x24
> 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> +0x45
> 0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
> 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
> 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
> 0006fff0 00000000 010018f8 00000000 78746341 kernel32!
> ProcessIdToSessionId+0x209
>
> STACK_COMMAND: ~0s; .ecxr ; kb
>
> FOLLOWUP_IP:
> mscorsvr!CoUninitializeEE+1660
> 79241fac 8b07 mov eax,dword ptr [edi]
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: mscorsvr!CoUninitializeEE+1660
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: mscorsvr
>
> IMAGE_NAME: mscorsvr.dll
>
> FAULTING_THREAD: 00000d88
>
> BUCKET_ID: WRONG_SYMBOLS
>
> Followup: MachineOwner
> ---------
>
> On Oct 19, 3:03 pm, David Wang wrote:
>
>
>
> > You need to run IISState *before* the crash happens, so that IISState
> > can catch the crash when it happens to log its results.
>
> > Please follow its instructions to configure access to symbols.
>
> > The websites using ASP.Net 1.1 and 2.0 should be in different
> > Application Pools. If not, then that is the problem.
>
> > If the websites are in different Application Pools, then they should
> > not be causing the other to crash or change its .Net Framework
> > version.
>
> > You are running a couple of 3rd party ISAPI Filters and Extensions
> > (AuthXFlt and AuthXDB) for custom authentication. I consider 3rd party
> > ISAPI DLLs suspect until proven otherwise.
>
> > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > //
>
> > On Oct 19, 11:40 am, tim.cav...@gmail.com wrote:
>
> > > I have a website that runs on the .net 1.1 framework. The site crashes
> > > randomly and I am having difficulty locating the root cause.
>
> > > I have run iisstate after the most recent crash but I do not know how
> > > to interpret the dump file. The file is below. Any help is
> > > appreciated.
>
> > > The one that I am looking at is:
>
> > > Thread ID: 26
> > > System Thread ID: 14cc
> > > Kernel Time: 0:0:0.0
> > > User Time: 0:0:0.0
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> > > -
> > > Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> > > worker
> > > PDB symbol for mscorwks.dll not loaded
> > > failed to load from resource.Failed to load SOS data.
> > > No valid SOS data table found.
>
> > > The site is supposed to run on the 1.1 framework and that's what it
> > > shows under the ASP.net tab in IIS. We do have another site on the
> > > same server that is running on the 2.0 framework. Could something on
> > > that site be causing this other one to crash or think its supposed to
> > > be using the 2.0 framework?
>
> > > Opened log file 'C:\iisstate\output\IISState-8104.log'
>
> > > ***********************
> > > Starting new log output
> > > IISState version 3.3.1
>
> > > Fri Oct 19 14:01:33 2007
>
> > > OS =3D Windows 2003 Server
> > > Executable: w3wp.exe
> > > PID =3D 8104
>
> > > Note: Thread times are formatted as HH:MM:SS.ms
>
> > > ***********************
>
> > > Thread ID: 0
> > > System Thread ID: 186c
> > > Kernel Time: 0:0:0.109
> > > User Time: 0:0:0.109
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for C:\WINDOWS\system32\ntdll.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for C:\WINDOWS\system32\kernel32.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for c:\windows\system32\inetsrv\w3dt.dll -
> > > *** ERROR: Module load completed but symbols could not be loaded for =
c:
> > > \windows\system32\inetsrv\w3wp.exe
> > > Thread Type: Other
> > > # ChildEBP RetAddr
> > > WARNING: Stack unwind information not available. Following frames may
> > > be wrong.
> > > 00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
> > > 01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
> > > 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=3D+0x1b31
> > > 03 0006ff44 01001a27 w3wp+0x187c
> > > 04 0006ffc0 77e6f23b w3wp+0x1a27
> > > 05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209
>
> > > Thread ID: 1
> > > System Thread ID: 1dec
> > > Kernel Time: 0:0:0.0
> > > User Time: 0:0:0.0
> > > Thread Type: Other
> > > # ChildEBP RetAddr
> > > WARNING: Stack unwind information not available. Following frames may
> > > be wrong.
> > > 00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
> > > 01 0063ffb8 77e64829 ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
> > > +0x301
> > > 02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > > Thread ID: 2
> > > System Thread ID: 1b60
> > > Kernel Time: 0:0:0.0
> > > User Time: 0:0:0.0
> > > Thread Type: Other
> > > # ChildEBP RetAddr
> > > WARNING: Stack unwind information not available. Following frames may
> > > be wrong.
> > > 00 00ccffb8 77e64829 ntdll!KiFastSystemCallRet
> > > 01 00ccffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > > Thread ID: 3
> > > System Thread ID: 1da0
> > > Kernel Time: 0:0:0.0
> > > User Time: 0:0:0.0
> > > Thread Type: Other
> > > # ChildEBP RetAddr
> > > WARNING: Stack unwind information not available. Following frames may
> > > be wrong.
> > > 00 00d0ffb8 77e64829 ntdll!KiFastSystemCallRet
> > > 01 00d0ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > > Thread ID: 4
> > > System Thread ID: 1b84
> > > Kernel Time: 0:0:0.0
> > > User Time: 0:0:0.15
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 22.10.2007 14:53:13 von tim.cavins

I set up my symbol path to be SRV*c:\websymbols*http://
msdl.microsoft.com/download/symbols

I ran .reload and then !analyze -v and got this. Is there something
else I need to do?

-Tim

0:000> !analyze -v
************************************************************ ***************=
****
*
*
* Exception
Analysis *
*
*
************************************************************ ***************=
****

FAULTING_IP:
mscorsvr!SafeRelease+4d
79241fac 8b07 mov eax,dword ptr [edi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 79241fac (mscorsvr!SafeRelease+0x0000004d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 029df928
Attempt to read from address 029df928

DEFAULT_BUCKET_ID: INVALID_POINTER_READ

PROCESS_NAME: w3wp.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 029df928

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac

STACK_TEXT:
0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!SafeRelease+0x4d
0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!IUnkEntry::Free
+0x7c
0006fb4c 79262e48 000bf0ac 044186c0 00000000 mscorsvr!
ComPlusWrapper::ReleaseAllInterfaces+0xa
0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
ComPlusWrapper::ReleaseAllInterfacesCallBack+0x121
0006fd90 7924ac00 0441d208 000bf0a8 0008ca78 mscorsvr!
ComPlusWrapper::Cleanup+0x16
0006fda0 7924a63e 0444c508 0006fdd0 79263017 mscorsvr!
ComPlusContextCleanupGroup::CleanUpWrappers+0x19
0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
ComPlusApartmentCleanupGroup::ReleaseCleanupGroup+0xe
0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!
ComPlusApartmentCleanupGroup::CleanUpWrappers+0x7a
0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!
ComPlusWrapperCleanupList::CleanUpWrappers+0x69
0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
ComPlusWrapperCache::ReleaseWrappers+0xf1
0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
ComPlusWrapperCache::ReleaseComPlusWrappers+0x28
0006ff04 7924b8d0 00000000 0006ff20 79011628 mscorsvr!CoEEShutDownCOM
+0x24
0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CorExitProcess
+0x38
0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
+0x46
0006ff2c 77bcaefb fffffffe 00000000 fffffffe msvcrt!__crtExitProcess
+0x29
0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!_cinit+0xd2
0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp!wmainCRTStartup
+0x144
0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart
+0x23

STACK_COMMAND: ~0s; .ecxr ; kb

FOLLOWUP_IP:
mscorsvr!SafeRelease+4d
79241fac 8b07 mov eax,dword ptr [edi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mscorsvr!SafeRelease+4d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mscorsvr

IMAGE_NAME: mscorsvr.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 46205108

FAULTING_THREAD: 00000d88

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ

FAILURE_BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!
SafeRelease+4d

BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!SafeRelease
+4d

Followup: MachineOwner
---------

On Oct 20, 12:49 am, David Wang wrote:
> Please make symbols available to properly resolve the stack backtrace.
>
> You do not have access to symbols to run !analyze.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Oct 19, 1:04 pm, tim.cav...@gmail.com wrote:
>
>
>
> > Got a dump file at the time of a crash and ran !analyze -v on it.
>
> > The following is the output. Any help is greatly appreciated.
>
> > Tim
>
> > 0:000> !analyze -v
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for ntdll.dll -
> > ************************************************************ ***********=
********
> > *
> > *
> > * Exception
> > Analysis *
> > *
> > *
> > ************************************************************ ***********=
********
>
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for mscoree.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for msvcrt.dll -
> > *** ERROR: Module load completed but symbols could not be loaded for
> > w3wp.exe
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for kernel32.dll -
> > ***** OS symbols are WRONG. Please fix symbols to do analysis.
>
> > ************************************************************ ***********=
**
> > ***
> > ***
> > ***
> > ***
> > *** Your debugger is not using the correct symbols
> > ***
> > ***
> > ***
> > *** In order for this command to work properly, your symbol path
> > ***
> > *** must point to .pdb files that have full type information.
> > ***
> > ***
> > ***
> > *** Certain .pdb files (such as the public OS symbols) do not
> > ***
> > *** contain the required information. Contact the group that
> > ***
> > *** provided you with these symbols if you need this command to
> > ***
> > *** work.
> > ***
> > ***
> > ***
> > *** Type referenced: ntdll!_PEB
> > ***
> > ***
> > ***
> > ************************************************************ ***********=
**
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for ole32.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for mfc42.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for comsvcs.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for user32.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for browscap.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for LeakTrack.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for userenv.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for rpcrt4.dll -
> > ************************************************************ ***********=
**
> > ***
> > ***
> > ***
> > ***
> > *** Your debugger is not using the correct symbols
> > ***
> > ***
> > ***
> > *** In order for this command to work properly, your symbol path
> > ***
> > *** must point to .pdb files that have full type information.
> > ***
> > ***
> > ***
> > *** Certain .pdb files (such as the public OS symbols) do not
> > ***
> > *** contain the required information. Contact the group that
> > ***
> > *** provided you with these symbols if you need this command to
> > ***
> > *** work.
> > ***
> > ***
> > ***
> > *** Type referenced: ntdll!_PEB
> > ***
> > ***
> > ***
> > ************************************************************ ***********=
**
>
> > FAULTING_IP:
> > mscorsvr!CoUninitializeEE+1660
> > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
> > ExceptionCode: c0000005 (Access violation)
> > ExceptionFlags: 00000000
> > NumberParameters: 2
> > Parameter[0]: 00000000
> > Parameter[1]: 029df928
> > Attempt to read from address 029df928
>
> > DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> > PROCESS_NAME: w3wp.exe
>
> > FAULTING_MODULE: 7c800000 ntdll
>
> > DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> > referenced memory at "0x%08lx". The memory could not be "%s".
>
> > READ_ADDRESS: 029df928
>
> > BUGCHECK_STR: ACCESS_VIOLATION
>
> > LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> > STACK_TEXT:
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
> > +0x1660
> > 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x3701
> > 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x3737
> > 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x365b
> > 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
> > +0x1771a
> > 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
> > +0x17756
> > 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x3d25
> > 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x42a0
> > 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
> > +0x24
> > 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> > +0x45
> > 0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
> > 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
> > 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> > 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
> > 0006fff0 00000000 010018f8 00000000 78746341 kernel32!
> > ProcessIdToSessionId+0x209
>
> > STACK_COMMAND: ~0s; .ecxr ; kb
>
> > FOLLOWUP_IP:
> > mscorsvr!CoUninitializeEE+1660
> > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > SYMBOL_STACK_INDEX: 0
>
> > SYMBOL_NAME: mscorsvr!CoUninitializeEE+1660
>
> > FOLLOWUP_NAME: MachineOwner
>
> > MODULE_NAME: mscorsvr
>
> > IMAGE_NAME: mscorsvr.dll
>
> > FAULTING_THREAD: 00000d88
>
> > BUCKET_ID: WRONG_SYMBOLS
>
> > Followup: MachineOwner
> > ---------
>
> > On Oct 19, 3:03 pm, David Wang wrote:
>
> > > You need to run IISState *before* the crash happens, so that IISState
> > > can catch the crash when it happens to log its results.
>
> > > Please follow its instructions to configure access to symbols.
>
> > > The websites using ASP.Net 1.1 and 2.0 should be in different
> > > Application Pools. If not, then that is the problem.
>
> > > If the websites are in different Application Pools, then they should
> > > not be causing the other to crash or change its .Net Framework
> > > version.
>
> > > You are running a couple of 3rd party ISAPI Filters and Extensions
> > > (AuthXFlt and AuthXDB) for custom authentication. I consider 3rd party
> > > ISAPI DLLs suspect until proven otherwise.
>
> > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > //
>
> > > On Oct 19, 11:40 am, tim.cav...@gmail.com wrote:
>
> > > > I have a website that runs on the .net 1.1 framework. The site cras=
hes
> > > > randomly and I am having difficulty locating the root cause.
>
> > > > I have run iisstate after the most recent crash but I do not know h=
ow
> > > > to interpret the dump file. The file is below. Any help is
> > > > appreciated.
>
> > > > The one that I am looking at is:
>
> > > > Thread ID: 26
> > > > System Thread ID: 14cc
> > > > Kernel Time: 0:0:0.0
> > > > User Time: 0:0:0.0
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.=
dll
> > > > -
> > > > Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> > > > worker
> > > > PDB symbol for mscorwks.dll not loaded
> > > > failed to load from resource.Failed to load SOS data.
> > > > No valid SOS data table found.
>
> > > > The site is supposed to run on the 1.1 framework and that's what it
> > > > shows under the ASP.net tab in IIS. We do have another site on the
> > > > same server that is running on the 2.0 framework. Could something on
> > > > that site be causing this other one to crash or think its supposed =
to
> > > > be using the 2.0 framework?
>
> > > > Opened log file 'C:\iisstate\output\IISState-8104.log'
>
> > > > ***********************
> > > > Starting new log output
> > > > IISState version 3.3.1
>
> > > > Fri Oct 19 14:01:33 2007
>
> > > > OS =3D Windows 2003 Server
> > > > Executable: w3wp.exe
> > > > PID =3D 8104
>
> > > > Note: Thread times are formatted as HH:MM:SS.ms
>
> > > > ***********************
>
> > > > Thread ID: 0
> > > > System Thread ID: 186c
> > > > Kernel Time: 0:0:0.109
> > > > User Time: 0:0:0.109
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for C:\WINDOWS\system32\ntdll.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for C:\WINDOWS\system32\kernel32.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for c:\windows\system32\inetsrv\w3dt.dll -
> > > > *** ERROR: Module load completed but symbols could not be loaded fo=
r c:
> > > > \windows\system32\inetsrv\w3wp.exe
> > > > Thread Type: Other
> > > > # ChildEBP RetAddr
> > > > WARNING: Stack unwind information not available. Following frames m=
ay
> > > > be wrong.
> > > > 00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
> > > > 01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
> > > > 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=3D+0x1b31
> > > > 03 0006ff44 01001a27 w3wp+0x187c
> > > > 04 0006ffc0 77e6f23b w3wp+0x1a27
> > > > 05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209
>
> > > > Thread ID: 1
> > > > System Thread ID: 1dec
> > > > Kernel Time: 0:0:0.0
> > > > User Time: 0:0:0.0
> > > > Thread Type: Other
> > > > # ChildEBP RetAddr
> > > > WARNING: Stack unwind information not available. Following frames m=
ay
> > > > be wrong.
> > > > 00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
> > > > 01 0063ffb8 77e64829 ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtSta=
tus
> > > > +0x301
> > > > 02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > > > Thread ID: 2
> > > > System Thread ID: 1b60
> > > > Kernel Time: 0:0:0.0
> > > > User Time:
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 22.10.2007 23:18:56 von patfilot

The crash occurred when .Net was trying to dereference a call to a COM/COM+
dll, which was no longer there (i.e. the dll may have unloaded out from
under you). There are a couple of things to try:

1) type 'lm '. This will list all modules that are loaded and, more
importantly, dll's that have unloaded. That may give you a hint to the
culprit.

2) type '!\clr10\sos.clrstack ' which may dump out any managed code
that is still on the stack (it may have all gone away at this point).

Pat

wrote in message
news:1193057593.870969.165320@e34g2000pro.googlegroups.com.. .
I set up my symbol path to be SRV*c:\websymbols*http://
msdl.microsoft.com/download/symbols

I ran .reload and then !analyze -v and got this. Is there something
else I need to do?

-Tim

0:000> !analyze -v
************************************************************ *******************
*
*
* Exception
Analysis *
*
*
************************************************************ *******************

FAULTING_IP:
mscorsvr!SafeRelease+4d
79241fac 8b07 mov eax,dword ptr [edi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 79241fac (mscorsvr!SafeRelease+0x0000004d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 029df928
Attempt to read from address 029df928

DEFAULT_BUCKET_ID: INVALID_POINTER_READ

PROCESS_NAME: w3wp.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 029df928

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac

STACK_TEXT:
0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!SafeRelease+0x4d
0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!IUnkEntry::Free
+0x7c
0006fb4c 79262e48 000bf0ac 044186c0 00000000 mscorsvr!
ComPlusWrapper::ReleaseAllInterfaces+0xa
0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
ComPlusWrapper::ReleaseAllInterfacesCallBack+0x121
0006fd90 7924ac00 0441d208 000bf0a8 0008ca78 mscorsvr!
ComPlusWrapper::Cleanup+0x16
0006fda0 7924a63e 0444c508 0006fdd0 79263017 mscorsvr!
ComPlusContextCleanupGroup::CleanUpWrappers+0x19
0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
ComPlusApartmentCleanupGroup::ReleaseCleanupGroup+0xe
0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!
ComPlusApartmentCleanupGroup::CleanUpWrappers+0x7a
0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!
ComPlusWrapperCleanupList::CleanUpWrappers+0x69
0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
ComPlusWrapperCache::ReleaseWrappers+0xf1
0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
ComPlusWrapperCache::ReleaseComPlusWrappers+0x28
0006ff04 7924b8d0 00000000 0006ff20 79011628 mscorsvr!CoEEShutDownCOM
+0x24
0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CorExitProcess
+0x38
0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
+0x46
0006ff2c 77bcaefb fffffffe 00000000 fffffffe msvcrt!__crtExitProcess
+0x29
0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!_cinit+0xd2
0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp!wmainCRTStartup
+0x144
0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart
+0x23

STACK_COMMAND: ~0s; .ecxr ; kb

FOLLOWUP_IP:
mscorsvr!SafeRelease+4d
79241fac 8b07 mov eax,dword ptr [edi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mscorsvr!SafeRelease+4d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mscorsvr

IMAGE_NAME: mscorsvr.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 46205108

FAULTING_THREAD: 00000d88

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ

FAILURE_BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!
SafeRelease+4d

BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!SafeRelease
+4d

Followup: MachineOwner
---------

On Oct 20, 12:49 am, David Wang wrote:
> Please make symbols available to properly resolve the stack backtrace.
>
> You do not have access to symbols to run !analyze.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Oct 19, 1:04 pm, tim.cav...@gmail.com wrote:
>
>
>
> > Got a dump file at the time of a crash and ran !analyze -v on it.
>
> > The following is the output. Any help is greatly appreciated.
>
> > Tim
>
> > 0:000> !analyze -v
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for ntdll.dll -
> > ************************************************************ *******************
> > *
> > *
> > * Exception
> > Analysis *
> > *
> > *
> > ************************************************************ *******************
>
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for mscoree.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for msvcrt.dll -
> > *** ERROR: Module load completed but symbols could not be loaded for
> > w3wp.exe
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for kernel32.dll -
> > ***** OS symbols are WRONG. Please fix symbols to do analysis.
>
> > ************************************************************ *************
> > ***
> > ***
> > ***
> > ***
> > *** Your debugger is not using the correct symbols
> > ***
> > ***
> > ***
> > *** In order for this command to work properly, your symbol path
> > ***
> > *** must point to .pdb files that have full type information.
> > ***
> > ***
> > ***
> > *** Certain .pdb files (such as the public OS symbols) do not
> > ***
> > *** contain the required information. Contact the group that
> > ***
> > *** provided you with these symbols if you need this command to
> > ***
> > *** work.
> > ***
> > ***
> > ***
> > *** Type referenced: ntdll!_PEB
> > ***
> > ***
> > ***
> > ************************************************************ *************
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for ole32.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for mfc42.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for comsvcs.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for user32.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for browscap.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for LeakTrack.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for userenv.dll -
> > *** ERROR: Symbol file could not be found. Defaulted to export
> > symbols for rpcrt4.dll -
> > ************************************************************ *************
> > ***
> > ***
> > ***
> > ***
> > *** Your debugger is not using the correct symbols
> > ***
> > ***
> > ***
> > *** In order for this command to work properly, your symbol path
> > ***
> > *** must point to .pdb files that have full type information.
> > ***
> > ***
> > ***
> > *** Certain .pdb files (such as the public OS symbols) do not
> > ***
> > *** contain the required information. Contact the group that
> > ***
> > *** provided you with these symbols if you need this command to
> > ***
> > *** work.
> > ***
> > ***
> > ***
> > *** Type referenced: ntdll!_PEB
> > ***
> > ***
> > ***
> > ************************************************************ *************
>
> > FAULTING_IP:
> > mscorsvr!CoUninitializeEE+1660
> > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
> > ExceptionCode: c0000005 (Access violation)
> > ExceptionFlags: 00000000
> > NumberParameters: 2
> > Parameter[0]: 00000000
> > Parameter[1]: 029df928
> > Attempt to read from address 029df928
>
> > DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> > PROCESS_NAME: w3wp.exe
>
> > FAULTING_MODULE: 7c800000 ntdll
>
> > DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> > referenced memory at "0x%08lx". The memory could not be "%s".
>
> > READ_ADDRESS: 029df928
>
> > BUGCHECK_STR: ACCESS_VIOLATION
>
> > LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> > STACK_TEXT:
> > WARNING: Stack unwind information not available. Following frames may
> > be wrong.
> > 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
> > +0x1660
> > 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x3701
> > 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x3737
> > 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x365b
> > 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
> > +0x1771a
> > 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
> > +0x17756
> > 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x3d25
> > 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> > GetMetaDataPublicInterfaceFromInternal+0x42a0
> > 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
> > +0x24
> > 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> > +0x45
> > 0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
> > 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
> > 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> > 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
> > 0006fff0 00000000 010018f8 00000000 78746341 kernel32!
> > ProcessIdToSessionId+0x209
>
> > STACK_COMMAND: ~0s; .ecxr ; kb
>
> > FOLLOWUP_IP:
> > mscorsvr!CoUninitializeEE+1660
> > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > SYMBOL_STACK_INDEX: 0
>
> > SYMBOL_NAME: mscorsvr!CoUninitializeEE+1660
>
> > FOLLOWUP_NAME: MachineOwner
>
> > MODULE_NAME: mscorsvr
>
> > IMAGE_NAME: mscorsvr.dll
>
> > FAULTING_THREAD: 00000d88
>
> > BUCKET_ID: WRONG_SYMBOLS
>
> > Followup: MachineOwner
> > ---------
>
> > On Oct 19, 3:03 pm, David Wang wrote:
>
> > > You need to run IISState *before* the crash happens, so that IISState
> > > can catch the crash when it happens to log its results.
>
> > > Please follow its instructions to configure access to symbols.
>
> > > The websites using ASP.Net 1.1 and 2.0 should be in different
> > > Application Pools. If not, then that is the problem.
>
> > > If the websites are in different Application Pools, then they should
> > > not be causing the other to crash or change its .Net Framework
> > > version.
>
> > > You are running a couple of 3rd party ISAPI Filters and Extensions
> > > (AuthXFlt and AuthXDB) for custom authentication. I consider 3rd party
> > > ISAPI DLLs suspect until proven otherwise.
>
> > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > //
>
> > > On Oct 19, 11:40 am, tim.cav...@gmail.com wrote:
>
> > > > I have a website that runs on the .net 1.1 framework. The site
> > > > crashes
> > > > randomly and I am having difficulty locating the root cause.
>
> > > > I have run iisstate after the most recent crash but I do not know
> > > > how
> > > > to interpret the dump file. The file is below. Any help is
> > > > appreciated.
>
> > > > The one that I am looking at is:
>
> > > > Thread ID: 26
> > > > System Thread ID: 14cc
> > > > Kernel Time: 0:0:0.0
> > > > User Time: 0:0:0.0
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for
> > > > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> > > > -
> > > > Thread Type: Managed Thread. Possible ASP.Net page or other .Net
> > > > worker
> > > > PDB symbol for mscorwks.dll not loaded
> > > > failed to load from resource.Failed to load SOS data.
> > > > No valid SOS data table found.
>
> > > > The site is supposed to run on the 1.1 framework and that's what it
> > > > shows under the ASP.net tab in IIS. We do have another site on the
> > > > same server that is running on the 2.0 framework. Could something on
> > > > that site be causing this other one to crash or think its supposed
> > > > to
> > > > be using the 2.0 framework?
>
> > > > Opened log file 'C:\iisstate\output\IISState-8104.log'
>
> > > > ***********************
> > > > Starting new log output
> > > > IISState version 3.3.1
>
> > > > Fri Oct 19 14:01:33 2007
>
> > > > OS = Windows 2003 Server
> > > > Executable: w3wp.exe
> > > > PID = 8104
>
> > > > Note: Thread times are formatted as HH:MM:SS.ms
>
> > > > ***********************
>
> > > > Thread ID: 0
> > > > System Thread ID: 186c
> > > > Kernel Time: 0:0:0.109
> > > > User Time: 0:0:0.109
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for C:\WINDOWS\system32\ntdll.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for C:\WINDOWS\system32\kernel32.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for c:\windows\system32\inetsrv\w3dt.dll -
> > > > *** ERROR: Module load completed but symbols could not be loaded for
> > > > c:
> > > > \windows\system32\inetsrv\w3wp.exe
> > > > Thread Type: Other
> > > > # ChildEBP RetAddr
> > > > WARNING: Stack unwind information not available. Following frames
> > > > may
> > > > be wrong.
> > > > 00 0006fc7c 77e61c8d ntdll!KiFastSystemCallRet
> > > > 01 0006fc90 5a364662 kernel32!WaitForSingleObject+0x12
> > > > 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=+0x1b31
> > > > 03 0006ff44 01001a27 w3wp+0x187c
> > > > 04 0006ffc0 77e6f23b w3wp+0x1a27
> > > > 05 0006fff0 00000000 kernel32!ProcessIdToSessionId+0x209
>
> > > > Thread ID: 1
> > > > System Thread ID: 1dec
> > > > Kernel Time: 0:0:0.0
> > > > User Time: 0:0:0.0
> > > > Thread Type: Other
> > > > # ChildEBP RetAddr
> > > > WARNING: Stack unwind information not available. Following frames
> > > > may
> > > > be wrong.
> > > > 00 0063ff48 7c80e4a2 ntdll!KiFastSystemCallRet
> > > > 01 0063ffb8 77e64829
> > > > ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
> > > > +0x301
> > > > 02 0063ffec 00000000 kernel32!GetModuleHandleA+0xdf
>
> > > > Thread ID: 2
> > > > System Thread ID: 1b60
> > > > Kernel Time: 0:0:0.0
> > > > User Time:
>
> ...
>
> read more »- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 23.10.2007 14:21:36 von tim.cavins

Pat,

Thanks for your response.

Here are the unloaded modules returned:

Unloaded modules:
771f0000 77201000 WINSTA.dll
770e0000 771e8000 SETUPAPI.dll
69500000 69517000 faultrep.dll
771f0000 77201000 WINSTA.dll
770e0000 771e8000 SETUPAPI.dll
69500000 69517000 faultrep.dll
5a300000 5a307000 W3TP.dll
5a400000 5a408000 W3CACHE.dll
67150000 67159000 HTTPAPI.dll
5a360000 5a36d000 w3dt.dll
5b640000 5b658000 strmfilt.dll
5a3f0000 5a3f6000 W3COMLOG.dll
62da0000 62da7000 LONSINT.dll
60ba0000 60bb1000 wamreg.DLL
5a420000 5a431000 IISMAP.dll
5a390000 5a3e8000 w3core.dll

The clrstack command did not return anything.

-Tim

On Oct 22, 5:18 pm, "Pat [MSFT]"
wrote:
> The crash occurred when .Net was trying to dereference a call to a COM/CO=
M+
> dll, which was no longer there (i.e. the dll may have unloaded out from
> under you). There are a couple of things to try:
>
> 1) type 'lm '. This will list all modules that are loaded and, mo=
re
> importantly, dll's that have unloaded. That may give you a hint to the
> culprit.
>
> 2) type '!\clr10\sos.clrstack ' which may dump out any managed code
> that is still on the stack (it may have all gone away at this point).
>
> Pat
>
> wrote in message
>
> news:1193057593.870969.165320@e34g2000pro.googlegroups.com.. .
> I set up my symbol path to be SRV*c:\websymbols*http://
> msdl.microsoft.com/download/symbols
>
> I ran .reload and then !analyze -v and got this. Is there something
> else I need to do?
>
> -Tim
>
> 0:000> !analyze -v
> ************************************************************ *************=
**=AD****
> *
> *
> * Exception
> Analysis *
> *
> *
> ************************************************************ *************=
**=AD****
>
> FAULTING_IP:
> mscorsvr!SafeRelease+4d
> 79241fac 8b07 mov eax,dword ptr [edi]
>
> EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> ExceptionAddress: 79241fac (mscorsvr!SafeRelease+0x0000004d)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000000
> Parameter[1]: 029df928
> Attempt to read from address 029df928
>
> DEFAULT_BUCKET_ID: INVALID_POINTER_READ
>
> PROCESS_NAME: w3wp.exe
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> READ_ADDRESS: 029df928
>
> NTGLOBALFLAG: 0
>
> APPLICATION_VERIFIER_FLAGS: 0
>
> LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> STACK_TEXT:
> 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!SafeRelease+0x4d
> 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!IUnkEntry::Free
> +0x7c
> 0006fb4c 79262e48 000bf0ac 044186c0 00000000 mscorsvr!
> ComPlusWrapper::ReleaseAllInterfaces+0xa
> 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> ComPlusWrapper::ReleaseAllInterfacesCallBack+0x121
> 0006fd90 7924ac00 0441d208 000bf0a8 0008ca78 mscorsvr!
> ComPlusWrapper::Cleanup+0x16
> 0006fda0 7924a63e 0444c508 0006fdd0 79263017 mscorsvr!
> ComPlusContextCleanupGroup::CleanUpWrappers+0x19
> 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> ComPlusApartmentCleanupGroup::ReleaseCleanupGroup+0xe
> 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!
> ComPlusApartmentCleanupGroup::CleanUpWrappers+0x7a
> 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!
> ComPlusWrapperCleanupList::CleanUpWrappers+0x69
> 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> ComPlusWrapperCache::ReleaseWrappers+0xf1
> 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> ComPlusWrapperCache::ReleaseComPlusWrappers+0x28
> 0006ff04 7924b8d0 00000000 0006ff20 79011628 mscorsvr!CoEEShutDownCOM
> +0x24
> 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CorExitProcess
> +0x38
> 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> +0x46
> 0006ff2c 77bcaefb fffffffe 00000000 fffffffe msvcrt!__crtExitProcess
> +0x29
> 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!_cinit+0xd2
> 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp!wmainCRTStartup
> +0x144
> 0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart
> +0x23
>
> STACK_COMMAND: ~0s; .ecxr ; kb
>
> FOLLOWUP_IP:
> mscorsvr!SafeRelease+4d
> 79241fac 8b07 mov eax,dword ptr [edi]
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: mscorsvr!SafeRelease+4d
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: mscorsvr
>
> IMAGE_NAME: mscorsvr.dll
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> FAULTING_THREAD: 00000d88
>
> PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ
>
> BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ
>
> FAILURE_BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!
> SafeRelease+4d
>
> BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!SafeRelease
> +4d
>
> Followup: MachineOwner
> ---------
>
> On Oct 20, 12:49 am, David Wang wrote:
>
>
>
> > Please make symbols available to properly resolve the stack backtrace.
>
> > You do not have access to symbols to run !analyze.
>
> > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > //
>
> > On Oct 19, 1:04 pm, tim.cav...@gmail.com wrote:
>
> > > Got a dump file at the time of a crash and ran !analyze -v on it.
>
> > > The following is the output. Any help is greatly appreciated.
>
> > > Tim
>
> > > 0:000> !analyze -v
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for ntdll.dll -
> > > ************************************************************ *********=
******=AD****
> > > *
> > > *
> > > * Exception
> > > Analysis *
> > > *
> > > *
> > > ************************************************************ *********=
******=AD****
>
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for mscoree.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for msvcrt.dll -
> > > *** ERROR: Module load completed but symbols could not be loaded for
> > > w3wp.exe
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for kernel32.dll -
> > > ***** OS symbols are WRONG. Please fix symbols to do analysis.
>
> > > ************************************************************ *********=
****
> > > ***
> > > ***
> > > ***
> > > ***
> > > *** Your debugger is not using the correct symbols
> > > ***
> > > ***
> > > ***
> > > *** In order for this command to work properly, your symbol path
> > > ***
> > > *** must point to .pdb files that have full type information.
> > > ***
> > > ***
> > > ***
> > > *** Certain .pdb files (such as the public OS symbols) do not
> > > ***
> > > *** contain the required information. Contact the group that
> > > ***
> > > *** provided you with these symbols if you need this command to
> > > ***
> > > *** work.
> > > ***
> > > ***
> > > ***
> > > *** Type referenced: ntdll!_PEB
> > > ***
> > > ***
> > > ***
> > > ************************************************************ *********=
****
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for ole32.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for mfc42.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for comsvcs.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for user32.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for browscap.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for LeakTrack.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for userenv.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for rpcrt4.dll -
> > > ************************************************************ *********=
****
> > > ***
> > > ***
> > > ***
> > > ***
> > > *** Your debugger is not using the correct symbols
> > > ***
> > > ***
> > > ***
> > > *** In order for this command to work properly, your symbol path
> > > ***
> > > *** must point to .pdb files that have full type information.
> > > ***
> > > ***
> > > ***
> > > *** Certain .pdb files (such as the public OS symbols) do not
> > > ***
> > > *** contain the required information. Contact the group that
> > > ***
> > > *** provided you with these symbols if you need this command to
> > > ***
> > > *** work.
> > > ***
> > > ***
> > > ***
> > > *** Type referenced: ntdll!_PEB
> > > ***
> > > ***
> > > ***
> > > ************************************************************ *********=
****
>
> > > FAULTING_IP:
> > > mscorsvr!CoUninitializeEE+1660
> > > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > > ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
> > > ExceptionCode: c0000005 (Access violation)
> > > ExceptionFlags: 00000000
> > > NumberParameters: 2
> > > Parameter[0]: 00000000
> > > Parameter[1]: 029df928
> > > Attempt to read from address 029df928
>
> > > DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> > > PROCESS_NAME: w3wp.exe
>
> > > FAULTING_MODULE: 7c800000 ntdll
>
> > > DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> > > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> > > referenced memory at "0x%08lx". The memory could not be "%s".
>
> > > READ_ADDRESS: 029df928
>
> > > BUGCHECK_STR: ACCESS_VIOLATION
>
> > > LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> > > STACK_TEXT:
> > > WARNING: Stack unwind information not available. Following frames may
> > > be wrong.
> > > 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
> > > +0x1660
> > > 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x3701
> > > 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x3737
> > > 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x365b
> > > 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
> > > +0x1771a
> > > 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
> > > +0x17756
> > > 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x3d25
> > > 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x42a0
> > > 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
> > > +0x24
> > > 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> > > +0x45
> > > 0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
> > > 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
> > > 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> > > 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
> > > 0006fff0 00000000 010018f8 00000000 78746341
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 25.10.2007 00:52:55 von patfilot

None of the dll's correspond to the address that was attempting to be
freed - which means that the address itself is bogus (i.e. memory corruption
occurred). That said, it looks like the process was in the the act of
shutting down and calling cleanup. This can be a very difficult problem to
track down. You can try doing a live debug & looking for exceptions
(specificall AV's) or you can try running IISState with the '-sc' flag set.

Pat

wrote in message
news:1193142096.710861.200390@k35g2000prh.googlegroups.com.. .
Pat,

Thanks for your response.

Here are the unloaded modules returned:

Unloaded modules:
771f0000 77201000 WINSTA.dll
770e0000 771e8000 SETUPAPI.dll
69500000 69517000 faultrep.dll
771f0000 77201000 WINSTA.dll
770e0000 771e8000 SETUPAPI.dll
69500000 69517000 faultrep.dll
5a300000 5a307000 W3TP.dll
5a400000 5a408000 W3CACHE.dll
67150000 67159000 HTTPAPI.dll
5a360000 5a36d000 w3dt.dll
5b640000 5b658000 strmfilt.dll
5a3f0000 5a3f6000 W3COMLOG.dll
62da0000 62da7000 LONSINT.dll
60ba0000 60bb1000 wamreg.DLL
5a420000 5a431000 IISMAP.dll
5a390000 5a3e8000 w3core.dll

The clrstack command did not return anything.

-Tim

On Oct 22, 5:18 pm, "Pat [MSFT]"
wrote:
> The crash occurred when .Net was trying to dereference a call to a
> COM/COM+
> dll, which was no longer there (i.e. the dll may have unloaded out from
> under you). There are a couple of things to try:
>
> 1) type 'lm '. This will list all modules that are loaded and,
> more
> importantly, dll's that have unloaded. That may give you a hint to the
> culprit.
>
> 2) type '!\clr10\sos.clrstack ' which may dump out any managed code
> that is still on the stack (it may have all gone away at this point).
>
> Pat
>
> wrote in message
>
> news:1193057593.870969.165320@e34g2000pro.googlegroups.com.. .
> I set up my symbol path to be SRV*c:\websymbols*http://
> msdl.microsoft.com/download/symbols
>
> I ran .reload and then !analyze -v and got this. Is there something
> else I need to do?
>
> -Tim
>
> 0:000> !analyze -v
> ************************************************************ *******************
> *
> *
> * Exception
> Analysis *
> *
> *
> ************************************************************ *******************
>
> FAULTING_IP:
> mscorsvr!SafeRelease+4d
> 79241fac 8b07 mov eax,dword ptr [edi]
>
> EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> ExceptionAddress: 79241fac (mscorsvr!SafeRelease+0x0000004d)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000000
> Parameter[1]: 029df928
> Attempt to read from address 029df928
>
> DEFAULT_BUCKET_ID: INVALID_POINTER_READ
>
> PROCESS_NAME: w3wp.exe
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> READ_ADDRESS: 029df928
>
> NTGLOBALFLAG: 0
>
> APPLICATION_VERIFIER_FLAGS: 0
>
> LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> STACK_TEXT:
> 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!SafeRelease+0x4d
> 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!IUnkEntry::Free
> +0x7c
> 0006fb4c 79262e48 000bf0ac 044186c0 00000000 mscorsvr!
> ComPlusWrapper::ReleaseAllInterfaces+0xa
> 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> ComPlusWrapper::ReleaseAllInterfacesCallBack+0x121
> 0006fd90 7924ac00 0441d208 000bf0a8 0008ca78 mscorsvr!
> ComPlusWrapper::Cleanup+0x16
> 0006fda0 7924a63e 0444c508 0006fdd0 79263017 mscorsvr!
> ComPlusContextCleanupGroup::CleanUpWrappers+0x19
> 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> ComPlusApartmentCleanupGroup::ReleaseCleanupGroup+0xe
> 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!
> ComPlusApartmentCleanupGroup::CleanUpWrappers+0x7a
> 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!
> ComPlusWrapperCleanupList::CleanUpWrappers+0x69
> 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> ComPlusWrapperCache::ReleaseWrappers+0xf1
> 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> ComPlusWrapperCache::ReleaseComPlusWrappers+0x28
> 0006ff04 7924b8d0 00000000 0006ff20 79011628 mscorsvr!CoEEShutDownCOM
> +0x24
> 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CorExitProcess
> +0x38
> 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> +0x46
> 0006ff2c 77bcaefb fffffffe 00000000 fffffffe msvcrt!__crtExitProcess
> +0x29
> 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!_cinit+0xd2
> 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp!wmainCRTStartup
> +0x144
> 0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart
> +0x23
>
> STACK_COMMAND: ~0s; .ecxr ; kb
>
> FOLLOWUP_IP:
> mscorsvr!SafeRelease+4d
> 79241fac 8b07 mov eax,dword ptr [edi]
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: mscorsvr!SafeRelease+4d
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: mscorsvr
>
> IMAGE_NAME: mscorsvr.dll
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> FAULTING_THREAD: 00000d88
>
> PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ
>
> BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ
>
> FAILURE_BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!
> SafeRelease+4d
>
> BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!SafeRelease
> +4d
>
> Followup: MachineOwner
> ---------
>
> On Oct 20, 12:49 am, David Wang wrote:
>
>
>
> > Please make symbols available to properly resolve the stack backtrace.
>
> > You do not have access to symbols to run !analyze.
>
> > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > //
>
> > On Oct 19, 1:04 pm, tim.cav...@gmail.com wrote:
>
> > > Got a dump file at the time of a crash and ran !analyze -v on it.
>
> > > The following is the output. Any help is greatly appreciated.
>
> > > Tim
>
> > > 0:000> !analyze -v
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for ntdll.dll -
> > > ************************************************************ *******************
> > > *
> > > *
> > > * Exception
> > > Analysis *
> > > *
> > > *
> > > ************************************************************ *******************
>
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for mscoree.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for msvcrt.dll -
> > > *** ERROR: Module load completed but symbols could not be loaded for
> > > w3wp.exe
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for kernel32.dll -
> > > ***** OS symbols are WRONG. Please fix symbols to do analysis.
>
> > > ************************************************************ *************
> > > ***
> > > ***
> > > ***
> > > ***
> > > *** Your debugger is not using the correct symbols
> > > ***
> > > ***
> > > ***
> > > *** In order for this command to work properly, your symbol path
> > > ***
> > > *** must point to .pdb files that have full type information.
> > > ***
> > > ***
> > > ***
> > > *** Certain .pdb files (such as the public OS symbols) do not
> > > ***
> > > *** contain the required information. Contact the group that
> > > ***
> > > *** provided you with these symbols if you need this command to
> > > ***
> > > *** work.
> > > ***
> > > ***
> > > ***
> > > *** Type referenced: ntdll!_PEB
> > > ***
> > > ***
> > > ***
> > > ************************************************************ *************
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for ole32.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for mfc42.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for comsvcs.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for user32.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for browscap.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for LeakTrack.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for userenv.dll -
> > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > symbols for rpcrt4.dll -
> > > ************************************************************ *************
> > > ***
> > > ***
> > > ***
> > > ***
> > > *** Your debugger is not using the correct symbols
> > > ***
> > > ***
> > > ***
> > > *** In order for this command to work properly, your symbol path
> > > ***
> > > *** must point to .pdb files that have full type information.
> > > ***
> > > ***
> > > ***
> > > *** Certain .pdb files (such as the public OS symbols) do not
> > > ***
> > > *** contain the required information. Contact the group that
> > > ***
> > > *** provided you with these symbols if you need this command to
> > > ***
> > > *** work.
> > > ***
> > > ***
> > > ***
> > > *** Type referenced: ntdll!_PEB
> > > ***
> > > ***
> > > ***
> > > ************************************************************ *************
>
> > > FAULTING_IP:
> > > mscorsvr!CoUninitializeEE+1660
> > > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > > ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
> > > ExceptionCode: c0000005 (Access violation)
> > > ExceptionFlags: 00000000
> > > NumberParameters: 2
> > > Parameter[0]: 00000000
> > > Parameter[1]: 029df928
> > > Attempt to read from address 029df928
>
> > > DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> > > PROCESS_NAME: w3wp.exe
>
> > > FAULTING_MODULE: 7c800000 ntdll
>
> > > DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> > > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> > > referenced memory at "0x%08lx". The memory could not be "%s".
>
> > > READ_ADDRESS: 029df928
>
> > > BUGCHECK_STR: ACCESS_VIOLATION
>
> > > LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> > > STACK_TEXT:
> > > WARNING: Stack unwind information not available. Following frames may
> > > be wrong.
> > > 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!CoUninitializeEE
> > > +0x1660
> > > 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x3701
> > > 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x3737
> > > 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x365b
> > > 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!CoEEShutDownCOM
> > > +0x1771a
> > > 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!CoEEShutDownCOM
> > > +0x17756
> > > 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x3d25
> > > 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> > > GetMetaDataPublicInterfaceFromInternal+0x42a0
> > > 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CoEEShutDownCOM
> > > +0x24
> > > 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> > > +0x45
> > > 0006ff2c 77bcaefc fffffffe 00000000 fffffffe msvcrt!strerror+0x2b41
> > > 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!initterm+0xf6
> > > 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> > > 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp+0x1a3c
> > > 0006fff0 00000000 010018f8 00000000 78746341
>
> ...
>
> read more »- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 01.11.2007 15:02:24 von tim.cavins

Pat,

Thanks again for your response.

Since we last spoke, we have seperated the two websites(A framework
20, B framework 1.1) on the server to two servers to help and
pinpoint the rootcause. Since doing this, the site that was
crashing(B) has not crashed once.

However, the site A that remained on the original machine has crashed
several times, when before it was not, or at least not being logged
via a debugger. Our belief is that the crash caused IIS to totally
reboot for both websites and during the reboot, IIS thought or made my
site B to be a 2.0 website even though it was not. Thus the errors of
InitializeCulture is not a member of... errors that I was getting
after it appeared my site had crashed. As odd as this sounds, its the
only explanation we could find that makes any sense as to why site B
was generating framework 2.0 errors after the crash.

We have found a 3rd party application in the site A that is the likely
culprit and will be meeting to discuss options with that.

If we discover more information I will try to update you and others as
quickly as I can.

I appreciate your time and help.

Tim

On Oct 24, 6:52 pm, "Pat [MSFT]"
wrote:
> None of the dll's correspond to the address that was attempting to be
> freed - which means that the address itself is bogus (i.e. memory corrupt=
ion
> occurred). That said, it looks like the process was in the the act of
> shutting down and calling cleanup. This can be a very difficult problem =
to
> track down. You can try doing a live debug & looking for exceptions
> (specificall AV's) or you can try running IISState with the '-sc' flag se=
t
>
> Pat
>
> wrote in message
>
> news:1193142096.710861.200390@k35g2000prh.googlegroups.com.. .
> Pat,
>
> Thanks for your response.
>
> Here are the unloaded modules returned:
>
> Unloaded modules:
> 771f0000 77201000 WINSTA.dll
> 770e0000 771e8000 SETUPAPI.dll
> 69500000 69517000 faultrep.dll
> 771f0000 77201000 WINSTA.dll
> 770e0000 771e8000 SETUPAPI.dll
> 69500000 69517000 faultrep.dll
> 5a300000 5a307000 W3TP.dll
> 5a400000 5a408000 W3CACHE.dll
> 67150000 67159000 HTTPAPI.dll
> 5a360000 5a36d000 w3dt.dll
> 5b640000 5b658000 strmfilt.dll
> 5a3f0000 5a3f6000 W3COMLOG.dll
> 62da0000 62da7000 LONSINT.dll
> 60ba0000 60bb1000 wamreg.DLL
> 5a420000 5a431000 IISMAP.dll
> 5a390000 5a3e8000 w3core.dll
>
> The clrstack command did not return anything.
>
> -Tim
>
> On Oct 22, 5:18 pm, "Pat [MSFT]"
> wrote:
>
>
>
> > The crash occurred when .Net was trying to dereference a call to a
> > COM/COM+
> > dll, which was no longer there (i.e. the dll may have unloaded out from
> > under you). There are a couple of things to try:
>
> > 1) type 'lm '. This will list all modules that are loaded and,
> > more
> > importantly, dll's that have unloaded. That may give you a hint to the
> > culprit.
>
> > 2) type '!\clr10\sos.clrstack ' which may dump out any managed c=
ode
> > that is still on the stack (it may have all gone away at this point).
>
> > Pat
>
> > wrote in message
>
> >news:1193057593.870969.165320@e34g2000pro.googlegroups.com. ..
> > I set up my symbol path to be SRV*c:\websymbols*http://
> > msdl.microsoft.com/download/symbols
>
> > I ran .reload and then !analyze -v and got this. Is there something
> > else I need to do?
>
> > -Tim
>
> > 0:000> !analyze -v
> > ************************************************************ ***********=
********
> > *
> > *
> > * Exception
> > Analysis *
> > *
> > *
> > ************************************************************ ***********=
********
>
> > FAULTING_IP:
> > mscorsvr!SafeRelease+4d
> > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > ExceptionAddress: 79241fac (mscorsvr!SafeRelease+0x0000004d)
> > ExceptionCode: c0000005 (Access violation)
> > ExceptionFlags: 00000000
> > NumberParameters: 2
> > Parameter[0]: 00000000
> > Parameter[1]: 029df928
> > Attempt to read from address 029df928
>
> > DEFAULT_BUCKET_ID: INVALID_POINTER_READ
>
> > PROCESS_NAME: w3wp.exe
>
> > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> > referenced memory at "0x%08lx". The memory could not be "%s".
>
> > READ_ADDRESS: 029df928
>
> > NTGLOBALFLAG: 0
>
> > APPLICATION_VERIFIER_FLAGS: 0
>
> > LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> > STACK_TEXT:
> > 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!SafeRelease+0x4d
> > 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!IUnkEntry::Free
> > +0x7c
> > 0006fb4c 79262e48 000bf0ac 044186c0 00000000 mscorsvr!
> > ComPlusWrapper::ReleaseAllInterfaces+0xa
> > 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> > ComPlusWrapper::ReleaseAllInterfacesCallBack+0x121
> > 0006fd90 7924ac00 0441d208 000bf0a8 0008ca78 mscorsvr!
> > ComPlusWrapper::Cleanup+0x16
> > 0006fda0 7924a63e 0444c508 0006fdd0 79263017 mscorsvr!
> > ComPlusContextCleanupGroup::CleanUpWrappers+0x19
> > 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> > ComPlusApartmentCleanupGroup::ReleaseCleanupGroup+0xe
> > 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!
> > ComPlusApartmentCleanupGroup::CleanUpWrappers+0x7a
> > 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!
> > ComPlusWrapperCleanupList::CleanUpWrappers+0x69
> > 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> > ComPlusWrapperCache::ReleaseWrappers+0xf1
> > 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> > ComPlusWrapperCache::ReleaseComPlusWrappers+0x28
> > 0006ff04 7924b8d0 00000000 0006ff20 79011628 mscorsvr!CoEEShutDownCOM
> > +0x24
> > 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CorExitProcess
> > +0x38
> > 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> > +0x46
> > 0006ff2c 77bcaefb fffffffe 00000000 fffffffe msvcrt!__crtExitProcess
> > +0x29
> > 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!_cinit+0xd2
> > 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> > 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp!wmainCRTStartup
> > +0x144
> > 0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart
> > +0x23
>
> > STACK_COMMAND: ~0s; .ecxr ; kb
>
> > FOLLOWUP_IP:
> > mscorsvr!SafeRelease+4d
> > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > SYMBOL_STACK_INDEX: 0
>
> > SYMBOL_NAME: mscorsvr!SafeRelease+4d
>
> > FOLLOWUP_NAME: MachineOwner
>
> > MODULE_NAME: mscorsvr
>
> > IMAGE_NAME: mscorsvr.dll
>
> > DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> > FAULTING_THREAD: 00000d88
>
> > PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ
>
> > BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ
>
> > FAILURE_BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!
> > SafeRelease+4d
>
> > BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!SafeRelease
> > +4d
>
> > Followup: MachineOwner
> > ---------
>
> > On Oct 20, 12:49 am, David Wang wrote:
>
> > > Please make symbols available to properly resolve the stack backtrace.
>
> > > You do not have access to symbols to run !analyze.
>
> > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > //
>
> > > On Oct 19, 1:04 pm, tim.cav...@gmail.com wrote:
>
> > > > Got a dump file at the time of a crash and ran !analyze -v on it.
>
> > > > The following is the output. Any help is greatly appreciated.
>
> > > > Tim
>
> > > > 0:000> !analyze -v
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for ntdll.dll -
> > > > ************************************************************ *******=
************
> > > > *
> > > > *
> > > > * Exception
> > > > Analysis *
> > > > *
> > > > *
> > > > ************************************************************ *******=
************
>
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for mscoree.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for msvcrt.dll -
> > > > *** ERROR: Module load completed but symbols could not be loaded for
> > > > w3wp.exe
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for kernel32.dll -
> > > > ***** OS symbols are WRONG. Please fix symbols to do analysis.
>
> > > > ************************************************************ *******=
******
> > > > ***
> > > > ***
> > > > ***
> > > > ***
> > > > *** Your debugger is not using the correct symbols
> > > > ***
> > > > ***
> > > > ***
> > > > *** In order for this command to work properly, your symbol path
> > > > ***
> > > > *** must point to .pdb files that have full type information.
> > > > ***
> > > > ***
> > > > ***
> > > > *** Certain .pdb files (such as the public OS symbols) do not
> > > > ***
> > > > *** contain the required information. Contact the group that
> > > > ***
> > > > *** provided you with these symbols if you need this command to
> > > > ***
> > > > *** work.
> > > > ***
> > > > ***
> > > > ***
> > > > *** Type referenced: ntdll!_PEB
> > > > ***
> > > > ***
> > > > ***
> > > > ************************************************************ *******=
******
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for ole32.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for mfc42.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for comsvcs.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for user32.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for browscap.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for LeakTrack.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for userenv.dll -
> > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > symbols for rpcrt4.dll -
> > > > ************************************************************ *******=
******
> > > > ***
> > > > ***
> > > > ***
> > > > ***
> > > > *** Your debugger is not using the correct symbols
> > > > ***
> > > > ***
> > > > ***
> > > > *** In order for this command to work properly, your symbol path
> > > > ***
> > > > *** must point to .pdb files that have full type information.
> > > > ***
> > > > ***
> > > > ***
> > > > *** Certain .pdb files (such as the public OS symbols) do not
> > > > ***
> > > > *** contain the required information. Contact the group that
> > > > ***
> > > > *** provided you with these symbols if you need this command to
> > > > ***
> > > > *** work.
> > > > ***
> > > > ***
> > > > ***
> > > > *** Type referenced: ntdll!_PEB
> > > > ***
> > > > ***
> > > > ***
> > > > ************************************************************ *******=
******
>
> > > > FAULTING_IP:
> > > > mscorsvr!CoUninitializeEE+1660
> > > > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > > > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > > > ExceptionAddress: 79241fac (mscorsvr!CoUninitializeEE+0x00001660)
> > > > ExceptionCode: c0000005 (Access violation)
> > > > ExceptionFlags: 00000000
> > > > NumberParameters: 2
> > > > Parameter[0]: 00000000
> > > > Parameter[1]: 029df928
> > > > Attempt to read from address 029df928
>
> > > > DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> > > > PROCESS_NAME:
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: Website crash iisstate log help

am 01.11.2007 18:18:32 von David Wang

When you say you "separated the two websites on the server to two
servers", do you mean that you created two Application Pools, one for
Framework 1.1, the other for Framework 2.0, and assigned each website
to its own Application Pool for proper isolation?

If you did not, then please do that. Running multiple .Net Framework
versions in the process is not supported and can result in random
crashes/behaviors, depending on which framework loaded first.

No .Net Framework crash on IIS6 in worker process isolation mode (what
you are currently running) will cause IIS to "totally reboot" for
anything, and IIS does not assign .Net Framework version to any site
nor change them.

What can happen is that if the application's code is running inside
the same process, crashes by one application will affect any other
application in the same process. However, when you isolate code with
different Application Pools (and hence different processes), crashes
in one application in one process won't affect applications in another
process (not totally true, but the minor detail doesn't affect you
here. For all practical purposes, I want you to think "Application
Pool is Application Isolation").

To phrase it another way -- treat applications like kids, and
Application Pools as sandboxes. You put two applications in the same
Application Pool, they may interact and stomp on each other -- like
two kids bothering each other in the same sandbox. You put a kid in
each sandbox, and they're not going to bother each other (unless one
kid starts finds out about the other sandbox and starts throwing
things at it...)

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

On Nov 1, 7:02 am, Tim wrote:
> Pat,
>
> Thanks again for your response.
>
> Since we last spoke, we have seperated the two websites(A framework
> 2.0, B framework 1.1) on the server to two servers to help and
> pinpoint the rootcause. Since doing this, the site that was
> crashing(B) has not crashed once.
>
> However, the site A that remained on the original machine has crashed
> several times, when before it was not, or at least not being logged
> via a debugger. Our belief is that the crash caused IIS to totally
> reboot for both websites and during the reboot, IIS thought or made my
> site B to be a 2.0 website even though it was not. Thus the errors of
> InitializeCulture is not a member of... errors that I was getting
> after it appeared my site had crashed. As odd as this sounds, its the
> only explanation we could find that makes any sense as to why site B
> was generating framework 2.0 errors after the crash.
>
> We have found a 3rd party application in the site A that is the likely
> culprit and will be meeting to discuss options with that.
>
> If we discover more information I will try to update you and others as
> quickly as I can.
>
> I appreciate your time and help.
>
> Tim
>
> On Oct 24, 6:52 pm, "Pat [MSFT]"
> wrote:
>
>
>
> > None of the dll's correspond to the address that was attempting to be
> > freed - which means that the address itself is bogus (i.e. memory corru=
ption
> > occurred). That said, it looks like the process was in the the act of
> > shutting down and calling cleanup. This can be a very difficult proble=
m to
> > track down. You can try doing a live debug & looking for exceptions
> > (specificall AV's) or you can try running IISState with the '-sc' flag =
set.
>
> > Pat
>
> > wrote in message
>
> >news:1193142096.710861.200390@k35g2000prh.googlegroups.com. ..
> > Pat,
>
> > Thanks for your response.
>
> > Here are the unloaded modules returned:
>
> > Unloaded modules:
> > 771f0000 77201000 WINSTA.dll
> > 770e0000 771e8000 SETUPAPI.dll
> > 69500000 69517000 faultrep.dll
> > 771f0000 77201000 WINSTA.dll
> > 770e0000 771e8000 SETUPAPI.dll
> > 69500000 69517000 faultrep.dll
> > 5a300000 5a307000 W3TP.dll
> > 5a400000 5a408000 W3CACHE.dll
> > 67150000 67159000 HTTPAPI.dll
> > 5a360000 5a36d000 w3dt.dll
> > 5b640000 5b658000 strmfilt.dll
> > 5a3f0000 5a3f6000 W3COMLOG.dll
> > 62da0000 62da7000 LONSINT.dll
> > 60ba0000 60bb1000 wamreg.DLL
> > 5a420000 5a431000 IISMAP.dll
> > 5a390000 5a3e8000 w3core.dll
>
> > The clrstack command did not return anything.
>
> > -Tim
>
> > On Oct 22, 5:18 pm, "Pat [MSFT]"
> > wrote:
>
> > > The crash occurred when .Net was trying to dereference a call to a
> > > COM/COM+
> > > dll, which was no longer there (i.e. the dll may have unloaded out fr=
om
> > > under you). There are a couple of things to try:
>
> > > 1) type 'lm '. This will list all modules that are loaded and,
> > > more
> > > importantly, dll's that have unloaded. That may give you a hint to t=
he
> > > culprit.
>
> > > 2) type '!\clr10\sos.clrstack ' which may dump out any managed=
code
> > > that is still on the stack (it may have all gone away at this point).
>
> > > Pat
>
> > > wrote in message
>
> > >news:1193057593.870969.165320@e34g2000pro.googlegroups.com. ..
> > > I set up my symbol path to be SRV*c:\websymbols*http://
> > > msdl.microsoft.com/download/symbols
>
> > > I ran .reload and then !analyze -v and got this. Is there something
> > > else I need to do?
>
> > > -Tim
>
> > > 0:000> !analyze -v
> > > ************************************************************ *********=
******=AD****
> > > *
> > > *
> > > * Exception
> > > Analysis *
> > > *
> > > *
> > > ************************************************************ *********=
******=AD****
>
> > > FAULTING_IP:
> > > mscorsvr!SafeRelease+4d
> > > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > > ExceptionAddress: 79241fac (mscorsvr!SafeRelease+0x0000004d)
> > > ExceptionCode: c0000005 (Access violation)
> > > ExceptionFlags: 00000000
> > > NumberParameters: 2
> > > Parameter[0]: 00000000
> > > Parameter[1]: 029df928
> > > Attempt to read from address 029df928
>
> > > DEFAULT_BUCKET_ID: INVALID_POINTER_READ
>
> > > PROCESS_NAME: w3wp.exe
>
> > > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> > > referenced memory at "0x%08lx". The memory could not be "%s".
>
> > > READ_ADDRESS: 029df928
>
> > > NTGLOBALFLAG: 0
>
> > > APPLICATION_VERIFIER_FLAGS: 0
>
> > > LAST_CONTROL_TRANSFER: from 7924ac60 to 79241fac
>
> > > STACK_TEXT:
> > > 0006fb24 7924ac60 00000000 00000000 044186c0 mscorsvr!SafeRelease+0x4d
> > > 0006fb40 7924ac96 00000001 044186c0 79262e48 mscorsvr!IUnkEntry::Free
> > > +0x7c
> > > 0006fb4c 79262e48 000bf0ac 044186c0 00000000 mscorsvr!
> > > ComPlusWrapper::ReleaseAllInterfaces+0xa
> > > 0006fd84 7924abba 044186c0 000bf4ac 7924ac00 mscorsvr!
> > > ComPlusWrapper::ReleaseAllInterfacesCallBack+0x121
> > > 0006fd90 7924ac00 0441d208 000bf0a8 0008ca78 mscorsvr!
> > > ComPlusWrapper::Cleanup+0x16
> > > 0006fda0 7924a63e 0444c508 0006fdd0 79263017 mscorsvr!
> > > ComPlusContextCleanupGroup::CleanUpWrappers+0x19
> > > 0006fdac 79263017 000bf0a8 00000000 00000001 mscorsvr!
> > > ComPlusApartmentCleanupGroup::ReleaseCleanupGroup+0xe
> > > 0006fdd0 79263053 00000000 03e88494 04404858 mscorsvr!
> > > ComPlusApartmentCleanupGroup::CleanUpWrappers+0x7a
> > > 0006fe08 7924b284 7ffd4000 00000000 00000001 mscorsvr!
> > > ComPlusWrapperCleanupList::CleanUpWrappers+0x69
> > > 0006fecc 7924b7ff 00000000 00000000 793eda14 mscorsvr!
> > > ComPlusWrapperCache::ReleaseWrappers+0xf1
> > > 0006fefc 7924b921 00000000 7924b8d0 00000000 mscorsvr!
> > > ComPlusWrapperCache::ReleaseComPlusWrappers+0x28
> > > 0006ff04 7924b8d0 00000000 0006ff20 79011628 mscorsvr!CoEEShutDownCOM
> > > +0x24
> > > 0006ff10 79011628 fffffffe 791b0000 0006ff2c mscorsvr!CorExitProcess
> > > +0x38
> > > 0006ff20 77bcaddb fffffffe 0006ff5c 77bcaefc mscoree!CorExitProcess
> > > +0x46
> > > 0006ff2c 77bcaefb fffffffe 00000000 fffffffe msvcrt!__crtExitProcess
> > > +0x29
> > > 0006ff5c 77bcaf52 fffffffe 00000000 00000000 msvcrt!_cinit+0xd2
> > > 0006ff70 01001a3c fffffffe 00000000 00000000 msvcrt!exit+0x11
> > > 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 w3wp!wmainCRTStartup
> > > +0x144
> > > 0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart
> > > +0x23
>
> > > STACK_COMMAND: ~0s; .ecxr ; kb
>
> > > FOLLOWUP_IP:
> > > mscorsvr!SafeRelease+4d
> > > 79241fac 8b07 mov eax,dword ptr [edi]
>
> > > SYMBOL_STACK_INDEX: 0
>
> > > SYMBOL_NAME: mscorsvr!SafeRelease+4d
>
> > > FOLLOWUP_NAME: MachineOwner
>
> > > MODULE_NAME: mscorsvr
>
> > > IMAGE_NAME: mscorsvr.dll
>
> > > DEBUG_FLR_IMAGE_TIMESTAMP: 46205108
>
> > > FAULTING_THREAD: 00000d88
>
> > > PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ
>
> > > BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ
>
> > > FAILURE_BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!
> > > SafeRelease+4d
>
> > > BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_mscorsvr!SafeRelea=
se
> > > +4d
>
> > > Followup: MachineOwner
> > > ---------
>
> > > On Oct 20, 12:49 am, David Wang wrote:
>
> > > > Please make symbols available to properly resolve the stack backtra=
ce.
>
> > > > You do not have access to symbols to run !analyze.
>
> > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > > //
>
> > > > On Oct 19, 1:04 pm, tim.cav...@gmail.com wrote:
>
> > > > > Got a dump file at the time of a crash and ran !analyze -v on it.
>
> > > > > The following is the output. Any help is greatly appreciated.
>
> > > > > Tim
>
> > > > > 0:000> !analyze -v
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for ntdll.dll -
> > > > > ************************************************************ *****=
**********=AD****
> > > > > *
> > > > > *
> > > > > * Exception
> > > > > Analysis *
> > > > > *
> > > > > *
> > > > > ************************************************************ *****=
**********=AD****
>
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for mscoree.dll -
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for msvcrt.dll -
> > > > > *** ERROR: Module load completed but symbols could not be loaded =
for
> > > > > w3wp.exe
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for kernel32.dll -
> > > > > ***** OS symbols are WRONG. Please fix symbols to do analysis.
>
> > > > > ************************************************************ *****=
********
> > > > > ***
> > > > > ***
> > > > > ***
> > > > > ***
> > > > > *** Your debugger is not using the correct symbols
> > > > > ***
> > > > > ***
> > > > > ***
> > > > > *** In order for this command to work properly, your symbol pa=
th
> > > > > ***
> > > > > *** must point to .pdb files that have full type information.
> > > > > ***
> > > > > ***
> > > > > ***
> > > > > *** Certain .pdb files (such as the public OS symbols) do not
> > > > > ***
> > > > > *** contain the required information. Contact the group that
> > > > > ***
> > > > > *** provided you with these symbols if you need this command to
> > > > > ***
> > > > > *** work.
> > > > > ***
> > > > > ***
> > > > > ***
> > > > > *** Type referenced: ntdll!_PEB
> > > > > ***
> > > > > ***
> > > > > ***
> > > > > ************************************************************ *****=
********
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for ole32.dll -
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for mfc42.dll -
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for comsvcs.dll -
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for user32.dll -
> > > > > *** ERROR: Symbol file could not be found. Defaulted to export
> > > > > symbols for browscap.dll -
> > > > > *** ERROR: Symbol file could not be found. Defaulted to
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -