IIS stops responding. Only option is reboot

IIS stops processing pages of any sort. Even the "under contruction"
iisstart.htm file. I have this problem on two servers on occassion. One
runs only OWA for Exchange 2003 and the other runs only the Trend Micro
Office Scan console. On both servers I cannot load any pages at all when
this occurs. Restarting any and all services I can think of does nothing.
Event logs are show nothing for w3svc, active server pages, exchange, etc.
c:\windows\system32\logfiles\w3svc logs just stop logging any information.

I will focus on the Exchange server IIS first since I care about that much
more. httperr logs just start showing "connection refused" over and over
except for just this error 1 hour and 20 minutes before the connection
refused entries started, but it doesn't seem related.

2007-11-07 05:21:43 75.202.249.90 1661 222.1.1.11 80 HTTP/1.1 POST
/Microsoft-Server-ActiveSync?User=kss&DeviceId=367CF17C12E16 38ABED35659A7ACDF04&DeviceType=PocketPC&Cmd=Ping
- 1 Connection_Dropped ExchangeApplicationPool
...........................
2007-11-07 06:27:53 - - - - - - - - - 1_Connections_Refused -
2007-11-07 06:27:58 - - - - - - - - - 1_Connections_Refused -
2007-11-07 06:28:43 - - - - - - - - - 1_Connections_Refused -

The logfiles\w3svc logs stop logging OWA hits at 6:26:41 and Exchange Active
Sync connections at 6:33:23

WWW service often takes about 45 seconds to restart when in this state, but
I cannot find any errors anywhere while, before or after its restart.

Any suggestions on where else to look?

kevin

Re: IIS stops responding. Only option is reboot

On Nov 7, 2:27 pm, "Kevin Nickell" wrote:
> IIS stops processing pages of any sort. Even the "under contruction"
> iisstart.htm file. I have this problem on two servers on occassion. One
> runs only OWA for Exchange 2003 and the other runs only the Trend Micro
> Office Scan console. On both servers I cannot load any pages at all when
> this occurs. Restarting any and all services I can think of does nothing.
> Event logs are show nothing for w3svc, active server pages, exchange, etc.
> c:\windows\system32\logfiles\w3svc logs just stop logging any information.
>
> I will focus on the Exchange server IIS first since I care about that much
> more. httperr logs just start showing "connection refused" over and over
> except for just this error 1 hour and 20 minutes before the connection
> refused entries started, but it doesn't seem related.
>
> 2007-11-07 05:21:43 75.202.249.90 1661 222.1.1.11 80 HTTP/1.1 POST
> /Microsoft-Server-ActiveSync?User=3Dkss&DeviceId=3D367CF17C1 2E1638ABED356=
59A7AC=ADDF04&DeviceType=3DPocketPC&Cmd=3DPing
> - 1 Connection_Dropped ExchangeApplicationPool
> ..........................
> 2007-11-07 06:27:53 - - - - - - - - - 1_Connections_Refused -
> 2007-11-07 06:27:58 - - - - - - - - - 1_Connections_Refused -
> 2007-11-07 06:28:43 - - - - - - - - - 1_Connections_Refused -
>
> The logfiles\w3svc logs stop logging OWA hits at 6:26:41 and Exchange Act=
ive
> Sync connections at 6:33:23
>
> WWW service often takes about 45 seconds to restart when in this state, b=
ut
> I cannot find any errors anywhere while, before or after its restart.
>
> Any suggestions on where else to look?
>
> kevin



http://blogs.msdn.com/david.wang/archive/2005/09/21/HOWTO-Di agnose-IIS6-fai=
ling-to-accept-connections-due-to-Connections-Refused.aspx


Determine the tag that is leaking the most nonpaged pool memory and
track it down. Most likely not a problem with IIS but something else
running on your server -- frequent culprits include anti-virus,
network driver.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Re: IIS stops responding. Only option is reboot

OK, I have identified two hogs of nonpaged memory, but cannot figure out
what they are and the pooltag.txt gives nothing to help

The tags are:
ddk
thre

Any ideas what these are?

Kevin

"David Wang" wrote in message
news:1194518256.814109.116250@k35g2000prh.googlegroups.com.. .
On Nov 7, 2:27 pm, "Kevin Nickell" wrote:
> IIS stops processing pages of any sort. Even the "under contruction"
> iisstart.htm file. I have this problem on two servers on occassion. One
> runs only OWA for Exchange 2003 and the other runs only the Trend Micro
> Office Scan console. On both servers I cannot load any pages at all when
> this occurs. Restarting any and all services I can think of does nothing.
> Event logs are show nothing for w3svc, active server pages, exchange, etc.
> c:\windows\system32\logfiles\w3svc logs just stop logging any information.
>
> I will focus on the Exchange server IIS first since I care about that much
> more. httperr logs just start showing "connection refused" over and over
> except for just this error 1 hour and 20 minutes before the connection
> refused entries started, but it doesn't seem related.
>
> 2007-11-07 05:21:43 75.202.249.90 1661 222.1.1.11 80 HTTP/1.1 POST
> /Microsoft-Server-ActiveSync?User=kss&DeviceId=367CF17C12E16 38ABED35659A7AC­DF04&DeviceType=PocketPC&Cmd=Ping
> - 1 Connection_Dropped ExchangeApplicationPool
> ..........................
> 2007-11-07 06:27:53 - - - - - - - - - 1_Connections_Refused -
> 2007-11-07 06:27:58 - - - - - - - - - 1_Connections_Refused -
> 2007-11-07 06:28:43 - - - - - - - - - 1_Connections_Refused -
>
> The logfiles\w3svc logs stop logging OWA hits at 6:26:41 and Exchange
> Active
> Sync connections at 6:33:23
>
> WWW service often takes about 45 seconds to restart when in this state,
> but
> I cannot find any errors anywhere while, before or after its restart.
>
> Any suggestions on where else to look?
>
> kevin



http://blogs.msdn.com/david.wang/archive/2005/09/21/HOWTO-Di agnose-IIS6-failing-to-accept-connections-due-to-Connections -Refused.aspx


Determine the tag that is leaking the most nonpaged pool memory and
track it down. Most likely not a problem with IIS but something else
running on your server -- frequent culprits include anti-virus,
network driver.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Re: IIS stops responding. Only option is reboot

The comments from my blog post have a lot of tips on how to track down
the driver owning those tags.

You can also read:
http://www.microsoft.com/whdc/Driver/tips/PoolMem.mspx

As well as this excellent post:
http://blogs.msdn.com/ntdebugging/archive/2006/12/18/Underst anding-Pool-Con=
sumption-and-Event-ID_3A00_--2020-or-2019.aspx

The blog entry says that "Thre" is due to thread allocation -- so some
process has excess number of threads, which you can use a kernel
debugger or Task Manager to figure it out.

In particular, people's comments on that page have indicated that
"Trend Micro Office Scan" as well as various OEM monitoring modules
often leak threads/non-paged pool memory and is the cause of these
reboots.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//








On Nov 8, 12:26 pm, "Kevin Nickell" wrote:
> OK, I have identified two hogs of nonpaged memory, but cannot figure out
> what they are and the pooltag.txt gives nothing to help
>
> The tags are:
> ddk
> thre
>
> Any ideas what these are?
>
> Kevin
>
> "David Wang" wrote in message
>
> news:1194518256.814109.116250@k35g2000prh.googlegroups.com.. .
> On Nov 7, 2:27 pm, "Kevin Nickell" wrote:
>
>
>
>
>
> > IIS stops processing pages of any sort. Even the "under contruction"
> > iisstart.htm file. I have this problem on two servers on occassion. O=
ne
> > runs only OWA for Exchange 2003 and the other runs only the Trend Micro
> > Office Scan console. On both servers I cannot load any pages at all wh=
en
> > this occurs. Restarting any and all services I can think of does nothi=
ng.
> > Event logs are show nothing for w3svc, active server pages, exchange, e=
tc.
> > c:\windows\system32\logfiles\w3svc logs just stop logging any informati=
on.
>
> > I will focus on the Exchange server IIS first since I care about that m=
uch
> > more. httperr logs just start showing "connection refused" over and ov=
er
> > except for just this error 1 hour and 20 minutes before the connection
> > refused entries started, but it doesn't seem related.
>
> > 2007-11-07 05:21:43 75.202.249.90 1661 222.1.1.11 80 HTTP/1.1 POST
> > /Microsoft-Server-ActiveSync?User=3Dkss&DeviceId=3D367CF17C1 2E1638ABED3=
5659A7AC­­DF04&DeviceType=3DPocketPC&Cmd=3DPing
> > - 1 Connection_Dropped ExchangeApplicationPool
> > ..........................
> > 2007-11-07 06:27:53 - - - - - - - - - 1_Connections_Refused -
> > 2007-11-07 06:27:58 - - - - - - - - - 1_Connections_Refused -
> > 2007-11-07 06:28:43 - - - - - - - - - 1_Connections_Refused -
>
> > The logfiles\w3svc logs stop logging OWA hits at 6:26:41 and Exchange
> > Active
> > Sync connections at 6:33:23
>
> > WWW service often takes about 45 seconds to restart when in this state,
> > but
> > I cannot find any errors anywhere while, before or after its restart.
>
> > Any suggestions on where else to look?
>
> > kevin
>
> http://blogs.msdn.com/david.wang/archive/2005/09/21/HOWTO-Di agnose-II...
>
> Determine the tag that is leaking the most nonpaged pool memory and
> track it down. Most likely not a problem with IIS but something else
> running on your server -- frequent culprits include anti-virus,
> network driver.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //- Hide quoted text -
>
> - Show quoted text -