IIS crashes - log analysis help appreciated!

David Wang

2007-03-21 20:14:25 UTC

What 3rd party components are running in this Application Pool.

Can you capture additional crashes to verify that we get the same
stack.

Can you also check your symbols configuration because many key
components did not resolve properly.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Post by DM
Hello,
Every now and then one of our IIS servers crashes. Usually we get the
A process serving application pool 'DefaultAppPool' suffered a fatal
communication error with the World Wide Web Publishing Service. The process
id was '7932'.
Error: File [filename] Unexpected error. A trappable error (C0000005)
occurred in an external object. The script cannot continue running..
I ran an IISDiag and was able to extract the following information from a
crash dump. However it doesn't help me much so if anyone has any ideas as to
why IIS is crashing I would be forever grateful!
Type of Analysis Performed Crash Analysis
Machine Name [edited out]
Operating System Windows Server 2003 Service Pack 1
Number Of Processors 2
Process ID 884
Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
System Up-Time 37 day(s) 01:07:24
Process Up-Time 0 day(s) 00:15:45
Thread 6 - System ID 7140
Entry point w3tp+1d80
Create time 2007-03-21 11:37:39
Time spent in user mode 0 Days 0:0:0.140
Time spent in kernel mode 0 Days 0:0:0.187
Function Arg 1 Arg 2 Arg 3 Source
ntdll!KiRaiseUserExceptionDispatcher+37 7c821144 71ca3d15
00000b30
ntdll!KiFastSystemCallRet 04300c38 71ced558 00d9f980
kerberos!KerbFree+23f1 04300c38 00d9f9c0 7c831ff0
kerberos!KerbFree+250d 01dd70f0 00d9f9c0 00d9f9ac
secur32!EncryptMessage+75 00d9f9c0 00000000 000c0288
secur32!DeleteSecurityContext+83 00d9f9c0 00000000 01251ef0
secur32!DeleteSecurityContext+38 01251f08 00000000 01251ef0
w3core!W3_FILE_INFO_CACHE::GetFileCache+a4d9 00000001 0025af88
00da48c8
w3core!W3_FILE_INFO_CACHE::GetFileCache+7ced 00da48c8 00000000
0025a398
w3core!W3_FILE_INFO_CACHE::GetFileInfo+4df4 00da48c8 00000000
00000000
w3core+2264 00000000 00000000 00000000
w3core+65ea 00da3e00 00da3e00 5a361650
w3dt!UlAtqAllocateMemory+16f 00000311 00000000 00da3e04
w3dt!UlAtqAllocateMemory+19a 00000000 00000311 00da3e04
w3tp!THREAD_POOL::PostCompletion+c9 00000000 002586e8 5a300000
w3tp!THREAD_POOL::~THREAD_POOL+153 00258578 00000000 00000000
w3tp+1db9 002586e8 00000000 00000000
kernel32!GetModuleFileNameA+eb 5a301d80 002586e8 00000000
In
w3wp__PID__884__Date__03_21_2007__Time_11_53_24AM__427__Second_Chance_Exception_C0000008.dmp
the assembly instruction at ntdll!KiRaiseUserExceptionDispatcher+37 in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
unknown exception (0xc0000008) on thread 6