IIS Websites (server side) keeps freezing up, Need to isolate/troubleshoot application pool

Posted on 2008-10-01
Last Modified: 2012-05-05
Hi Friends,

I really appreciate expert troubleshooting advise on this.

There are about 200 Host Header sites on this IIS server.
Note that this server also has Perl CGI, ISAPI, and PHP5.
When the problem occurs, as far as I can tell, very quickly all the sites become unresponsive.
My fix thus far has been to simply restart the www NT service.

I have found 3 interesting sets of problems in the eventlogs:

1.      There is some policy that keep causing errors, related to mapping print drivers in kernel mode for anyone who uses terminal services
2.      There are lots of ASP.NET errors (mostly from one site in particular), which provide the process ID for the associated w3wp.exe
3.      There are lots of DNS update errors (attempting to update the Active Directory name FQDN of this server) and redirector failing as a result

1. Isolate the website I suspect as the cause, from the default app pool.  HOW DO I DO THIS??

(this way, I will be able to map the process ID to the w3wp.exe using IISApp.vbs or 'Process Explorer', and if that one has all the CPU cycles, that should be conclusive proof ---- but right now I only have 2 process threads for w3wp.exe, because they are all in a shared pool under the default parent root).

2. Could Performance Monitor help me?

Thanks in advance for any advise!

Here is a sample of the events I found in the APP and SYS logs:
Event ID: 1309
Event code: 3005 
Thread information: 
    Thread ID: 8 
    Thread account name: NT AUTHORITY\NETWORK SERVICE 
    Is impersonating: False 
    Stack trace: at System.Web.HttpForbiddenHandler.ProcessRequest(HttpContext context) at Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Event ID: 1111
Kernel Mode Printer blocking policy is enabled. The attempt for Microsoft XPS Document Writer (from hostname) in session 1 to use a Kernel Mode driver failed.
Event ID: 5789
Attempt to update DNS Host Name of the computer object in Active Directory failed. The updated value was 'XXX.YYY.ZZZ' (FQDN). The following error occurred: 
The parameter is incorrect. 
Event ID: 1074
A worker process with process id of '2096' serving application pool 'DefaultAppPool' has requested a recycle because the worker process reached its allowed processing time limit.
Event ID: 50
{Delayed Write Failed} Windows was unable to save all the data for the file \Device\LanmanRedirector. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event ID: 55
Kernel Mode Printer blocking policy is enabled. The attempt for Microsoft XPS Document Writer (from XXXX) - HOSTNAME in session 3 to use a Kernel Mode driver failed.

Open in new window

Question by:ksuchy
  • 2

Expert Comment

ID: 22618570
Actually, it may not be IIS at all.  Are there lots of the "{Delayed Write Failed}" error messages in your event log?  Check to see if you see one or more of them close to the time that apps become non-responsive.  It's usually indicative of either a SAN/NAS traffic problem, or occasionally a local hard drive failing.

If that doesn't pan out, isolate that site that provides the most errors and put it in its own app pool.  See if that solves the problem or isolates it.  If that doesn't work, take your top 10 sites and put them in that app pool.  Keep moving sites to the new app pool (or their own) until the problem either moves to another app pool or goes away.  I know it's tedious and annoying, but your only other real alternative is trying to go through each of 200 IIS logs to try to find the source... which is an option -- just not a real attractive one.

Author Comment

ID: 22618607
Ok, I've created the new app pool.
I'll take a look at the possible SAN/NAS issue and report back.
The freezes are very infrequent, but often enough to raise alarms here.

Accepted Solution

gregcmcse earned 500 total points
ID: 22618681
Out of curiosity, is this server used for anything else?  You mentioned Terminal Server errors -- is that remote admin or something else?


Featured Post

3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
IIS redirect  from to and to root of site 6 33
Crystal reports 2 41
Store results in 3 20
RLDC Reporting in Visual studio 11 16
If I have to fix slow responding website my first thoughts are server side optimizations: the database may not be optimized or caching is not enabled, or things like that. We often overlook another major part of our web application: the client. We o…
A publishing tool, a Version Control System, or a Collaboration Platform! These can be some of the defining words for the two very famous web-hosting Git repositories: Bitbucket and Github. Git is widely used amongst the programmers and developers f…
Learn how to set-up custom confirmation messages to users who complete your Wufoo form. Include inputs from fields in your form, webpage redirects, and more with Wufoo’s confirmation options.
Learn how to set-up PayPal payment integration in your Wufoo form. Allow your users to remit payment through PayPal upon completion of your online form. This is helpful for collecting membership payments, customer payments, donations, and more.

778 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question