Go Premium for a chance to win a PS4. Enter to Win


IIS Websites (server side) keeps freezing up, Need to isolate/troubleshoot application pool

Posted on 2008-10-01
Medium Priority
Last Modified: 2012-05-05
Hi Friends,

I really appreciate expert troubleshooting advise on this.

There are about 200 Host Header sites on this IIS server.
Note that this server also has Perl CGI, ISAPI, and PHP5.
When the problem occurs, as far as I can tell, very quickly all the sites become unresponsive.
My fix thus far has been to simply restart the www NT service.

I have found 3 interesting sets of problems in the eventlogs:

1.      There is some policy that keep causing errors, related to mapping print drivers in kernel mode for anyone who uses terminal services
2.      There are lots of ASP.NET errors (mostly from one site in particular), which provide the process ID for the associated w3wp.exe
3.      There are lots of DNS update errors (attempting to update the Active Directory name FQDN of this server) and redirector failing as a result

1. Isolate the website I suspect as the cause, from the default app pool.  HOW DO I DO THIS??

(this way, I will be able to map the process ID to the w3wp.exe using IISApp.vbs or 'Process Explorer', and if that one has all the CPU cycles, that should be conclusive proof ---- but right now I only have 2 process threads for w3wp.exe, because they are all in a shared pool under the default parent root).

2. Could Performance Monitor help me?

Thanks in advance for any advise!

Here is a sample of the events I found in the APP and SYS logs:
Event ID: 1309
Event code: 3005 
Thread information: 
    Thread ID: 8 
    Thread account name: NT AUTHORITY\NETWORK SERVICE 
    Is impersonating: False 
    Stack trace: at System.Web.HttpForbiddenHandler.ProcessRequest(HttpContext context) at Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Event ID: 1111
Kernel Mode Printer blocking policy is enabled. The attempt for Microsoft XPS Document Writer (from hostname) in session 1 to use a Kernel Mode driver failed.
Event ID: 5789
Attempt to update DNS Host Name of the computer object in Active Directory failed. The updated value was 'XXX.YYY.ZZZ' (FQDN). The following error occurred: 
The parameter is incorrect. 
Event ID: 1074
A worker process with process id of '2096' serving application pool 'DefaultAppPool' has requested a recycle because the worker process reached its allowed processing time limit.
Event ID: 50
{Delayed Write Failed} Windows was unable to save all the data for the file \Device\LanmanRedirector. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event ID: 55
Kernel Mode Printer blocking policy is enabled. The attempt for Microsoft XPS Document Writer (from XXXX) - HOSTNAME in session 3 to use a Kernel Mode driver failed.

Open in new window

Question by:ksuchy
  • 2

Expert Comment

ID: 22618570
Actually, it may not be IIS at all.  Are there lots of the "{Delayed Write Failed}" error messages in your event log?  Check to see if you see one or more of them close to the time that apps become non-responsive.  It's usually indicative of either a SAN/NAS traffic problem, or occasionally a local hard drive failing.

If that doesn't pan out, isolate that site that provides the most errors and put it in its own app pool.  See if that solves the problem or isolates it.  If that doesn't work, take your top 10 sites and put them in that app pool.  Keep moving sites to the new app pool (or their own) until the problem either moves to another app pool or goes away.  I know it's tedious and annoying, but your only other real alternative is trying to go through each of 200 IIS logs to try to find the source... which is an option -- just not a real attractive one.

Author Comment

ID: 22618607
Ok, I've created the new app pool.
I'll take a look at the possible SAN/NAS issue and report back.
The freezes are very infrequent, but often enough to raise alarms here.

Accepted Solution

gregcmcse earned 1500 total points
ID: 22618681
Out of curiosity, is this server used for anything else?  You mentioned Terminal Server errors -- is that remote admin or something else?


Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
Preparing an email is something we should all take special care with – especially when the email is for somebody you may not know very well. The pressures of everyday working life stacked with a hectic office environment can make this a real challen…
This video teaches viewers how to create their own website using cPanel and Wordpress. Tutorial walks users through how to set up their own domain name from tools like Domain Registrar, Hosting Account, and Wordpress. More specifically, the order in…
Use Wufoo, an online form creation tool, to make powerful forms. Learn how to selectively show certain fields based on user input using rules to gather relevant information and data from your forms. The rules feature provides you with an opportunity…
Suggested Courses

926 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question