IIS Admin Service keeps terminating unexpectedly on Server 2003 standard SP2 w/ Exchange 2003 SP2

electric69
electric69 used Ask the Experts™
on
Hello,

The IIS Admin Service on my Exchange 2003 SP2 server keeps terminating unexpectedly.  How can I get IIS Admin and SMTP to remain running smoothly?  

The sequence of events seems to be:

1

Event ID 1009 - w3svc - A process serving application pool 'ExchangeApplicationPool' terminated unexpectedly. The process id was '7164'. The process exit code was '0xc0000005'.

2

Event ID 7031 - Service Control Manager - The IIS Admin Service service terminated unexpectedly.  It has done this 44 time(s).  The following corrective action will be taken in 1 milliseconds: Run the configured recovery program.

3

Event ID 7034 - Service Control Manager - The Simple Mail Transfer Protocol (SMTP) service terminated unexpectedly.  It has done this 44 time(s).

4

IIS Admin and SMTP services are restarted by the service control  manager
There appear to be no corrupted messages in the queues, so that does not seem to be the problem.

Thank you

--------------------------------------------
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7031
Date:            10/19/2010
Time:            7:20:52 AM
User:            N/A
Computer:      EXCHANGE
Description:
The IIS Admin Service service terminated unexpectedly.  It has done this 44 time(s).  The following corrective action will be taken in 1 milliseconds: Run the configured recovery program.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------------------------
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7034
Date:            10/19/2010
Time:            7:20:52 AM
User:            N/A
Computer:      EXCHANGE
Description:
The Simple Mail Transfer Protocol (SMTP) service terminated unexpectedly.  It has done this 44 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------

Event Type:      Warning
Event Source:      W3SVC
Event Category:      None
Event ID:      1013
Date:            10/19/2010
Time:            7:22:27 AM
User:            N/A
Computer:      EXCHANGE
Description:
A process serving application pool 'ExchangeApplicationPool' exceeded time limits during shut down. The process id was '1180'.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------

Event Type:      Warning
Event Source:      W3SVC
Event Category:      None
Event ID:      1009
Date:            10/19/2010
Time:            6:08:57 AM
User:            N/A
Computer:      EXCHANGE
Description:
A process serving application pool 'ExchangeApplicationPool' terminated unexpectedly. The process id was '7164'. The process exit code was '0xc0000005'.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:
Hello,

The Inetinfo.exe process repeatedly crashes and restarts.This problem is caused by a problem in the Windows Server 2003 SMTP service.

This may help you.

http://support.microsoft.com/kb/827214 

Regards,
Tushar Kaskhedikar
Please check on IIS if the "maximum worker process" for the "ExchangeApplicationPool" is set to more than 1. If not please set it to 1. Restart ISS.

Author

Commented:
@petedoku: Under web garden, the maximum number of worker processes is already 1.

@Tushar Kaskhedikar: I'm taking a look to see if that KB article has an update rolled into Exchange 2003 SP2 or Windows 2003 SP2.
Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

Author

Commented:
I'm looking further into ADPlus for further troubleshooting (http://support.microsoft.com/kb/286350).

Author

Commented:
For anyone else experiencing a similar problem, the application log mentioned a Symantec issue.

Turning off the Symantec Mail Security for MS Exchange anti-spam feature kept the services running without issue for more than 12 hours when, normally, the services would die about every 72 minutes.

Here's the application event log entry that pointed me toward Symantec's SMSMSE:

Event Type:      Error
Event Source:      Microsoft Exchange Server
Event Category:      None
Event ID:      1000
Date:            10/17/2010
Time:            6:06:49 AM
User:            N/A
Computer:      EXCHANGE
Description:
Faulting application inetinfo.exe, version 6.0.3790.3959, stamp 45d69692, faulting module libspamhunter.dll, version 6.0.3.7, stamp 445bbebe, debug? 0, fault address 0x0002617b.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00   A.p.p.l.
0008: 69 00 63 00 61 00 74 00   i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00   i.o.n. .
0018: 46 00 61 00 69 00 6c 00   F.a.i.l.
0020: 75 00 72 00 65 00 20 00   u.r.e. .
0028: 20 00 69 00 6e 00 65 00    .i.n.e.
0030: 74 00 69 00 6e 00 66 00   t.i.n.f.
0038: 6f 00 2e 00 65 00 78 00   o...e.x.
0040: 65 00 20 00 36 00 2e 00   e. .6...
0048: 30 00 2e 00 33 00 37 00   0...3.7.
0050: 39 00 30 00 2e 00 33 00   9.0...3.
0058: 39 00 35 00 39 00 20 00   9.5.9. .
0060: 34 00 35 00 64 00 36 00   4.5.d.6.
0068: 39 00 36 00 39 00 32 00   9.6.9.2.
0070: 20 00 69 00 6e 00 20 00    .i.n. .
0078: 6c 00 69 00 62 00 73 00   l.i.b.s.
0080: 70 00 61 00 6d 00 68 00   p.a.m.h.
0088: 75 00 6e 00 74 00 65 00   u.n.t.e.
0090: 72 00 2e 00 64 00 6c 00   r...d.l.
0098: 6c 00 20 00 36 00 2e 00   l. .6...
00a0: 30 00 2e 00 33 00 2e 00   0...3...
00a8: 37 00 20 00 34 00 34 00   7. .4.4.
00b0: 35 00 62 00 62 00 65 00   5.b.b.e.
00b8: 62 00 65 00 20 00 66 00   b.e. .f.
00c0: 44 00 65 00 62 00 75 00   D.e.b.u.
00c8: 67 00 20 00 30 00 20 00   g. .0. .
00d0: 61 00 74 00 20 00 6f 00   a.t. .o.
00d8: 66 00 66 00 73 00 65 00   f.f.s.e.
00e0: 74 00 20 00 30 00 30 00   t. .0.0.
00e8: 30 00 32 00 36 00 31 00   0.2.6.1.
00f0: 37 00 62 00 0d 00 0a 00   7.b.....

---------------------------------------------------------

Since the Exchange server went down hard earlier in the month, the anti-spam signatures may have been corrupted.  To eliminate the anti-spam signatures as a potential problem, I followed the instructions below from Symantec on how to clean out the old anti-spam signatures:

http://www.symantec.com/business/support/index?page=content&id=TECH84147
I followed the instructions below from Symantec on how to clean out the old anti-spam signatures:

http://www.symantec.com/business/support/index?page=content&id=TECH84147

The exchange, SMTP and IIS services have not failed in almost a week since I repaired the anti-spam signatures per the above link.

Author

Commented:
This was the solution for the services that crashed relating to Symantec Mail Security for MS Exchange's corrupted anti-spam signatures.

The other suggestions/questions did not come close to an answer.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial