Solved

IIS 7.5 Crash - Analysis

Posted on 2013-01-08
3
927 Views
Last Modified: 2013-01-29
Hi,

Ive noticed in my event log a lot of issues, I ran a IIS debug and got

Type of Analysis Performed   Crash Analysis 
Machine Name   D20-S405 
Operating System   Windows Server 2008 R2 Service Pack 1 
Number Of Processors   2 
Process ID   4740 
Process Image   C:\Windows\SysWOW64\inetsrv\w3wp.exe 
System Up-Time   05:54:39 
Process Up-Time   00:06:03 


Thread 2 - System ID 3088
Entry point   ntdll!TppWorkerThread 
Create time   1/3/2013 5:51:14 AM 
Time spent in user mode   0 Days 0:0:0.0 
Time spent in kernel mode   0 Days 0:0:0.46 


.NET Call Stack

Full Call Stack

Function     Arg 1     Arg 2     Arg 3     Arg 4   Source 
ntdll!RtlReportCriticalFailure+57     c0000374     774e4268     00c1f758     774af6a9    
ntdll!RtlpReportHeapFailure+21     00000002     76b13c9f     00000000     00030000    
ntdll!RtlpLogHeapFailure+a1     00000008     00030000     03a93748     00000000    
ntdll!RtlFreeHeap+64     00030000     00000000     03a93750     9e013059    
msvcrt!free+cd     03a93750     022fa1a8     0287854a     022fa338    
php5ts!zend_hash_graceful_reverse_destroy+2e     10000000     00000000     00000000     1000260d    
ntdll!LdrpCallInitRoutine+14     1000260d     10000000     00000000     00000000    
ntdll!LdrpUnloadDll+375     10000000     00c1f90c     76b132eb     6e39e0b8    
ntdll!LdrUnloadDll+4a     10000000     00000000     00c1f954     6e394695    
KERNELBASE!FreeLibrary+15     10000000     02111960     6e3946b7     02111960    
filter+4695     00000001     00000003     00dfe6a0     6e395487    
filter+5456     00000001     02111428     6e5d3816     003f2de4    
filter!RegisterModule+239     02111178     6e5be132     02111178     6e5be18c    
iiscore!CONTEXT_CONTAINER::~CONTEXT_CONTAINER+17     02111178     6e5be18c     02111178     00c1f9d0    
iiscore!W3_SITE::~W3_SITE+1d     02111178     00c1f9d0     6e5c1fbc     00000001    
iiscore!W3_SITE::`scalar deleting destructor'+d     00000001     003d69d0     6e5cf80f     00c1f9fc    
iiscore!W3_SITE::DereferenceSiteInfo+20     00c1f9fc     722b7f37     02111178     ffffffff    
iiscore!W3_SITE_TABLE_BY_NAME::AddRefRecord+3d     02111178     ffffffff     00000000     00e028c4    
iisutil!CLKRLinearHashTable::_Clear+6f     00000001     00e02974     00e02320     6e5bb2b5    
iisutil!CLKRHashTable::Clear+1f     00e02974     00e02320     6e5bd24c     00da7354    
iiscore!W3_SERVER::TerminateGlobalModules+1b     00da7354     00da7380     00da7354     00000000    
iiscore!W3_SERVER::Terminate+16c     02110d78     6e5b52c0     00c1fa60     724a9a60    
iiscore!IISCORE_PROTOCOL_MANAGER::StopListenerChannel+58     02110d84     02110d78     00000000     00000000    
w3wphost!LISTENER_CHANNEL::HandleStopListenerChannel+65     00000000     00d8bd18     724a42e4     00409280    
w3wphost!LISTENER_CHANNEL_STOP_WORKITEM::ExecuteWorkItem+10     00409280     00c1faec     774494d2     00d8bd18    
w3wphost!W3WP_HOST::ExecuteWorkItem+10     00d8bd18     76b1312b     003396f0     00000002    
ntdll!RtlpTpWorkCallback+11d     00d8bd18     00409280     76b1378b     00000000    
ntdll!TppWorkerThread+572     003396e8     00c1fc98     77419ef2     003396e8    
kernel32!BaseThreadInitThunk+e     003396e8     76b1375f     00000000     00000000    
ntdll!__RtlUserThreadStart+70     77433e45     003396e8     ffffffff     774a736f    
ntdll!_RtlUserThreadStart+1b     77433e45     003396e8     00000000     00000000    


Exception Information
In w3wp__domain.com(domain)(2.0)(pool)__PID__4740__Date__01_03_2013__Time_05_57_15AM__93__Second_Chance_Exception_C0000374.dmp the assembly instruction at ntdll!RtlReportCriticalFailure+57 in C:\Windows\SysWOW64\ntdll.dll from Microsoft Corporation has caused an unknown exception (0xc0000374) on thread 2

Module Information 
Image Name: C:\Windows\SysWOW64\ntdll.dll   Symbol Type:  PDB 
Base address: 0x00905a4d   Time Stamp:  Thu Nov 17 06:28:47 2011  
Checksum: 0x00006f00   Comments:   
COM DLL: False   Company Name:  Microsoft Corporation 
ISAPIExtension: False   File Description:  NT Layer DLL 
ISAPIFilter: False   File Version:  6.1.7601.17725 (win7sp1_gdr.111116-1503) 
Managed DLL: False   Internal Name:  ntdll.dll 
VB DLL: False   Legal Copyright:  © Microsoft Corporation. All rights reserved. 
Loaded Image Name:  ntdll.dll   Legal Trademarks:   
Mapped Image Name:     Original filename:  ntdll.dll 
Module name:  ntdll   Private Build:   
Single Threaded:  False   Product Name:  Microsoft® Windows® Operating System 
Module Size:  1.50 MBytes   Product Version:  6.1.7601.17725 
Symbol File Name:  c:\symcache\wntdll.pdb\D74F79EB1F8D4A45ABCD2F476CCABACC2\wntdll.pdb   Special Build:  & 

Open in new window


Does this mean anythign to anyone? As ive tried looking it up and didnt get any answers
0
Comment
Question by:Phil Pearce
  • 2
3 Comments
 
LVL 76

Expert Comment

by:arnold
ID: 38757921
0
 
LVL 1

Author Comment

by:Phil Pearce
ID: 38758708
Hi, thanks for the reply

Before I read the lot the title is "How To: Collect a Crash dump of an IIS worker process on IIS 7.0 (and above) "

Ive already collected the dump and analysed it and the results were above?


or should I continue reading?
0
 
LVL 76

Accepted Solution

by:
arnold earned 500 total points
ID: 38758899
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Here are the symptoms: You start receiving calls from users that one of your legacy web apps isn't coming up, so you log into your IIS 5 server to check it out.  When you pull up the services, you notice that the WWW Publishing service isn't runn…
If you don't have the right permissions set for your WordPress location in IIS, you won't be able to perform automatic updates. Here's how to fix the problem.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now