Solved

System Log Warning  5009, WAS : What does it mean and is this something I need to solve?

Posted on 2015-01-30
17
193 Views
Last Modified: 2015-02-04
Windows Server 2008R2 running IIS 7.0.  This warning is showing in my system log but have not seen any problems with the web site or the server.  I am not sure what it means or if it's something I should try to fix.  Here are the details.

A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '10096'. The process exit code was '0xc0000005'.

The default application pool is my web site and this is the only site running on this server.
0
Comment
Question by:kdschool
  • 7
  • 7
  • 3
17 Comments
 
LVL 77

Expert Comment

by:arnold
ID: 40579702
There are tools to troubleshoot app pool issues.
Unfortunately, you've not included details.
Is this event happening on a regular schedule, every x number of days.
I.e. Memory leak ....
What doe your app do?
0
 

Author Comment

by:kdschool
ID: 40579720
This is the only dates I see it.  It's a warning not an error.  I have not noticed any impact on the appliction.

Warning      1/28/2015 1:37:20 PM      WAS      5009      None
Warning      1/27/2015 7:11:46 AM      WAS      5009      None
Warning      1/23/2015 7:10:57 AM      WAS      5009      None
Warning      1/22/2015 2:44:49 PM      WAS      5009      None
Warning      1/21/2015 10:49:42 AM      WAS      5009      None
Warning      1/21/2015 8:33:44 AM      WAS      5009      None
Warning      1/20/2015 10:35:46 AM      WAS      5009      None
Warning      1/16/2015 11:10:22 AM      WAS      5009      None
Warning      1/15/2015 1:58:00 PM      WAS      5009      None
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579735
The error "The process exit code was '0xc0000005'" is typical of an "Access Denied" message.

A few questions"

1. What is the AppPool, that is throwing this error, running as?
2. What is the website/web app based on?  ... static HTML, ASP, ASP.NET?
3. Do you have http logging on?  Have you looked into the http logs to see what is occurring at this time?
4. Are there any Windows Error Reporting events that have crash details in them?

Dan
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 27

Assisted Solution

by:Dan McFadden
Dan McFadden earned 500 total points
ID: 40579746
I would also enable "Failed Request Tracing" for 24-48 hours, to see if you can catch the error and get it logged.

Link:  http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Dan
0
 

Author Comment

by:kdschool
ID: 40579760
HTML only  I do have asp installed but not using it at this time.  No crash events in the system log. I have not looked at the logs I can do that and try the failed request tracing also.

I installed a new SSL certficicate SHA 256 from SHA -1 on January 15 after that the messages started.  If it's accessed denied then could that be someone trying to see a file that they don't have access to?
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579787
What is the account the AppPool is using?  Have you left the defaults or are you using a custom configuration?

Dan
0
 

Author Comment

by:kdschool
ID: 40579825
In setting up the trace conditons how do I find the status code to use for the warning I am getting?
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579848
How to set up FRT:

http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Since you haven't looked in your http logs, I would use "event severity" of error as the config.

Dan
0
 

Author Comment

by:kdschool
ID: 40579852
IIS is using the system account.
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579854
Have you tried the identity as "ApplicationPoolIdentity" or "NetworkService"?
0
 

Author Comment

by:kdschool
ID: 40579867
I tried using event severity and it won't let me only select severity.  It wants a status code or I can't finish the wizard.
0
 

Author Comment

by:kdschool
ID: 40579873
What I really want to know is since this is just a warning and it only started after installing the new ssl certificate do I need to worry about it?
0
 
LVL 27

Assisted Solution

by:Dan McFadden
Dan McFadden earned 500 total points
ID: 40579882
Technically, you could ignore it.  But since you are getting an "Access Denied" warning, it may be worth your time to find out what is throwing the error.

Dan
0
 
LVL 77

Expert Comment

by:arnold
ID: 40579893
If you have SSL, does it mean you have a portion of your site that collects confidential info, payments, etc.

The suggestions above enabling different tracing/troubleshooting will help you determine the cause the application pool crashes.  As it is a warning, while it has a brief impact delay between when it crashes and a new instance is started.  is likely seen as a blip.  

It could be that the processing/computing dealing with the new certificate could explain it.
Presumably you have log data cruncher. See whether the traffic patterns increased traffic patterns correlate to the shorter period between these events.
I.e. week with heavy traffic, the event appeared three times, week with light traffic, the event appeared once.

in the example above, it seems the days friday, saturday, sunday and monday are light usage days, while tuesday through Thusday are heavier use days.
0
 
LVL 77

Expert Comment

by:arnold
ID: 40579901
See if the event correlates to access to the https:// of your site since you say your site is HTML only. Does your site configured for bandwidth minimization (enabled compression for outgoing data)?
0
 
LVL 27

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 40579910
I agree with Arnold.  It goes along with asking if you have http logging enabled and if you've looked into the logs.

If you do have a secure section sending/receiving data and the https log hits line up with your AppPool crashes, you might have a better idea what direction to go in.  Either way, analyzing your http logs is extremely useful as it will give you an insight to what is happening when, on your site.

Dan
0
 

Author Comment

by:kdschool
ID: 40589290
It seems to have corrected itself.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
A phishing scam that claims a recipient’s credit card details have been “suspended” is the latest trend in spoof emails.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question