Solved

System Log Warning  5009, WAS : What does it mean and is this something I need to solve?

Posted on 2015-01-30
17
188 Views
Last Modified: 2015-02-04
Windows Server 2008R2 running IIS 7.0.  This warning is showing in my system log but have not seen any problems with the web site or the server.  I am not sure what it means or if it's something I should try to fix.  Here are the details.

A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '10096'. The process exit code was '0xc0000005'.

The default application pool is my web site and this is the only site running on this server.
0
Comment
Question by:kdschool
  • 7
  • 7
  • 3
17 Comments
 
LVL 76

Expert Comment

by:arnold
ID: 40579702
There are tools to troubleshoot app pool issues.
Unfortunately, you've not included details.
Is this event happening on a regular schedule, every x number of days.
I.e. Memory leak ....
What doe your app do?
0
 

Author Comment

by:kdschool
ID: 40579720
This is the only dates I see it.  It's a warning not an error.  I have not noticed any impact on the appliction.

Warning      1/28/2015 1:37:20 PM      WAS      5009      None
Warning      1/27/2015 7:11:46 AM      WAS      5009      None
Warning      1/23/2015 7:10:57 AM      WAS      5009      None
Warning      1/22/2015 2:44:49 PM      WAS      5009      None
Warning      1/21/2015 10:49:42 AM      WAS      5009      None
Warning      1/21/2015 8:33:44 AM      WAS      5009      None
Warning      1/20/2015 10:35:46 AM      WAS      5009      None
Warning      1/16/2015 11:10:22 AM      WAS      5009      None
Warning      1/15/2015 1:58:00 PM      WAS      5009      None
0
 
LVL 26

Expert Comment

by:Dan McFadden
ID: 40579735
The error "The process exit code was '0xc0000005'" is typical of an "Access Denied" message.

A few questions"

1. What is the AppPool, that is throwing this error, running as?
2. What is the website/web app based on?  ... static HTML, ASP, ASP.NET?
3. Do you have http logging on?  Have you looked into the http logs to see what is occurring at this time?
4. Are there any Windows Error Reporting events that have crash details in them?

Dan
0
 
LVL 26

Assisted Solution

by:Dan McFadden
Dan McFadden earned 500 total points
ID: 40579746
I would also enable "Failed Request Tracing" for 24-48 hours, to see if you can catch the error and get it logged.

Link:  http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Dan
0
 

Author Comment

by:kdschool
ID: 40579760
HTML only  I do have asp installed but not using it at this time.  No crash events in the system log. I have not looked at the logs I can do that and try the failed request tracing also.

I installed a new SSL certficicate SHA 256 from SHA -1 on January 15 after that the messages started.  If it's accessed denied then could that be someone trying to see a file that they don't have access to?
0
 
LVL 26

Expert Comment

by:Dan McFadden
ID: 40579787
What is the account the AppPool is using?  Have you left the defaults or are you using a custom configuration?

Dan
0
 

Author Comment

by:kdschool
ID: 40579825
In setting up the trace conditons how do I find the status code to use for the warning I am getting?
0
 
LVL 26

Expert Comment

by:Dan McFadden
ID: 40579848
How to set up FRT:

http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Since you haven't looked in your http logs, I would use "event severity" of error as the config.

Dan
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:kdschool
ID: 40579852
IIS is using the system account.
0
 
LVL 26

Expert Comment

by:Dan McFadden
ID: 40579854
Have you tried the identity as "ApplicationPoolIdentity" or "NetworkService"?
0
 

Author Comment

by:kdschool
ID: 40579867
I tried using event severity and it won't let me only select severity.  It wants a status code or I can't finish the wizard.
0
 

Author Comment

by:kdschool
ID: 40579873
What I really want to know is since this is just a warning and it only started after installing the new ssl certificate do I need to worry about it?
0
 
LVL 26

Assisted Solution

by:Dan McFadden
Dan McFadden earned 500 total points
ID: 40579882
Technically, you could ignore it.  But since you are getting an "Access Denied" warning, it may be worth your time to find out what is throwing the error.

Dan
0
 
LVL 76

Expert Comment

by:arnold
ID: 40579893
If you have SSL, does it mean you have a portion of your site that collects confidential info, payments, etc.

The suggestions above enabling different tracing/troubleshooting will help you determine the cause the application pool crashes.  As it is a warning, while it has a brief impact delay between when it crashes and a new instance is started.  is likely seen as a blip.  

It could be that the processing/computing dealing with the new certificate could explain it.
Presumably you have log data cruncher. See whether the traffic patterns increased traffic patterns correlate to the shorter period between these events.
I.e. week with heavy traffic, the event appeared three times, week with light traffic, the event appeared once.

in the example above, it seems the days friday, saturday, sunday and monday are light usage days, while tuesday through Thusday are heavier use days.
0
 
LVL 76

Expert Comment

by:arnold
ID: 40579901
See if the event correlates to access to the https:// of your site since you say your site is HTML only. Does your site configured for bandwidth minimization (enabled compression for outgoing data)?
0
 
LVL 26

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 40579910
I agree with Arnold.  It goes along with asking if you have http logging enabled and if you've looked into the logs.

If you do have a secure section sending/receiving data and the https log hits line up with your AppPool crashes, you might have a better idea what direction to go in.  Either way, analyzing your http logs is extremely useful as it will give you an insight to what is happening when, on your site.

Dan
0
 

Author Comment

by:kdschool
ID: 40589290
It seems to have corrected itself.
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now