Solved

System Log Warning  5009, WAS : What does it mean and is this something I need to solve?

Posted on 2015-01-30
17
192 Views
Last Modified: 2015-02-04
Windows Server 2008R2 running IIS 7.0.  This warning is showing in my system log but have not seen any problems with the web site or the server.  I am not sure what it means or if it's something I should try to fix.  Here are the details.

A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '10096'. The process exit code was '0xc0000005'.

The default application pool is my web site and this is the only site running on this server.
0
Comment
Question by:kdschool
  • 7
  • 7
  • 3
17 Comments
 
LVL 77

Expert Comment

by:arnold
ID: 40579702
There are tools to troubleshoot app pool issues.
Unfortunately, you've not included details.
Is this event happening on a regular schedule, every x number of days.
I.e. Memory leak ....
What doe your app do?
0
 

Author Comment

by:kdschool
ID: 40579720
This is the only dates I see it.  It's a warning not an error.  I have not noticed any impact on the appliction.

Warning      1/28/2015 1:37:20 PM      WAS      5009      None
Warning      1/27/2015 7:11:46 AM      WAS      5009      None
Warning      1/23/2015 7:10:57 AM      WAS      5009      None
Warning      1/22/2015 2:44:49 PM      WAS      5009      None
Warning      1/21/2015 10:49:42 AM      WAS      5009      None
Warning      1/21/2015 8:33:44 AM      WAS      5009      None
Warning      1/20/2015 10:35:46 AM      WAS      5009      None
Warning      1/16/2015 11:10:22 AM      WAS      5009      None
Warning      1/15/2015 1:58:00 PM      WAS      5009      None
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579735
The error "The process exit code was '0xc0000005'" is typical of an "Access Denied" message.

A few questions"

1. What is the AppPool, that is throwing this error, running as?
2. What is the website/web app based on?  ... static HTML, ASP, ASP.NET?
3. Do you have http logging on?  Have you looked into the http logs to see what is occurring at this time?
4. Are there any Windows Error Reporting events that have crash details in them?

Dan
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
LVL 27

Assisted Solution

by:Dan McFadden
Dan McFadden earned 500 total points
ID: 40579746
I would also enable "Failed Request Tracing" for 24-48 hours, to see if you can catch the error and get it logged.

Link:  http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Dan
0
 

Author Comment

by:kdschool
ID: 40579760
HTML only  I do have asp installed but not using it at this time.  No crash events in the system log. I have not looked at the logs I can do that and try the failed request tracing also.

I installed a new SSL certficicate SHA 256 from SHA -1 on January 15 after that the messages started.  If it's accessed denied then could that be someone trying to see a file that they don't have access to?
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579787
What is the account the AppPool is using?  Have you left the defaults or are you using a custom configuration?

Dan
0
 

Author Comment

by:kdschool
ID: 40579825
In setting up the trace conditons how do I find the status code to use for the warning I am getting?
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579848
How to set up FRT:

http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Since you haven't looked in your http logs, I would use "event severity" of error as the config.

Dan
0
 

Author Comment

by:kdschool
ID: 40579852
IIS is using the system account.
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 40579854
Have you tried the identity as "ApplicationPoolIdentity" or "NetworkService"?
0
 

Author Comment

by:kdschool
ID: 40579867
I tried using event severity and it won't let me only select severity.  It wants a status code or I can't finish the wizard.
0
 

Author Comment

by:kdschool
ID: 40579873
What I really want to know is since this is just a warning and it only started after installing the new ssl certificate do I need to worry about it?
0
 
LVL 27

Assisted Solution

by:Dan McFadden
Dan McFadden earned 500 total points
ID: 40579882
Technically, you could ignore it.  But since you are getting an "Access Denied" warning, it may be worth your time to find out what is throwing the error.

Dan
0
 
LVL 77

Expert Comment

by:arnold
ID: 40579893
If you have SSL, does it mean you have a portion of your site that collects confidential info, payments, etc.

The suggestions above enabling different tracing/troubleshooting will help you determine the cause the application pool crashes.  As it is a warning, while it has a brief impact delay between when it crashes and a new instance is started.  is likely seen as a blip.  

It could be that the processing/computing dealing with the new certificate could explain it.
Presumably you have log data cruncher. See whether the traffic patterns increased traffic patterns correlate to the shorter period between these events.
I.e. week with heavy traffic, the event appeared three times, week with light traffic, the event appeared once.

in the example above, it seems the days friday, saturday, sunday and monday are light usage days, while tuesday through Thusday are heavier use days.
0
 
LVL 77

Expert Comment

by:arnold
ID: 40579901
See if the event correlates to access to the https:// of your site since you say your site is HTML only. Does your site configured for bandwidth minimization (enabled compression for outgoing data)?
0
 
LVL 27

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 40579910
I agree with Arnold.  It goes along with asking if you have http logging enabled and if you've looked into the logs.

If you do have a secure section sending/receiving data and the https log hits line up with your AppPool crashes, you might have a better idea what direction to go in.  Either way, analyzing your http logs is extremely useful as it will give you an insight to what is happening when, on your site.

Dan
0
 

Author Comment

by:kdschool
ID: 40589290
It seems to have corrected itself.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
A phishing scam that claims a recipient’s credit card details have been “suspended” is the latest trend in spoof emails.
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question