?
Solved

System Log Warning  5009, WAS : What does it mean and is this something I need to solve?

Posted on 2015-01-30
17
Medium Priority
?
201 Views
Last Modified: 2015-02-04
Windows Server 2008R2 running IIS 7.0.  This warning is showing in my system log but have not seen any problems with the web site or the server.  I am not sure what it means or if it's something I should try to fix.  Here are the details.

A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '10096'. The process exit code was '0xc0000005'.

The default application pool is my web site and this is the only site running on this server.
0
Comment
Question by:kdschool
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 7
  • 3
17 Comments
 
LVL 79

Expert Comment

by:arnold
ID: 40579702
There are tools to troubleshoot app pool issues.
Unfortunately, you've not included details.
Is this event happening on a regular schedule, every x number of days.
I.e. Memory leak ....
What doe your app do?
0
 

Author Comment

by:kdschool
ID: 40579720
This is the only dates I see it.  It's a warning not an error.  I have not noticed any impact on the appliction.

Warning      1/28/2015 1:37:20 PM      WAS      5009      None
Warning      1/27/2015 7:11:46 AM      WAS      5009      None
Warning      1/23/2015 7:10:57 AM      WAS      5009      None
Warning      1/22/2015 2:44:49 PM      WAS      5009      None
Warning      1/21/2015 10:49:42 AM      WAS      5009      None
Warning      1/21/2015 8:33:44 AM      WAS      5009      None
Warning      1/20/2015 10:35:46 AM      WAS      5009      None
Warning      1/16/2015 11:10:22 AM      WAS      5009      None
Warning      1/15/2015 1:58:00 PM      WAS      5009      None
0
 
LVL 28

Expert Comment

by:Dan McFadden
ID: 40579735
The error "The process exit code was '0xc0000005'" is typical of an "Access Denied" message.

A few questions"

1. What is the AppPool, that is throwing this error, running as?
2. What is the website/web app based on?  ... static HTML, ASP, ASP.NET?
3. Do you have http logging on?  Have you looked into the http logs to see what is occurring at this time?
4. Are there any Windows Error Reporting events that have crash details in them?

Dan
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 28

Assisted Solution

by:Dan McFadden
Dan McFadden earned 2000 total points
ID: 40579746
I would also enable "Failed Request Tracing" for 24-48 hours, to see if you can catch the error and get it logged.

Link:  http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Dan
0
 

Author Comment

by:kdschool
ID: 40579760
HTML only  I do have asp installed but not using it at this time.  No crash events in the system log. I have not looked at the logs I can do that and try the failed request tracing also.

I installed a new SSL certficicate SHA 256 from SHA -1 on January 15 after that the messages started.  If it's accessed denied then could that be someone trying to see a file that they don't have access to?
0
 
LVL 28

Expert Comment

by:Dan McFadden
ID: 40579787
What is the account the AppPool is using?  Have you left the defaults or are you using a custom configuration?

Dan
0
 

Author Comment

by:kdschool
ID: 40579825
In setting up the trace conditons how do I find the status code to use for the warning I am getting?
0
 
LVL 28

Expert Comment

by:Dan McFadden
ID: 40579848
How to set up FRT:

http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Since you haven't looked in your http logs, I would use "event severity" of error as the config.

Dan
0
 

Author Comment

by:kdschool
ID: 40579852
IIS is using the system account.
0
 
LVL 28

Expert Comment

by:Dan McFadden
ID: 40579854
Have you tried the identity as "ApplicationPoolIdentity" or "NetworkService"?
0
 

Author Comment

by:kdschool
ID: 40579867
I tried using event severity and it won't let me only select severity.  It wants a status code or I can't finish the wizard.
0
 

Author Comment

by:kdschool
ID: 40579873
What I really want to know is since this is just a warning and it only started after installing the new ssl certificate do I need to worry about it?
0
 
LVL 28

Assisted Solution

by:Dan McFadden
Dan McFadden earned 2000 total points
ID: 40579882
Technically, you could ignore it.  But since you are getting an "Access Denied" warning, it may be worth your time to find out what is throwing the error.

Dan
0
 
LVL 79

Expert Comment

by:arnold
ID: 40579893
If you have SSL, does it mean you have a portion of your site that collects confidential info, payments, etc.

The suggestions above enabling different tracing/troubleshooting will help you determine the cause the application pool crashes.  As it is a warning, while it has a brief impact delay between when it crashes and a new instance is started.  is likely seen as a blip.  

It could be that the processing/computing dealing with the new certificate could explain it.
Presumably you have log data cruncher. See whether the traffic patterns increased traffic patterns correlate to the shorter period between these events.
I.e. week with heavy traffic, the event appeared three times, week with light traffic, the event appeared once.

in the example above, it seems the days friday, saturday, sunday and monday are light usage days, while tuesday through Thusday are heavier use days.
0
 
LVL 79

Expert Comment

by:arnold
ID: 40579901
See if the event correlates to access to the https:// of your site since you say your site is HTML only. Does your site configured for bandwidth minimization (enabled compression for outgoing data)?
0
 
LVL 28

Accepted Solution

by:
Dan McFadden earned 2000 total points
ID: 40579910
I agree with Arnold.  It goes along with asking if you have http logging enabled and if you've looked into the logs.

If you do have a secure section sending/receiving data and the https log hits line up with your AppPool crashes, you might have a better idea what direction to go in.  Either way, analyzing your http logs is extremely useful as it will give you an insight to what is happening when, on your site.

Dan
0
 

Author Comment

by:kdschool
ID: 40589290
It seems to have corrected itself.
0

Featured Post

Get proactive database performance tuning online

At Percona’s web store you can order full Percona Database Performance Audit in minutes. Find out the health of your database, and how to improve it. Pay online with a credit card. Improve your database performance now!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question