[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 208
  • Last Modified:

System Log Warning 5009, WAS : What does it mean and is this something I need to solve?

Windows Server 2008R2 running IIS 7.0.  This warning is showing in my system log but have not seen any problems with the web site or the server.  I am not sure what it means or if it's something I should try to fix.  Here are the details.

A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '10096'. The process exit code was '0xc0000005'.

The default application pool is my web site and this is the only site running on this server.
0
kdschool
Asked:
kdschool
  • 7
  • 7
  • 3
3 Solutions
 
arnoldCommented:
There are tools to troubleshoot app pool issues.
Unfortunately, you've not included details.
Is this event happening on a regular schedule, every x number of days.
I.e. Memory leak ....
What doe your app do?
0
 
kdschoolAuthor Commented:
This is the only dates I see it.  It's a warning not an error.  I have not noticed any impact on the appliction.

Warning      1/28/2015 1:37:20 PM      WAS      5009      None
Warning      1/27/2015 7:11:46 AM      WAS      5009      None
Warning      1/23/2015 7:10:57 AM      WAS      5009      None
Warning      1/22/2015 2:44:49 PM      WAS      5009      None
Warning      1/21/2015 10:49:42 AM      WAS      5009      None
Warning      1/21/2015 8:33:44 AM      WAS      5009      None
Warning      1/20/2015 10:35:46 AM      WAS      5009      None
Warning      1/16/2015 11:10:22 AM      WAS      5009      None
Warning      1/15/2015 1:58:00 PM      WAS      5009      None
0
 
Dan McFaddenSystems EngineerCommented:
The error "The process exit code was '0xc0000005'" is typical of an "Access Denied" message.

A few questions"

1. What is the AppPool, that is throwing this error, running as?
2. What is the website/web app based on?  ... static HTML, ASP, ASP.NET?
3. Do you have http logging on?  Have you looked into the http logs to see what is occurring at this time?
4. Are there any Windows Error Reporting events that have crash details in them?

Dan
0
Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

 
Dan McFaddenSystems EngineerCommented:
I would also enable "Failed Request Tracing" for 24-48 hours, to see if you can catch the error and get it logged.

Link:  http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Dan
0
 
kdschoolAuthor Commented:
HTML only  I do have asp installed but not using it at this time.  No crash events in the system log. I have not looked at the logs I can do that and try the failed request tracing also.

I installed a new SSL certficicate SHA 256 from SHA -1 on January 15 after that the messages started.  If it's accessed denied then could that be someone trying to see a file that they don't have access to?
0
 
Dan McFaddenSystems EngineerCommented:
What is the account the AppPool is using?  Have you left the defaults or are you using a custom configuration?

Dan
0
 
kdschoolAuthor Commented:
In setting up the trace conditons how do I find the status code to use for the warning I am getting?
0
 
Dan McFaddenSystems EngineerCommented:
How to set up FRT:

http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Since you haven't looked in your http logs, I would use "event severity" of error as the config.

Dan
0
 
kdschoolAuthor Commented:
IIS is using the system account.
0
 
Dan McFaddenSystems EngineerCommented:
Have you tried the identity as "ApplicationPoolIdentity" or "NetworkService"?
0
 
kdschoolAuthor Commented:
I tried using event severity and it won't let me only select severity.  It wants a status code or I can't finish the wizard.
0
 
kdschoolAuthor Commented:
What I really want to know is since this is just a warning and it only started after installing the new ssl certificate do I need to worry about it?
0
 
Dan McFaddenSystems EngineerCommented:
Technically, you could ignore it.  But since you are getting an "Access Denied" warning, it may be worth your time to find out what is throwing the error.

Dan
0
 
arnoldCommented:
If you have SSL, does it mean you have a portion of your site that collects confidential info, payments, etc.

The suggestions above enabling different tracing/troubleshooting will help you determine the cause the application pool crashes.  As it is a warning, while it has a brief impact delay between when it crashes and a new instance is started.  is likely seen as a blip.  

It could be that the processing/computing dealing with the new certificate could explain it.
Presumably you have log data cruncher. See whether the traffic patterns increased traffic patterns correlate to the shorter period between these events.
I.e. week with heavy traffic, the event appeared three times, week with light traffic, the event appeared once.

in the example above, it seems the days friday, saturday, sunday and monday are light usage days, while tuesday through Thusday are heavier use days.
0
 
arnoldCommented:
See if the event correlates to access to the https:// of your site since you say your site is HTML only. Does your site configured for bandwidth minimization (enabled compression for outgoing data)?
0
 
Dan McFaddenSystems EngineerCommented:
I agree with Arnold.  It goes along with asking if you have http logging enabled and if you've looked into the logs.

If you do have a secure section sending/receiving data and the https log hits line up with your AppPool crashes, you might have a better idea what direction to go in.  Either way, analyzing your http logs is extremely useful as it will give you an insight to what is happening when, on your site.

Dan
0
 
kdschoolAuthor Commented:
It seems to have corrected itself.
0

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

  • 7
  • 7
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now