IIS 7.5 Event log error WAS 5009 how to troubleshoot this error?

I had a event over the weekend.  this occurred one time there is a warning  then error.  Has not re-occurred since two days now.

System log showed two errors.  

A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '3276'. The process exit code was '0xc0000005'.

then Error
The World Wide Web Publishing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

Then it self corrected.  The site was not available apparently for just a about 10 minutes during this.

How can I figure out what caused this and prevent it from re-occurring?
In the application log there is also one error close to same time.

Faulting application name: svchost.exe_WAS, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: unknown, version:, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000002141770
Faulting process id: 0x2354
Faulting application start time: 0x01d079943d0ec2c7
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: unknown
Report Id: b06263e2-e6e8-11e4-b1ea-e4115bbe0afa
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dan McFaddenSystems EngineerCommented:
0xc0000005 translates to an access violation.

So, some questions:
1. is there anything in the HTTP logs that correspond to the time the above error occurred?
2. is there anything else in the event logs that occurs around this time?
3. have you reviewed the report that was generated?  See:  Report Id: b06263e2-e6e8-11e4-b1ea-e4115bbe0afa?
3a. link: http://blogs.technet.com/b/arykhus/archive/2008/12/11/finding-useful-crash-data-and-windows-error-reporting-wer.aspx
4. do you have AV software running scans at this time?

kdschoolAuthor Commented:
In the http failed requests logs same date about one hour before the error occured someone tried to access a old pages that has an old sql asp connection string in it that is no longer used.  Could that have caused this?  Should I remove that connection from the connection folder since that application no longer is in use?

Run McAfee but no scans run on this date/time

Where can I find the error report that you mention above?
Dan McFaddenSystems EngineerCommented:
You should, without a doubt, remove the old ASP content.  You could use URL Rewriting or Redirection to push the user to the correct URL.

I don't think the hit on the old ASP page caused the issue.

From the actual HTTP logs (not the failed request logs) what activity, if any, occurred a bit before during and after the time of the crash?  What hits were recorded in the logs?  Do you have http logging enabled?

Does McAfee have a real-time scan function?

Point 3a in my post above points you to an article that walks you thru reviewing the Error Reports.

Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

kdschoolAuthor Commented:
The system log error is in this time format  5:56:22 PM that converts to 17:56 PM miliarty time like the http logs.  These are the only logged events prior to this time at 17:14. The next sequence is after 18:00 or after the event.

#Version: 1.0
#Date: 2015-04-19 17:14:05
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken

2015-04-19 17:14:05 xxx.xx.xxx.xxx GET /SafCom/QTakes/CDrivingRequirement.html - 80 - Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+Trident/6.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+InfoPath.3;+.NET4.0C;+.NET4.0E) 200 0 0 1388

2015-04-19 17:14:05 xxx.xx.xxx.xxx GET /images/IncursionIdwithcircle.jpg - 80 - Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+Trident/6.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+InfoPath.3;+.NET4.0C;+.NET4.0E) 200 0 0 78

2015-04-19 17:14:05 xxx.xx.xxx.xxx GET /favicon.ico - 80 - Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+Trident/6.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+InfoPath.3;+.NET4.0C;+.NET4.0E) 200 0 0 234
kdschoolAuthor Commented:
Also the errors are from the system and application logs.  The link you gave me is for windows vista and I dont have that option under my control panel.
Dan McFaddenSystems EngineerCommented:
If you go into the Control Panel, then Action Center, then View archived messages... do you find any Error Reports listed there?

If yes, view the report with ID: b06263e2-e6e8-11e4-b1ea-e4115bbe0afa

Essentially, you have a AppPool that is full on crashing, normally an admin would attach a debugger to watch the AppPool for a crash, and when it does, create a dump file which can be further analyzed.

2 more questions:

1. how many applications (websites) are using the default app pool?
2. have you tried creating a new AppPool and moving just this website to the new AppPool?

kdschoolAuthor Commented:
There is only one website on this server and the server is new.  It has four 300 GB hard drives and very fast dual 8 core processor.  This error only occured one time on  4/19 and to date no other errors in the logs they are clean. I don't know what you mean by a full app pool?  There are a lot of historical files I can remove if necessary to prevent this from re-occuring.   Is there a size restriction for an application pool?  The old server had just as many files and much less memory that ran this same default app pool.  Is there a tool I could buy that would help me analzye what is going on?  Moving an app pool seems like it might have some big consequences?   What about recycling the web site so the processes are gently corrected if something is wrong.  Also the logs were error free until I installed the last 11 windows updates.  There was a license issue and I could not install them until that was corrected.  Those were installed on 4/16.

No archived messages in that file.
Dan McFaddenSystems EngineerCommented:
I don't know what you mean by a full app pool?
I didn't say a full AppPool, I said it is full on crashing.  Meaning not just an error message, but the w3wp.exe process (which is the AppPool) failed and shutdown down.  The only way to determine why, is to debug the crash dump, if one exists.

There is no restriction on the size of a website that an AppPool can support.  Moving a website to a new AppPool takes all of 5 minutes to do.  Most of the time is creating and configuring the pool.  The switch take effect immediately and might cause a few seconds of downtime as the site restarts.

1. Is this a static HTML site or is it ASP.NET?
2. What version of the .NET Framework is being used?
3. On the old server, how was the AppPool that this site used, configured?
3a.  Is it the same on the new server?

Recycling an AppPool is never a solution to an issue, it just hides the problem.  To figure out what happened and why, you have to let the AppPool crash, capture a crash dump and analyze the dump file.  Probably something more for the developers to do.

reference link:  http://www.codeproject.com/Articles/37182/Debug-your-ASP-NET-Application-while-Hosted-on-IIS

If this was a one time event, there may be no direct answer to why it happened.  Until it can be reliably reproduced, its just a guessing game as to what may have caused the crash.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
kdschoolAuthor Commented:
You gave me valuble information still no reoccurance will read up on all this and see if occurs again.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Web Applications

From novice to tech pro — start learning today.