w3wp.exe exception
in [IIS]
|
From: GaneshBabu.CV on 14 Sep 2007 08:02 Hi, We are running ASP application in IIS 6.0. But w3wp.exe crashes unexpectedly with the following message. An exception dialog appears and one of the following message is logged in event log And any one of the following are logged in the System log during the w3wp.exe exception: Message 1 Event Type: Warning Event Source: W3SVC Event Category: None Event ID: 1009 Date: Date Time: Time User: N/A Computer: ComputerName Description: A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '1234'. The process exit code was '0xc0000005'. Message 2 Event Type: Warning Event Source: W3SVC Event Category: None Event ID: 1011 Date: Date Time: Time User: N/A Computer: ComputerName Description: A process serving application pool 'DefaultAppPool' suffered a fatal communication error with the World Wide Web Publishing Service. The process id was '1234'. The data field contains the error number. Message 3 Event Type: Warning Event Source: W3SVC Event Category: None Event ID: 1013 Date: Date Time: Time User: N/A Computer: ComputerName Description: The process where application pool 'DefaultAppPool' was offered exceeded the time limitation in the middle of the shutdown. Process id was two '41 ' At times, only any of the above entry is found in the event log without the w3wp.exe exception dialog. We have run Microsoft's debug tool(Debug Diag) and have captured the following Analysis Summary Type Description Recommendation Error In w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000002 on thread 8 Heap corruption was detected in heap 0x00080000, however pageheap was not enabled in this dump. Please follow the instructions in the recommendation section for troubleshooting heap corruption issues. Current NTGlobalFlags value: 0x0 An access violation exception thrown by a heap memory manager function indicates heap corruption. Please follow the steps outlined in the following Knowledge Base article: 300966 Howto debug heap corruption issues in Internet Information Services (IIS) Warning 1 client connection(s) in w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp have been executing a request for more than 90 seconds. Please see the Client Connections section of this report for more detailed information about the connection(s). Analysis Details Table Of Contents w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp Top 5 threads by CPU time Thread report COM+ STA ThreadPool Report Well-Known COM STA Threads Report HTTP Report ASP Report Faulting Module Information Report for w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp Type of Analysis Performed Combined Crash/Hang Analysis Machine Name INFCH02041 Operating System Windows Server 2003 Service Pack 2 Number Of Processors 2 Process ID 4468 Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe System Up-Time 4 day(s) 14:22:11 Process Up-Time 0 day(s) 00:19:47 Top 5 Threads by CPU time Note - Times include both user mode and kernel mode for each thread Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry Point for Thread: msvcrt!_endthreadex+2f Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry Point for Thread: msvcrt!_endthreadex+2f Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry Point for Thread: ntdll!RtlpWorkerThread Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry Point for Thread: LeakTrack!UnloadThread Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry Point for Thread: msvcrt!_endthreadex+2f Thread report Thread 0 - System ID 2232 Entry point w3wp!wmainCRTStartup Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.78 Time spent in kernel mode 0 Days 0:0:0.406 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 w3dt!WP_CONTEXT::RunMainThreadLoop+10 w3dt!UlAtqStartListen+2d w3core!W3_SERVER::StartListen+bd w3core!UlW3Start+26e w3wp!wmain+22a w3wp!wmainCRTStartup+12f kernel32!BaseProcessStart+23 Back to Top Thread 1 - System ID 4392 Entry point ntdll!RtlpTimerThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.187 Time spent in kernel mode 0 Days 0:0:0.234 Function Source ntdll!KiFastSystemCallRet ntdll!NtDelayExecution+c ntdll!RtlpTimerThread+47 kernel32!BaseThreadStart+34 Back to Top Thread 2 - System ID 5596 Entry point w3tp!THREAD_MANAGER::ThreadManagerThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.312 Function Source ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion+c kernel32!GetQueuedCompletionStatus+29 w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 w3tp!THREAD_MANAGER::ThreadManagerThread+39 kernel32!BaseThreadStart+34 Back to Top Thread 3 - System ID 5460 Entry point w3tp!THREAD_MANAGER::ThreadManagerThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.15 Function Source ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion+c kernel32!GetQueuedCompletionStatus+29 w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 w3tp!THREAD_MANAGER::ThreadManagerThread+39 kernel32!BaseThreadStart+34 Back to Top Thread 4 - System ID 2164 Entry point w3tp!THREAD_MANAGER::ThreadManagerThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.62 Time spent in kernel mode 0 Days 0:0:0.218 Function Source ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion+c kernel32!GetQueuedCompletionStatus+29 w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 w3tp!THREAD_MANAGER::ThreadManagerThread+39 kernel32!BaseThreadStart+34 Back to Top Thread 5 - System ID 3476 Entry point w3tp!THREAD_MANAGER::ThreadManagerThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.31 Time spent in kernel mode 0 Days 0:0:0.0 Function Source ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion+c kernel32!GetQueuedCompletionStatus+29 w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 w3tp!THREAD_MANAGER::ThreadManagerThread+39 kernel32!BaseThreadStart+34 Back to Top Thread 6 - System ID 2768 Entry point ntdll!RtlpWaitThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.296 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects+c ntdll!RtlpWaitThread+161 kernel32!BaseThreadStart+34 Back to Top Thread 7 - System ID 5800 Entry point w3core!HTTP_COMPRESSION::CompressionThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.281 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 w3core!HTTP_COMPRESSION::CompressionThread+126 kernel32!BaseThreadStart+34 Back to Top Entry point rpcrt4!ThreadStartRoutine Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.296 Function Source ntdll!ExpInterlockedPopEntrySListFault ntdll!RtlpAllocateFromHeapLookaside+13 ntdll!RtlAllocateHeap+1dd LeakTrack!CHeapMemoryLT::HeapAllocDetour+3b rpcrt4!AllocWrapper+1e rpcrt4!operator new+d rpcrt4!RPC_SERVER::CreateThread+7a rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+103 rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+430 rpcrt4!RecvLotsaCallsWrapper+d rpcrt4!BaseCachedThreadRoutine+9d rpcrt4!ThreadStartRoutine+1b kernel32!BaseThreadStart+34 Back to Top Thread 9 - System ID 3284 Entry point ntdll!RtlpIOWorkerThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.15 Function Source ntdll!KiFastSystemCallRet ntdll!NtDelayExecution+c ntdll!RtlpIOWorkerThread+3f kernel32!BaseThreadStart+34 Back to Top Thread 10 - System ID 5124 Entry point asp!CApplnCleanupMgr::ApplnCleanupThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.234 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 asp!CApplnCleanupMgr::ApplnCleanupDoWork+1e asp!CApplnCleanupMgr::ApplnCleanupThread+a kernel32!BaseThreadStart+34 Back to Top Thread 11 - System ID 268 Entry point msvcrt!_endthreadex+2f Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.15 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects+c kernel32!WaitForMultipleObjectsEx+11a user32!RealMsgWaitForMultipleObjectsEx+141 user32!MsgWaitForMultipleObjects+1f asp!CMTACallbackThread::Thread+4f msvcrt!_endthreadex+a3 kernel32!BaseThreadStart+34 Back to Top Thread 12 - System ID 4612 Entry point msvcrt!_endthread+3b Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.281 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects+c kernel32!WaitForMultipleObjectsEx+11a user32!RealMsgWaitForMultipleObjectsEx+141 user32!MsgWaitForMultipleObjects+1f asp!Debugger+9e msvcrt!_endthread+ab kernel32!BaseThreadStart+34 Back to Top Thread 13 - System ID 5964 Entry point pdm!DebuggerThreadEntry Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.46 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects+c kernel32!WaitForMultipleObjectsEx+11a user32!RealMsgWaitForMultipleObjectsEx+141 user32!MsgWaitForMultipleObjects+1f pdm!CDebuggerThread::CallableWaitForMultiple+9d pdm!CDebuggerThread::ThreadEntry+74 pdm!DebuggerThreadEntry+9 kernel32!BaseThreadStart+34 Back to Top Thread 14 - System ID 5728 Entry point asp!CViperReqManager::WatchThread Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.15 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 asp!CViperReqManager::WatchThread+68 kernel32!BaseThreadStart+34 Back to Top Thread 15 - System ID 5272 Entry point msvcrt!_endthreadex+2f Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.218 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 comsvcs!CSTAThreadPool::LoadBalanceThreadControlLoop+29 msvcrt!_endthreadex+a3 kernel32!BaseThreadStart+34 Back to Top Thread 16 - System ID 4624 Entry point msvcrt!_endthreadex+2f Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.15 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 comsvcs!CSTAThreadPool::KillThreadControlLoop+25 msvcrt!_endthreadex+a3 kernel32!BaseThreadStart+34 Back to Top Thread 17 - System ID 272 Entry point msvcrt!_endthreadex+2f Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.46 Time spent in kernel mode 0 Days 0:0:0.312 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects+c kernel32!WaitForMultipleObjectsEx+11a user32!RealMsgWaitForMultipleObjectsEx+141 user32!MsgWaitForMultipleObjects+1f comsvcs!CSTAThread::WorkerLoop+1f9 msvcrt!_endthreadex+a3 kernel32!BaseThreadStart+34 Back to Top Thread 18 - System ID 2976 Entry point msvcrt!_endthreadex+2f Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:2:57.859 Time spent in kernel mode 0 Days 0:8:38.93 This thread is not fully resolved and may or may not be a problem. Further analysis of these threads may be required. Function Source ntdll!ExpInterlockedPopEntrySListFault ntdll!RtlpAllocateFromHeapLookaside+13 ntdll!RtlAllocateHeap+1dd LeakTrack!CHeapMemoryLT::HeapAllocDetour+71 ole32!CRetailMalloc_Alloc+16 LeakTrack!CCoTaskAllocatorLT::IMalloc_AllocDetour+64 oleaut32!APP_DATA::AllocCachedMem+4f oleaut32!SysAllocStringByteLen+2e LeakTrack!CBSTRLT::SysAllocStringByteLenDetour+68 oleaut32!ErrStringCopyNoNull+16 oleaut32!VariantChangeTypeEx+a8c oleaut32!CoerceArg+3ff oleaut32!CTypeInfo2::GetInvokeArgs+422 oleaut32!CTypeInfo2::Invoke+1d7 almcdbacc+6128 vbscript!IDispatchInvoke2+af vbscript!IDispatchInvoke+59 vbscript!InvokeDispatch+13a vbscript!InvokeByName+42 vbscript!CScriptRuntime::Run+2587 vbscript!CScriptEntryPoint::Call+5c vbscript!CScriptRuntime::Run+20d4 vbscript!CScriptEntryPoint::Call+5c vbscript!CScriptRuntime::Run+1f08 vbscript!CScriptEntryPoint::Call+5c vbscript!CSession::Execute+b4 vbscript!COleScript::ExecutePendingScripts+13e vbscript!COleScript::SetScriptState+150 asp!CActiveScriptEngine::TryCall+19 asp!CActiveScriptEngine::Call+31 asp!CallScriptFunctionOfEngine+5b asp!ExecuteRequest+17e asp!Execute+24c asp!CHitObj::ViperAsyncCallback+3f0 asp!CViperAsyncRequest::OnCall+92 comsvcs!CSTAActivityWork::STAActivityWorkHelper+32 ole32!EnterForCallback+c4 ole32!SwitchForCallback+1a3 ole32!PerformCallback+54 ole32!CObjectContext::InternalContextCallback+159 ole32!CObjectContext::DoCallback+1c comsvcs!CSTAActivityWork::DoWork+12d comsvcs!CSTAThread::DoWork+18 comsvcs!CSTAThread::ProcessQueueWork+37 comsvcs!CSTAThread::WorkerLoop+190 msvcrt!_endthreadex+a3 kernel32!BaseThreadStart+34 Back to Top Thread 19 - System ID 3112 Entry point msvcrt!_endthreadex+2f Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.562 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects+c kernel32!WaitForMultipleObjectsEx+11a user32!RealMsgWaitForMultipleObjectsEx+141 user32!MsgWaitForMultipleObjects+1f comsvcs!CSTAThread::WorkerLoop+1f9 msvcrt!_endthreadex+a3 kernel32!BaseThreadStart+34 Back to Top Thread 20 - System ID 3844 Entry point msvcrt!_endthreadex+2f Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:2.312 Time spent in kernel mode 0 Days 0:0:34.937 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForMultipleObjects+c kernel32!WaitForMultipleObjectsEx+11a user32!RealMsgWaitForMultipleObjectsEx+141 user32!MsgWaitForMultipleObjects+1f comsvcs!CSTAThread::WorkerLoop+1f9 msvcrt!_endthreadex+a3 kernel32!BaseThreadStart+34 Back to Top Thread 21 - System ID 900 Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry Create time 2007/09/11 10:11:06 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.250 Function Source ntdll!KiFastSystemCallRet user32!NtUserGetMessage+c ole32!CDllHost::STAWorkerLoop+72 ole32!CDllHost::WorkerThread+c8 ole32!DLLHostThreadEntry+d ole32!CRpcThread::WorkerLoop+26 ole32!CRpcThreadCache::RpcWorkerThreadEntry+20 kernel32!BaseThreadStart+34 Back to Top Thread 22 - System ID 6112 Entry point ntdll!RtlpWorkerThread Create time 2007/09/11 10:13:06 Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.218 Function Source ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion+c ntdll!RtlpWorkerThread+3d kernel32!BaseThreadStart+34 Back to Top Thread 23 - System ID 4276 Entry point comsvcs!PingThread Create time 2007/09/11 10:14:25 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.218 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 comsvcs!PingThread+f6 kernel32!BaseThreadStart+34 Back to Top Thread 24 - System ID 1924 Entry point LeakTrack!CManager::WorkerThread Create time 2007/09/11 10:14:40 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.468 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 LeakTrack!CManager::WorkerThread+6c kernel32!BaseThreadStart+34 Back to Top Thread 25 - System ID 2792 Entry point LeakTrack!CManager::WorkerThread Create time 2007/09/11 10:14:40 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.31 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 LeakTrack!CManager::WorkerThread+6c kernel32!BaseThreadStart+34 Back to Top Thread 26 - System ID 3692 Entry point LeakTrack!UnloadThread Create time 2007/09/11 10:14:40 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.718 Function Source ntdll!KiFastSystemCallRet ntdll!NtWaitForSingleObject+c kernel32!WaitForSingleObjectEx+ac kernel32!WaitForSingleObject+12 LeakTrack!UnloadThread+1e kernel32!BaseThreadStart+34 Back to Top Thread 27 - System ID 3404 Entry point ntdll!RtlpWorkerThread Create time 2007/09/11 10:19:07 Time spent in user mode 0 Days 0:0:0.0 Time spent in kernel mode 0 Days 0:0:0.875 Function Source ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion+c ntdll!RtlpWorkerThread+3d kernel32!BaseThreadStart+34 Back to Top COM+ STA ThreadPool Report Max STA Threads 50 Min STA Threads 4 Current STA Threads 4 g_activitiesPerThread 1 EmulateMTSBehavior False STA Threads In-Call 0 (none) Note: There was an error collecting details for the COM+ STA Threadpool threads. The internal COM+ data structures may have been corrupted. Well-Known COM STA Threads Report STA Name Thread ID Thread Status Call Status Main STA 13 In-Call (bad symbols) Apartment-threaded host for MTA clients 21 Idle (N/A) HTTP report IIS ATQ worker thread count 4 Thread(s) Available ATQ worker thread count 4 Thread(s) Active client connections 20 client connection(s) Client Connections Client connection from 127.0.0.1:3445 to 127.0.0.1:80 Host Header localhost:80 POST request for /jp1netmaudit/ALM_Retrieval.asp HTTP Version HTTP/1.1 SSL Request False Time alive 0 day(s) 00:16:27 QueryString Request mapped to HTTP Request State HTR_READING_CLIENT_REQUEST Native Request State NREQ_STATE_PROCESS 19 connection(s) waiting for the next request. ASP report Executing ASP requests 0 Request(s) ASP templates cached 8 Template(s) ASP template cache size 1,589.66 KBytes Loaded ASP applications 1 Application(s) ASP.DLL Version 6.0.3790.4050 ASP application report ASP application metabase key /LM/W3SVC/1/ROOT Physical Path C:\INETPUB\WWWROOT\ Virtual Root / Session Count 0 Session(s) Request Count 0 Request(s) Session Timeout 20 minutes(s) Path to Global.asa Server side script debugging enabled False Client side script debugging enabled False Out of process COM servers allowed False Session state turned on True Write buffering turned on True Application restart enabled True Parent paths enabled True ASP Script error messages will be sent to browser True ASP Template Cache report ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER \WWWROOT\ALM_INDEX.ASP Application URL http://localhost:80/jp1netmaudit Application Path /jp1netmaudit Template Size 78572 bytes # of files in Template 2 file(s) Include Heirarchy F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT \ALM_INDEX.ASP 2007/08/29 14:14:04 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER \WWWROOT\GLOBAL.ASA Application URL http://localhost:80/jp1netmaudit Application Path /jp1netmaudit Template Size 47152 bytes # of files in Template 3 file(s) Include Heirarchy F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT \GLOBAL.ASA 2007/09/05 14:23:02 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_GLOBALASA.INC 2007/09/05 15:31:26 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_FILEDELETION.INC 2007/07/25 23:04:17 ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER \WWWROOT\ALM_LOGIN.ASP Application URL http://localhost:80/jp1netmaudit Application Path /jp1netmaudit Template Size 109828 bytes # of files in Template 4 file(s) Include Heirarchy F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT \ALM_LOGIN.ASP 2007/08/22 10:25:33 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_LOGINLABEL.INC 2007/03/06 17:33:46 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_MESSAGE.INC 2007/09/06 17:59:30 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER \WWWROOT\ALM_AUTHENTICATION.ASP Application URL http://localhost:80/jp1netmaudit Application Path /jp1netmaudit Template Size 126820 bytes # of files in Template 5 file(s) Include Heirarchy F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT \ALM_AUTHENTICATION.ASP 2007/08/24 14:45:30 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_MESSAGE.INC 2007/09/06 17:59:30 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_LOGINDECODE.INC 2007/03/06 17:33:48 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_LOGINLABEL.INC 2007/03/06 17:33:46 ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER \WWWROOT\ALM_TOPFRAME.ASP Application URL http://localhost:80/jp1netmaudit Application Path /jp1netmaudit Template Size 102716 bytes # of files in Template 4 file(s) Include Heirarchy F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT \ALM_TOPFRAME.ASP 2007/03/11 0:55:22 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_INDEX.INC 2007/08/07 11:51:55 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_MESSAGE.INC 2007/09/06 17:59:30 ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER \WWWROOT\ALM_TREEVIEW.ASP Application URL http://localhost:80/jp1netmaudit Application Path /jp1netmaudit Template Size 133296 bytes # of files in Template 4 file(s) Include Heirarchy F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT \ALM_TREEVIEW.ASP 2007/09/04 11:51:40 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_INDEX.INC 2007/08/07 11:51:55 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_MESSAGE.INC 2007/09/06 17:59:30 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER \WWWROOT\ALM_RETRIEVAL.ASP Application URL http://localhost:80/jp1netmaudit Application Path /jp1netmaudit Template Size 1028732 bytes # of files in Template 9 file(s) Include Heirarchy F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT \ALM_RETRIEVAL.ASP 2007/09/04 17:18:44 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_RETRIEVALTOTALRETRIEVALLABEL.INC 2007/09/06 15:44:23 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_MESSAGE.INC 2007/09/06 17:59:30 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_CREATECSVPDF.INC 2007/03/11 0:55:22 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_CREATESEARCHCONDITION.INC 2007/06/08 16:50:21 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_RETRIEVALFUNC.INC 2007/09/10 20:21:56 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_REPORTLABEL.INC 2007/08/30 18:54:21 F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE \ALMM_REPORTFUNC.INC 2007/09/06 18:26:24 ASP Template for C:\INETPUB\WWWROOT\1.ASP Application URL http://localhost:80/ Application Path / Template Size 694 bytes # of files in Template 1 file(s) Include Heirarchy C:\INETPUB\WWWROOT\1.ASP 2007/09/10 19:29:42 NTDLL!EXPINTERLOCKEDPOPENTRYSLISTFAULT Detailed Info For Corrupt Heap Heap 1 - 0x00080000 Heap Name Default process heap Heap Description This heap is created by default and shared by all modules in the process Reserved memory 512.06 MBytes Committed memory 480.89 MBytes (93.91% of reserved) Uncommitted memory 31.18 MBytes (6.09% of reserved) Number of heap segments 10 segments Number of uncommitted ranges 1 range(s) Size of largest uncommitted range 31.12 MBytes Calculated heap fragmentation 0.19% Segment Information Base Address Reserved Size Committed Size Uncommitted Size Number of uncommitted ranges Largest uncommitted block Calculated heap fragmentation 0x00080640 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00% 0x050f0000 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00% 0x05b30000 2.00 MBytes 2.00 MBytes 0 Bytes 0 0 Bytes 0.00% 0x05d30000 4.00 MBytes 4.00 MBytes 0 Bytes 0 0 Bytes 0.00% 0x06130000 8.00 MBytes 8.00 MBytes 0 Bytes 0 0 Bytes 0.00% 0x06930000 16.00 MBytes 16.00 MBytes 0 Bytes 0 0 Bytes 0.00% 0x07930000 32.00 MBytes 32.00 MBytes 0 Bytes 0 0 Bytes 0.00% 0x09930000 64.00 MBytes 64.00 MBytes 0 Bytes 0 0 Bytes 0.00% 0x10170000 128.00 MBytes 128.00 MBytes 0 Bytes 0 0 Bytes 0.00% 0x23410000 256.00 MBytes 224.88 MBytes 31.12 MBytes 1 31.12 MBytes 0.00% Top 5 allocations by size Allocation Size - 512 Allocation Size - 32 Allocation Size - 144 Allocation Size - 64 Allocation Size - 80 471.58 MBytes 602.75 KBytes 135.70 KBytes 101.69 KBytes 88.98 KBytes Top 5 allocations by count Allocation Size - 512 Allocation Size - 32 Allocation Size - 28 Allocation Size - 64 Allocation Size - 80 965794 allocation(s) 19288 allocation(s) 1948 allocation(s) 1627 allocation(s) 1139 allocation(s) Back to Top In w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000002 on thread 8 Heap corruption was detected in heap 0x00080000, however pageheap was not enabled in this dump. Please follow the instructions in the recommendation section for troubleshooting heap corruption issues. Current NTGlobalFlags value: 0x0 Module Information Image Name: C:\WINDOWS\system32\ntdll.dll Symbol Type: PDB Base address: 0x7c950000 Time Stamp: Sat Feb 17 21:22:26 2007 Checksum: 0x000dfa0d Comments: COM DLL: False Company Name: Microsoft Corporation ISAPIExtension: False File Description: NT Layer DLL ISAPIFilter: False File Version: 5.2.3790.3959 (srv03_sp2_rtm. 070216-1710) Managed DLL: False Internal Name: ntdll.dll VB DLL: False Legal Copyright: c Microsoft Corporation. All rights reserved. Loaded Image Name: ntdll.dll Legal Trademarks: Mapped Image Name: Original filename: ntdll.dll Module name: ntdll Private Build: Single Threaded: False Product Name: MicrosoftR WindowsR Operating System Module Size: 872.00 KBytes Product Version: 5.2.3790.3959 Symbol File Name: c:\symcache\ntdll.pdb \93E72E109DC84F16AA54797E4DA8C1682\ntdll.pdb Special Build: & Script Summary Script Name Status Error Code Error Source Error Description Source Line IISAnalysis.asp Completed We are not able to diagonise the problem.we will be happy ,if you can able to help us.
From: Steve Schofield on 15 Sep 2007 22:16 Do you have some custom ISAPI's? http://support.microsoft.com/kb/892988 -- Best regards, Steve Schofield Windows Server MVP - IIS http://weblogs.asp.net/steveschofield http://www.IISLogs.com Log archival solution. Install, Configure, Forget <GaneshBabu.CV(a)gmail.com> wrote in message news:1189771346.662292.57480(a)50g2000hsm.googlegroups.com... > Hi, > > We are running ASP application in IIS 6.0. > But w3wp.exe crashes unexpectedly with the following message. > > An exception dialog appears and one of the following message is logged > in event log > > > And any one of the following are logged in the System log during the > w3wp.exe exception: > Message 1 > > Event Type: Warning > Event Source: W3SVC > Event Category: None > Event ID: 1009 > Date: Date > Time: Time > User: N/A > Computer: ComputerName > Description: > A process serving application pool 'DefaultAppPool' terminated > unexpectedly. The process id was '1234'. The process exit code was > '0xc0000005'. > > > Message 2 > > Event Type: Warning > Event Source: W3SVC > Event Category: None > Event ID: 1011 > Date: Date > Time: Time > User: N/A > Computer: ComputerName > Description: > A process serving application pool 'DefaultAppPool' suffered a fatal > communication error with the World Wide Web Publishing Service. The > process id was '1234'. The data field contains the error number. > > Message 3 > > Event Type: Warning > Event Source: W3SVC > Event Category: None > Event ID: 1013 > Date: Date > Time: Time > User: N/A > Computer: ComputerName > Description: > The process where application pool 'DefaultAppPool' was offered > exceeded the time limitation in the middle of the shutdown. Process id > was two '41 ' > > > At times, only any of the above entry is found in the event log > without the w3wp.exe exception dialog. > > We have run Microsoft's debug tool(Debug Diag) and have captured the > following > > > Analysis Summary > Type Description Recommendation > Error In > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an > access violation exception (0xC0000005) when trying to read from > memory location 0x00000002 on thread 8 > > > > Heap corruption was detected in heap 0x00080000, however pageheap was > not enabled in this dump. Please follow the instructions in the > recommendation section for troubleshooting heap corruption issues. > > > > Current NTGlobalFlags value: 0x0 An access violation exception thrown > by a heap memory manager function indicates heap corruption. Please > follow the steps outlined in the following Knowledge Base article: > > 300966 Howto debug heap corruption issues in Internet Information > Services (IIS) > Warning 1 client connection(s) in > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > have been executing a request for more than 90 seconds. Please see the > Client Connections section of this report for more detailed > information about the connection(s). > > > > > > Analysis Details > Table Of Contents > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > Top 5 threads by CPU time > > Thread report > > COM+ STA ThreadPool Report > > Well-Known COM STA Threads Report > > HTTP Report > > ASP Report > > Faulting Module Information > > > > > Report for > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > Type of Analysis Performed Combined Crash/Hang Analysis > Machine Name INFCH02041 > Operating System Windows Server 2003 Service Pack 2 > Number Of Processors 2 > Process ID 4468 > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe > System Up-Time 4 day(s) 14:22:11 > Process Up-Time 0 day(s) 00:19:47 > > > > Top 5 Threads by CPU time > Note - Times include both user mode and kernel mode for each thread > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry > Point for Thread: msvcrt!_endthreadex+2f > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry > Point for Thread: msvcrt!_endthreadex+2f > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry > Point for Thread: ntdll!RtlpWorkerThread > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry > Point for Thread: LeakTrack!UnloadThread > Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry > Point for Thread: msvcrt!_endthreadex+2f > > > > > > Thread report > > Thread 0 - System ID 2232 > Entry point w3wp!wmainCRTStartup > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.78 > Time spent in kernel mode 0 Days 0:0:0.406 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > w3dt!WP_CONTEXT::RunMainThreadLoop+10 > w3dt!UlAtqStartListen+2d > w3core!W3_SERVER::StartListen+bd > w3core!UlW3Start+26e > w3wp!wmain+22a > w3wp!wmainCRTStartup+12f > kernel32!BaseProcessStart+23 > > > > > Back to Top > > > Thread 1 - System ID 4392 > Entry point ntdll!RtlpTimerThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.187 > Time spent in kernel mode 0 Days 0:0:0.234 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtDelayExecution+c > ntdll!RtlpTimerThread+47 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 2 - System ID 5596 > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.15 > Time spent in kernel mode 0 Days 0:0:0.312 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!ZwRemoveIoCompletion+c > kernel32!GetQueuedCompletionStatus+29 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 3 - System ID 5460 > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.15 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!ZwRemoveIoCompletion+c > kernel32!GetQueuedCompletionStatus+29 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 4 - System ID 2164 > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.62 > Time spent in kernel mode 0 Days 0:0:0.218 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!ZwRemoveIoCompletion+c > kernel32!GetQueuedCompletionStatus+29 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 5 - System ID 3476 > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.31 > Time spent in kernel mode 0 Days 0:0:0.0 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!ZwRemoveIoCompletion+c > kernel32!GetQueuedCompletionStatus+29 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 6 - System ID 2768 > Entry point ntdll!RtlpWaitThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.296 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForMultipleObjects+c > ntdll!RtlpWaitThread+161 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 7 - System ID 5800 > Entry point w3core!HTTP_COMPRESSION::CompressionThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.281 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > w3core!HTTP_COMPRESSION::CompressionThread+126 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Entry point rpcrt4!ThreadStartRoutine > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.15 > Time spent in kernel mode 0 Days 0:0:0.296 > > > > > Function Source > ntdll!ExpInterlockedPopEntrySListFault > ntdll!RtlpAllocateFromHeapLookaside+13 > ntdll!RtlAllocateHeap+1dd > LeakTrack!CHeapMemoryLT::HeapAllocDetour+3b > rpcrt4!AllocWrapper+1e > rpcrt4!operator new+d > rpcrt4!RPC_SERVER::CreateThread+7a > rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+103 > rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+430 > rpcrt4!RecvLotsaCallsWrapper+d > rpcrt4!BaseCachedThreadRoutine+9d > rpcrt4!ThreadStartRoutine+1b > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 9 - System ID 3284 > Entry point ntdll!RtlpIOWorkerThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.15 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtDelayExecution+c > ntdll!RtlpIOWorkerThread+3f > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 10 - System ID 5124 > Entry point asp!CApplnCleanupMgr::ApplnCleanupThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.234 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > asp!CApplnCleanupMgr::ApplnCleanupDoWork+1e > asp!CApplnCleanupMgr::ApplnCleanupThread+a > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 11 - System ID 268 > Entry point msvcrt!_endthreadex+2f > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.15 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForMultipleObjects+c > kernel32!WaitForMultipleObjectsEx+11a > user32!RealMsgWaitForMultipleObjectsEx+141 > user32!MsgWaitForMultipleObjects+1f > asp!CMTACallbackThread::Thread+4f > msvcrt!_endthreadex+a3 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 12 - System ID 4612 > Entry point msvcrt!_endthread+3b > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.281 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForMultipleObjects+c > kernel32!WaitForMultipleObjectsEx+11a > user32!RealMsgWaitForMultipleObjectsEx+141 > user32!MsgWaitForMultipleObjects+1f > asp!Debugger+9e > msvcrt!_endthread+ab > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 13 - System ID 5964 > Entry point pdm!DebuggerThreadEntry > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.46 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForMultipleObjects+c > kernel32!WaitForMultipleObjectsEx+11a > user32!RealMsgWaitForMultipleObjectsEx+141 > user32!MsgWaitForMultipleObjects+1f > pdm!CDebuggerThread::CallableWaitForMultiple+9d > pdm!CDebuggerThread::ThreadEntry+74 > pdm!DebuggerThreadEntry+9 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 14 - System ID 5728 > Entry point asp!CViperReqManager::WatchThread > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.15 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > asp!CViperReqManager::WatchThread+68 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 15 - System ID 5272 > Entry point msvcrt!_endthreadex+2f > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.218 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > comsvcs!CSTAThreadPool::LoadBalanceThreadControlLoop+29 > msvcrt!_endthreadex+a3 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 16 - System ID 4624 > Entry point msvcrt!_endthreadex+2f > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.15 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > comsvcs!CSTAThreadPool::KillThreadControlLoop+25 > msvcrt!_endthreadex+a3 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 17 - System ID 272 > Entry point msvcrt!_endthreadex+2f > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.46 > Time spent in kernel mode 0 Days 0:0:0.312 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForMultipleObjects+c > kernel32!WaitForMultipleObjectsEx+11a > user32!RealMsgWaitForMultipleObjectsEx+141 > user32!MsgWaitForMultipleObjects+1f > comsvcs!CSTAThread::WorkerLoop+1f9 > msvcrt!_endthreadex+a3 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 18 - System ID 2976 > Entry point msvcrt!_endthreadex+2f > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:2:57.859 > Time spent in kernel mode 0 Days 0:8:38.93 > > > > > This thread is not fully resolved and may or may not be a problem. > Further analysis of these threads may be required. > > > > Function Source > ntdll!ExpInterlockedPopEntrySListFault > ntdll!RtlpAllocateFromHeapLookaside+13 > ntdll!RtlAllocateHeap+1dd > LeakTrack!CHeapMemoryLT::HeapAllocDetour+71 > ole32!CRetailMalloc_Alloc+16 > LeakTrack!CCoTaskAllocatorLT::IMalloc_AllocDetour+64 > oleaut32!APP_DATA::AllocCachedMem+4f > oleaut32!SysAllocStringByteLen+2e > LeakTrack!CBSTRLT::SysAllocStringByteLenDetour+68 > oleaut32!ErrStringCopyNoNull+16 > oleaut32!VariantChangeTypeEx+a8c > oleaut32!CoerceArg+3ff > oleaut32!CTypeInfo2::GetInvokeArgs+422 > oleaut32!CTypeInfo2::Invoke+1d7 > almcdbacc+6128 > vbscript!IDispatchInvoke2+af > vbscript!IDispatchInvoke+59 > vbscript!InvokeDispatch+13a > vbscript!InvokeByName+42 > vbscript!CScriptRuntime::Run+2587 > vbscript!CScriptEntryPoint::Call+5c > vbscript!CScriptRuntime::Run+20d4 > vbscript!CScriptEntryPoint::Call+5c > vbscript!CScriptRuntime::Run+1f08 > vbscript!CScriptEntryPoint::Call+5c > vbscript!CSession::Execute+b4 > vbscript!COleScript::ExecutePendingScripts+13e > vbscript!COleScript::SetScriptState+150 > asp!CActiveScriptEngine::TryCall+19 > asp!CActiveScriptEngine::Call+31 > asp!CallScriptFunctionOfEngine+5b > asp!ExecuteRequest+17e > asp!Execute+24c > asp!CHitObj::ViperAsyncCallback+3f0 > asp!CViperAsyncRequest::OnCall+92 > comsvcs!CSTAActivityWork::STAActivityWorkHelper+32 > ole32!EnterForCallback+c4 > ole32!SwitchForCallback+1a3 > ole32!PerformCallback+54 > ole32!CObjectContext::InternalContextCallback+159 > ole32!CObjectContext::DoCallback+1c > comsvcs!CSTAActivityWork::DoWork+12d > comsvcs!CSTAThread::DoWork+18 > comsvcs!CSTAThread::ProcessQueueWork+37 > comsvcs!CSTAThread::WorkerLoop+190 > msvcrt!_endthreadex+a3 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 19 - System ID 3112 > Entry point msvcrt!_endthreadex+2f > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.15 > Time spent in kernel mode 0 Days 0:0:0.562 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForMultipleObjects+c > kernel32!WaitForMultipleObjectsEx+11a > user32!RealMsgWaitForMultipleObjectsEx+141 > user32!MsgWaitForMultipleObjects+1f > comsvcs!CSTAThread::WorkerLoop+1f9 > msvcrt!_endthreadex+a3 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 20 - System ID 3844 > Entry point msvcrt!_endthreadex+2f > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:2.312 > Time spent in kernel mode 0 Days 0:0:34.937 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForMultipleObjects+c > kernel32!WaitForMultipleObjectsEx+11a > user32!RealMsgWaitForMultipleObjectsEx+141 > user32!MsgWaitForMultipleObjects+1f > comsvcs!CSTAThread::WorkerLoop+1f9 > msvcrt!_endthreadex+a3 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 21 - System ID 900 > Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry > Create time 2007/09/11 10:11:06 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.250 > > > > > Function Source > ntdll!KiFastSystemCallRet > user32!NtUserGetMessage+c > ole32!CDllHost::STAWorkerLoop+72 > ole32!CDllHost::WorkerThread+c8 > ole32!DLLHostThreadEntry+d > ole32!CRpcThread::WorkerLoop+26 > ole32!CRpcThreadCache::RpcWorkerThreadEntry+20 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 22 - System ID 6112 > Entry point ntdll!RtlpWorkerThread > Create time 2007/09/11 10:13:06 > Time spent in user mode 0 Days 0:0:0.15 > Time spent in kernel mode 0 Days 0:0:0.218 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!ZwRemoveIoCompletion+c > ntdll!RtlpWorkerThread+3d > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 23 - System ID 4276 > Entry point comsvcs!PingThread > Create time 2007/09/11 10:14:25 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.218 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > comsvcs!PingThread+f6 > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 24 - System ID 1924 > Entry point LeakTrack!CManager::WorkerThread > Create time 2007/09/11 10:14:40 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.468 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > LeakTrack!CManager::WorkerThread+6c > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 25 - System ID 2792 > Entry point LeakTrack!CManager::WorkerThread > Create time 2007/09/11 10:14:40 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.31 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > LeakTrack!CManager::WorkerThread+6c > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 26 - System ID 3692 > Entry point LeakTrack!UnloadThread > Create time 2007/09/11 10:14:40 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.718 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!NtWaitForSingleObject+c > kernel32!WaitForSingleObjectEx+ac > kernel32!WaitForSingleObject+12 > LeakTrack!UnloadThread+1e > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > Thread 27 - System ID 3404 > Entry point ntdll!RtlpWorkerThread > Create time 2007/09/11 10:19:07 > Time spent in user mode 0 Days 0:0:0.0 > Time spent in kernel mode 0 Days 0:0:0.875 > > > > > Function Source > ntdll!KiFastSystemCallRet > ntdll!ZwRemoveIoCompletion+c > ntdll!RtlpWorkerThread+3d > kernel32!BaseThreadStart+34 > > > > > Back to Top > > COM+ STA ThreadPool Report > Max STA Threads 50 > Min STA Threads 4 > Current STA Threads 4 > g_activitiesPerThread 1 > EmulateMTSBehavior False > STA Threads In-Call 0 (none) > > > > > Note: There was an error collecting details for the COM+ STA > Threadpool threads. The internal COM+ data structures may have been > corrupted. > > > Well-Known COM STA Threads Report > STA Name Thread ID Thread Status Call Status > > Main STA 13 In-Call (bad symbols) > Apartment-threaded host for MTA clients 21 Idle (N/A) > > > > HTTP report > IIS ATQ worker thread count 4 Thread(s) > Available ATQ worker thread count 4 Thread(s) > Active client connections 20 client connection(s) > > > > Client Connections > Client connection from 127.0.0.1:3445 to 127.0.0.1:80 > Host Header localhost:80 > POST request for /jp1netmaudit/ALM_Retrieval.asp > HTTP Version HTTP/1.1 > SSL Request False > Time alive 0 day(s) 00:16:27 > QueryString > Request mapped to > HTTP Request State HTR_READING_CLIENT_REQUEST > Native Request State NREQ_STATE_PROCESS > > > > > 19 connection(s) waiting for the next request. > ASP report > Executing ASP requests 0 Request(s) > ASP templates cached 8 Template(s) > ASP template cache size 1,589.66 KBytes > Loaded ASP applications 1 Application(s) > ASP.DLL Version 6.0.3790.4050 > > > > ASP application report > ASP application metabase key /LM/W3SVC/1/ROOT > Physical Path C:\INETPUB\WWWROOT\ > Virtual Root / > Session Count 0 Session(s) > Request Count 0 Request(s) > Session Timeout 20 minutes(s) > Path to Global.asa > Server side script debugging enabled False > Client side script debugging enabled False > Out of process COM servers allowed False > Session state turned on True > Write buffering turned on True > Application restart enabled True > Parent paths enabled True > ASP Script error messages will be sent to browser True > > > > ASP Template Cache report > ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER > \WWWROOT\ALM_INDEX.ASP > Application URL http://localhost:80/jp1netmaudit > Application Path /jp1netmaudit > Template Size 78572 bytes > # of files in Template 2 file(s) > Include Heirarchy > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT > \ALM_INDEX.ASP 2007/08/29 14:14:04 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 > > > > ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER > \WWWROOT\GLOBAL.ASA > Application URL http://localhost:80/jp1netmaudit > Application Path /jp1netmaudit > Template Size 47152 bytes > # of files in Template 3 file(s) > Include Heirarchy > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT > \GLOBAL.ASA 2007/09/05 14:23:02 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_GLOBALASA.INC 2007/09/05 15:31:26 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_FILEDELETION.INC 2007/07/25 23:04:17 > > > > ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER > \WWWROOT\ALM_LOGIN.ASP > Application URL http://localhost:80/jp1netmaudit > Application Path /jp1netmaudit > Template Size 109828 bytes > # of files in Template 4 file(s) > Include Heirarchy > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT > \ALM_LOGIN.ASP 2007/08/22 10:25:33 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_LOGINLABEL.INC 2007/03/06 17:33:46 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_MESSAGE.INC 2007/09/06 17:59:30 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 > > > > ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER > \WWWROOT\ALM_AUTHENTICATION.ASP > Application URL http://localhost:80/jp1netmaudit > Application Path /jp1netmaudit > Template Size 126820 bytes > # of files in Template 5 file(s) > Include Heirarchy > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT > \ALM_AUTHENTICATION.ASP 2007/08/24 14:45:30 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_MESSAGE.INC 2007/09/06 17:59:30 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_LOGINDECODE.INC 2007/03/06 17:33:48 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_LOGINLABEL.INC 2007/03/06 17:33:46 > > > > ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER > \WWWROOT\ALM_TOPFRAME.ASP > Application URL http://localhost:80/jp1netmaudit > Application Path /jp1netmaudit > Template Size 102716 bytes > # of files in Template 4 file(s) > Include Heirarchy > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT > \ALM_TOPFRAME.ASP 2007/03/11 0:55:22 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_INDEX.INC 2007/08/07 11:51:55 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_MESSAGE.INC 2007/09/06 17:59:30 > > > > ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER > \WWWROOT\ALM_TREEVIEW.ASP > Application URL http://localhost:80/jp1netmaudit > Application Path /jp1netmaudit > Template Size 133296 bytes > # of files in Template 4 file(s) > Include Heirarchy > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT > \ALM_TREEVIEW.ASP 2007/09/04 11:51:40 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_INDEX.INC 2007/08/07 11:51:55 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_MESSAGE.INC 2007/09/06 17:59:30 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 > > > > ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER > \WWWROOT\ALM_RETRIEVAL.ASP > Application URL http://localhost:80/jp1netmaudit > Application Path /jp1netmaudit > Template Size 1028732 bytes > # of files in Template 9 file(s) > Include Heirarchy > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT > \ALM_RETRIEVAL.ASP 2007/09/04 17:18:44 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_RETRIEVALTOTALRETRIEVALLABEL.INC 2007/09/06 15:44:23 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_MESSAGE.INC 2007/09/06 17:59:30 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_CREATECSVPDF.INC 2007/03/11 0:55:22 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_CREATESEARCHCONDITION.INC 2007/06/08 16:50:21 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_RETRIEVALFUNC.INC 2007/09/10 20:21:56 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_REPORTLABEL.INC 2007/08/30 18:54:21 > > F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE > \ALMM_REPORTFUNC.INC 2007/09/06 18:26:24 > > > > ASP Template for C:\INETPUB\WWWROOT\1.ASP > Application URL http://localhost:80/ > Application Path / > Template Size 694 bytes > # of files in Template 1 file(s) > Include Heirarchy > C:\INETPUB\WWWROOT\1.ASP 2007/09/10 19:29:42 > > > > NTDLL!EXPINTERLOCKEDPOPENTRYSLISTFAULT > > > > > Detailed Info For Corrupt Heap > Heap 1 - 0x00080000 > Heap Name Default process heap > Heap Description This heap is created by default and shared by all > modules in the process > Reserved memory 512.06 MBytes > Committed memory 480.89 MBytes (93.91% of reserved) > Uncommitted memory 31.18 MBytes (6.09% of reserved) > Number of heap segments 10 segments > Number of uncommitted ranges 1 range(s) > Size of largest uncommitted range 31.12 MBytes > Calculated heap fragmentation 0.19% > > > > > > Segment Information > Base Address Reserved Size Committed Size Uncommitted Size Number of > uncommitted ranges Largest uncommitted block Calculated heap > fragmentation > 0x00080640 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00% > 0x050f0000 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00% > 0x05b30000 2.00 MBytes 2.00 MBytes 0 Bytes 0 0 Bytes 0.00% > 0x05d30000 4.00 MBytes 4.00 MBytes 0 Bytes 0 0 Bytes 0.00% > 0x06130000 8.00 MBytes 8.00 MBytes 0 Bytes 0 0 Bytes 0.00% > 0x06930000 16.00 MBytes 16.00 MBytes 0 Bytes 0 0 Bytes 0.00% > 0x07930000 32.00 MBytes 32.00 MBytes 0 Bytes 0 0 Bytes 0.00% > 0x09930000 64.00 MBytes 64.00 MBytes 0 Bytes 0 0 Bytes 0.00% > 0x10170000 128.00 MBytes 128.00 MBytes 0 Bytes 0 0 Bytes 0.00% > 0x23410000 256.00 MBytes 224.88 MBytes 31.12 MBytes 1 31.12 MBytes > 0.00% > > > > > > Top 5 allocations by size > > Allocation Size - 512 > Allocation Size - 32 > Allocation Size - 144 > Allocation Size - 64 > Allocation Size - 80 > > > > > > 471.58 MBytes > 602.75 KBytes > 135.70 KBytes > 101.69 KBytes > 88.98 KBytes > > > Top 5 allocations by count > > Allocation Size - 512 > Allocation Size - 32 > Allocation Size - 28 > Allocation Size - 64 > Allocation Size - 80 > > > > > > 965794 allocation(s) > 19288 allocation(s) > 1948 allocation(s) > 1627 allocation(s) > 1139 allocation(s) > > Back to Top > > > > > > > > In > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an > access violation exception (0xC0000005) when trying to read from > memory location 0x00000002 on thread 8 > > > > Heap corruption was detected in heap 0x00080000, however pageheap was > not enabled in this dump. Please follow the instructions in the > recommendation section for troubleshooting heap corruption issues. > > > > Current NTGlobalFlags value: 0x0 Module Information > Image Name: C:\WINDOWS\system32\ntdll.dll Symbol Type: PDB > Base address: 0x7c950000 Time Stamp: Sat Feb 17 21:22:26 2007 > Checksum: 0x000dfa0d Comments: > COM DLL: False Company Name: Microsoft Corporation > ISAPIExtension: False File Description: NT Layer DLL > ISAPIFilter: False File Version: 5.2.3790.3959 (srv03_sp2_rtm. > 070216-1710) > Managed DLL: False Internal Name: ntdll.dll > VB DLL: False Legal Copyright: c Microsoft Corporation. All rights > reserved. > Loaded Image Name: ntdll.dll Legal Trademarks: > Mapped Image Name: Original filename: ntdll.dll > Module name: ntdll Private Build: > Single Threaded: False Product Name: MicrosoftR WindowsR Operating > System > Module Size: 872.00 KBytes Product Version: 5.2.3790.3959 > Symbol File Name: c:\symcache\ntdll.pdb > \93E72E109DC84F16AA54797E4DA8C1682\ntdll.pdb Special Build: & > > > > > > > > > Script Summary > Script Name Status Error Code Error Source Error Description Source > Line > IISAnalysis.asp Completed > > > > > We are not able to diagonise the problem.we will be happy ,if you can > able to help us. >
From: GaneshBabu.CV on 17 Sep 2007 00:52 Thanks for the help. But we dont use any ISAPI DLLs in our application. We reviewed the code for memory leaks but didnt find any problem. This problem is occurring only in windows 2003 R2 SP2. Will it be a problem with 2003 R2? On Sep 16, 12:14 pm, David Wang <w3.4...(a)gmail.com> wrote: > Your application is running native code which is crashing the worker > process (that's what 0xc0000005 means). > > There is also signs of memory corruption in the worker process. It > *may* be the cause of the crash (in which case you have one issue), or > it may not (which means you have more than one issue within your > website). > > Please start by identifying all custom ISAPI Filter DLL and ISAPI > Extension DLL loaded on your server. > > When there is signs of memory corruption, the code that actually > crashed may *not* be the culprit but rather unfortunate victim of the > memory corrupting code. For example, the code that crashed in your > example was NTDLL, an internal Windows DLL, but what it was doing is > hardly the cause of the memory corruption -- it is clearly the victim > of some other memory corrupting code. It is usually beneficial to > enable PageHeap to catch many (but not all) code that corrupt memory > as it corrupts its, which is like catching a crook red-handed. > > Microsoft publishes free Application Verifier as well as Debugging > Tools which do all these things (and more), as well as general > instructions on how to use them. It would be beneficial in your > situation to use them to diagnose your issue. > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang > // > > On Sep 14, 5:02 am, GaneshBabu...(a)gmail.com wrote: > > > > > Hi, > > > We are running ASP application in IIS 6.0. > > But w3wp.exe crashes unexpectedly with the following message. > > > An exception dialog appears and one of the following message is logged > > in event log > > > And any one of the following are logged in the System log during the > > w3wp.exe exception: > > Message 1 > > > Event Type: Warning > > Event Source: W3SVC > > Event Category: None > > Event ID: 1009 > > Date: Date > > Time: Time > > User: N/A > > Computer: ComputerName > > Description: > > A process serving application pool 'DefaultAppPool' terminated > > unexpectedly. The process id was '1234'. The process exit code was > > '0xc0000005'. > > > Message 2 > > > Event Type: Warning > > Event Source: W3SVC > > Event Category: None > > Event ID: 1011 > > Date: Date > > Time: Time > > User: N/A > > Computer: ComputerName > > Description: > > A process serving application pool 'DefaultAppPool' suffered a fatal > > communication error with the World Wide Web Publishing Service. The > > process id was '1234'. The data field contains the error number. > > > Message 3 > > > Event Type: Warning > > Event Source: W3SVC > > Event Category: None > > Event ID: 1013 > > Date: Date > > Time: Time > > User: N/A > > Computer: ComputerName > > Description: > > The process where application pool 'DefaultAppPool' was offered > > exceeded the time limitation in the middle of the shutdown. Process id > > was two '41 ' > > > At times, only any of the above entry is found in the event log > > without the w3wp.exe exception dialog. > > > We have run Microsoft's debug tool(Debug Diag) and have captured the > > following > > > Analysis Summary > > Type Description Recommendation > > Error In > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an > > access violation exception (0xC0000005) when trying to read from > > memory location 0x00000002 on thread 8 > > > Heap corruption was detected in heap 0x00080000, however pageheap was > > not enabled in this dump. Please follow the instructions in the > > recommendation section for troubleshooting heap corruption issues. > > > Current NTGlobalFlags value: 0x0 An access violation exception thrown > > by a heap memory manager function indicates heap corruption. Please > > follow the steps outlined in the following Knowledge Base article: > > > 300966 Howto debug heap corruption issues in Internet Information > > Services (IIS) > > Warning 1 client connection(s) in > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > have been executing a request for more than 90 seconds. Please see the > > Client Connections section of this report for more detailed > > information about the connection(s). > > > Analysis Details > > Table Of Contents > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > Top 5 threads by CPU time > > > Thread report > > > COM+ STA ThreadPool Report > > > Well-Known COM STA Threads Report > > > HTTP Report > > > ASP Report > > > Faulting Module Information > > > Report for > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > Type of Analysis Performed Combined Crash/Hang Analysis > > Machine Name INFCH02041 > > Operating System Windows Server 2003 Service Pack 2 > > Number Of Processors 2 > > Process ID 4468 > > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe > > System Up-Time 4 day(s) 14:22:11 > > Process Up-Time 0 day(s) 00:19:47 > > > Top 5 Threads by CPU time > > Note - Times include both user mode and kernel mode for each thread > > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry > > Point for Thread: msvcrt!_endthreadex+2f > > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry > > Point for Thread: msvcrt!_endthreadex+2f > > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry > > Point for Thread: ntdll!RtlpWorkerThread > > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry > > Point for Thread: LeakTrack!UnloadThread > > Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry > > Point for Thread: msvcrt!_endthreadex+2f > > > Thread report > > > Thread 0 - System ID 2232 > > Entry point w3wp!wmainCRTStartup > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.78 > > Time spent in kernel mode 0 Days 0:0:0.406 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!NtWaitForSingleObject+c > > kernel32!WaitForSingleObjectEx+ac > > kernel32!WaitForSingleObject+12 > > w3dt!WP_CONTEXT::RunMainThreadLoop+10 > > w3dt!UlAtqStartListen+2d > > w3core!W3_SERVER::StartListen+bd > > w3core!UlW3Start+26e > > w3wp!wmain+22a > > w3wp!wmainCRTStartup+12f > > kernel32!BaseProcessStart+23 > > > Back to Top > > > Thread 1 - System ID 4392 > > Entry point ntdll!RtlpTimerThread > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.187 > > Time spent in kernel mode 0 Days 0:0:0.234 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!NtDelayExecution+c > > ntdll!RtlpTimerThread+47 > > kernel32!BaseThreadStart+34 > > > Back to Top > > > Thread 2 - System ID 5596 > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.15 > > Time spent in kernel mode 0 Days 0:0:0.312 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!ZwRemoveIoCompletion+c > > kernel32!GetQueuedCompletionStatus+29 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > > kernel32!BaseThreadStart+34 > > > Back to Top > > > Thread 3 - System ID 5460 > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.0 > > Time spent in kernel mode 0 Days 0:0:0.15 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!ZwRemoveIoCompletion+c > > kernel32!GetQueuedCompletionStatus+29 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > > kernel32!BaseThreadStart+34 > > > Back to Top > > > Thread 4 - System ID 2164 > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.62 > > Time spent in kernel mode 0 Days 0:0:0.218 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!ZwRemoveIoCompletion+c > > kernel32!GetQueuedCompletionStatus+29 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > > kernel32!BaseThreadStart+34 > > > Back to Top > > > Thread 5 - System ID 3476 > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.31 > > Time spent in kernel mode 0 Days 0:0:0.0 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!ZwRemoveIoCompletion+c > > kernel32!GetQueuedCompletionStatus+29 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > > kernel32!BaseThreadStart+34 > > > Back to Top > > > Thread 6 - System ID 2768 > > Entry point ntdll!RtlpWaitThread > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.0 > > Time spent in kernel mode 0 Days 0:0:0.296 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!NtWaitForMultipleObjects+c > > ntdll!RtlpWaitThread+161 > > kernel32!BaseThreadStart+34 > > > Back to Top > > > Thread 7 - System ID 5800 > > Entry point w3core!HTTP_COMPRESSION::CompressionThread > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.0 > > Time spent in kernel mode 0 Days 0:0:0.281 > > > Function Source > > ntdll!KiFastSystemCallRet > > ntdll!NtWaitForSingleObject+c > > kernel32!WaitForSingleObjectEx+ac > > kernel32!WaitForSingleObject+12 > > w3core!HTTP_COMPRESSION::CompressionThread+126 > > kernel32!BaseThreadStart+34 > > > Back to Top > > > Entry point rpcrt4!ThreadStartRoutine > > Create time 2007/09/11 10:11:06 > > Time spent in user mode 0 Days 0:0:0.15 > > Time spent in kernel mode 0 Days 0:0:0.296 > > > Function Source > > ntdll!ExpInterlockedPopEntrySListFault > > ntdll!RtlpAllocateFromHeapLookaside+13 > > ntdll!RtlAllocateHeap+1dd > > LeakTrack!CHeapMemoryLT::HeapAllocDetour+3b > > rpcrt4!AllocWrapper+1e > > rpcrt4!operator new+d > > rpcrt4!RPC_SERVER::CreateThread+7a > > rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+103 > > rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+430 > > rpcrt4!RecvLotsaCallsWrapper+d > > rpcrt4!BaseCachedThreadRoutine+9d > > rpcrt4!ThreadStartRoutine+1b > > ... > > read more »- Hide quoted text - > > - Show quoted text -
From: GaneshBabu.CV on 18 Sep 2007 02:52 Yes Sir our code is ASP, but we do use COM DLLs for Database connectivity and Logging. When we analyzed the memory leaks we found out that the BSTR were not freed using SysFreeString(). When we called SysFreeString also the same problem persists. Sometimes we get an exception dialog from w3wp.exe, it is an memory exception. I downloaded Application verifier from micorosoft site but Iam not able to execute w3wp.exe using the verifier. When Debug diag is not runnning the exception dialog apperas and event log entries are created, but if Debug diag is executed then the Exception dialog does not appear and only event log entries are created. Please help me in how to use Appverifier for w3wp.exe service and suggest me some method through which i can identify the cause of the problem. Thanks in Advance On Sep 18, 1:23 am, David Wang <w3.4...(a)gmail.com> wrote: > It *could*, but I consider it the last option to explore because if it > is a problem with IIS/Windows, the issue would be hit far more > frequently and honestly we haven't seen such a deluge. I realize that > users usually trust their own code and not Microsoft's, but history > has shown that to be an incorrect assumption. Put in another way -- if > your application gets used by 100 million people in countless > different ways, how likely do you think it'd have issues? > > ISAPI DLL is a common cause but not the only. Are you running *any* > third party code with your application. I see that your application is > ASP, so it is purely ASP which does not do *any* Server.CreateObject() > or new ActiveXObject() calls? Those calls would load other native > code into the web server that could crash, even if your web page is > pure ASP. > > I'm also going to have to check if that "crash" is one of the expected > exceptions -- there's a couple of internal Windows APIs that actually > use exceptions as a normal part of operation and should be ignored by > the debugger. I could have sworn ntdll! > ExpInterlockedPopEntrySListFault is one of them. > > Does this happen if you do not run DebugDiag to track memory leaks? > Because you have a crash, not memory leak, and they are tracked > differently > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang > // > > On Sep 16, 9:52 pm, GaneshBabu...(a)gmail.com wrote: > > > > > Thanks for the help. But we dont use any ISAPI DLLs in our > > application. We reviewed the code for memory leaks but didnt find any > > problem. This problem is occurring only in windows 2003 R2 SP2. Will > > it be a problem with 2003 R2? > > > On Sep 16, 12:14 pm, David Wang <w3.4...(a)gmail.com> wrote: > > > > Your application is running native code which is crashing the worker > > > process (that's what 0xc0000005 means). > > > > There is also signs of memory corruption in the worker process. It > > > *may* be the cause of the crash (in which case you have one issue), or > > > it may not (which means you have more than one issue within your > > > website). > > > > Please start by identifying all custom ISAPI Filter DLL and ISAPI > > > Extension DLL loaded on your server. > > > > When there is signs of memory corruption, the code that actually > > > crashed may *not* be the culprit but rather unfortunate victim of the > > > memory corrupting code. For example, the code that crashed in your > > > example was NTDLL, an internal Windows DLL, but what it was doing is > > > hardly the cause of the memory corruption -- it is clearly the victim > > > of some other memory corrupting code. It is usually beneficial to > > > enable PageHeap to catch many (but not all) code that corrupt memory > > > as it corrupts its, which is like catching a crook red-handed. > > > > Microsoft publishes free Application Verifier as well as Debugging > > > Tools which do all these things (and more), as well as general > > > instructions on how to use them. It would be beneficial in your > > > situation to use them to diagnose your issue. > > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang > > > // > > > > On Sep 14, 5:02 am, GaneshBabu...(a)gmail.com wrote: > > > > > Hi, > > > > > We are running ASP application in IIS 6.0. > > > > But w3wp.exe crashes unexpectedly with the following message. > > > > > An exception dialog appears and one of the following message is logged > > > > in event log > > > > > And any one of the following are logged in the System log during the > > > > w3wp.exe exception: > > > > Message 1 > > > > > Event Type: Warning > > > > Event Source: W3SVC > > > > Event Category: None > > > > Event ID: 1009 > > > > Date: Date > > > > Time: Time > > > > User: N/A > > > > Computer: ComputerName > > > > Description: > > > > A process serving application pool 'DefaultAppPool' terminated > > > > unexpectedly. The process id was '1234'. The process exit code was > > > > '0xc0000005'. > > > > > Message 2 > > > > > Event Type: Warning > > > > Event Source: W3SVC > > > > Event Category: None > > > > Event ID: 1011 > > > > Date: Date > > > > Time: Time > > > > User: N/A > > > > Computer: ComputerName > > > > Description: > > > > A process serving application pool 'DefaultAppPool' suffered a fatal > > > > communication error with the World Wide Web Publishing Service. The > > > > process id was '1234'. The data field contains the error number. > > > > > Message 3 > > > > > Event Type: Warning > > > > Event Source: W3SVC > > > > Event Category: None > > > > Event ID: 1013 > > > > Date: Date > > > > Time: Time > > > > User: N/A > > > > Computer: ComputerName > > > > Description: > > > > The process where application pool 'DefaultAppPool' was offered > > > > exceeded the time limitation in the middle of the shutdown. Process id > > > > was two '41 ' > > > > > At times, only any of the above entry is found in the event log > > > > without the w3wp.exe exception dialog. > > > > > We have run Microsoft's debug tool(Debug Diag) and have captured the > > > > following > > > > > Analysis Summary > > > > Type Description Recommendation > > > > Error In > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in > > > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an > > > > access violation exception (0xC0000005) when trying to read from > > > > memory location 0x00000002 on thread 8 > > > > > Heap corruption was detected in heap 0x00080000, however pageheap was > > > > not enabled in this dump. Please follow the instructions in the > > > > recommendation section for troubleshooting heap corruption issues. > > > > > Current NTGlobalFlags value: 0x0 An access violation exception thrown > > > > by a heap memory manager function indicates heap corruption. Please > > > > follow the steps outlined in the following Knowledge Base article: > > > > > 300966 Howto debug heap corruption issues in Internet Information > > > > Services (IIS) > > > > Warning 1 client connection(s) in > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > have been executing a request for more than 90 seconds. Please see the > > > > Client Connections section of this report for more detailed > > > > information about the connection(s). > > > > > Analysis Details > > > > Table Of Contents > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > > Top 5 threads by CPU time > > > > > Thread report > > > > > COM+ STA ThreadPool Report > > > > > Well-Known COM STA Threads Report > > > > > HTTP Report > > > > > ASP Report > > > > > Faulting Module Information > > > > > Report for > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > Type of Analysis Performed Combined Crash/Hang Analysis > > > > Machine Name INFCH02041 > > > > Operating System Windows Server 2003 Service Pack 2 > > > > Number Of Processors 2 > > > > Process ID 4468 > > > > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe > > > > System Up-Time 4 day(s) 14:22:11 > > > > Process Up-Time 0 day(s) 00:19:47 > > > > > Top 5 Threads by CPU time > > > > Note - Times include both user mode and kernel mode for each thread > > > > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry > > > > Point for Thread: msvcrt!_endthreadex+2f > > > > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry > > > > Point for Thread: msvcrt!_endthreadex+2f > > > > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry > > > > Point for Thread: ntdll!RtlpWorkerThread > > > > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry > > > > Point for Thread: LeakTrack!UnloadThread > > > > Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry > > > > Point for Thread: msvcrt!_endthreadex+2f > > > > > Thread report > > > > > Thread 0 - System ID 2232 > > > > Entry point w3wp!wmainCRTStartup > > > > Create time 2007/09/11 10:11:06 > > > > Time spent in user mode 0 Days 0:0:0.78 > > > > Time spent in kernel mode 0 Days 0:0:0.406 > > > > > Function Source > > > > ntdll!KiFastSystemCallRet > > > > ntdll!NtWaitForSingleObject+c > > > > kernel32!WaitForSingleObjectEx+ac > > > > kernel32!WaitForSingleObject+12 > > > > w3dt!WP_CONTEXT::RunMainThreadLoop+10 > > > > w3dt!UlAtqStartListen+2d > > > > w3core!W3_SERVER::StartListen+bd > > > > w3core!UlW3Start+26e > > > > w3wp!wmain+22a > > > > w3wp!wmainCRTStartup+12f > > > > kernel32!BaseProcessStart+23 > > > > > Back to Top > > > > > Thread 1 - System ID 4392 > > > > Entry point ntdll!RtlpTimerThread > > > > Create time 2007/09/11 10:11:06 > > > > Time spent in user mode 0 Days 0:0:0.187 > > > > Time spent in kernel mode 0 Days 0:0:0.234 > > > > > Function Source > > > > ntdll!KiFastSystemCallRet > > > > ntdll!NtDelayExecution+c > > > > ntdll!RtlpTimerThread+47 > > > > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > > > Thread 2 - System ID 5596 > > > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > > > > Create time 2007/09/11 10:11:06 > > > > Time spent in user mode 0 Days 0:0:0.15 > > > > Time spent in kernel mode 0 Days 0:0:0.312 > > > > > Function Source > > > > ntdll!KiFastSystemCallRet > > > > ntdll!ZwRemoveIoCompletion+c > > > > kernel32!GetQueuedCompletionStatus+29 > > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > > > > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > > > > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > > > Thread 3 - System ID 5460 > > > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread > > > > Create time 2007/09/11 10:11:06 > > > > Time spent in user mode 0 Days 0:0:0.0 > > > > Time spent in kernel mode 0 Days 0:0:0.15 > > > > > Function Source > > > > ntdll!KiFastSystemCallRet > > > > ntdll!ZwRemoveIoCompletion+c > > > > kernel32!GetQueuedCompletionStatus+29 > > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33 > > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 > > > > w3tp!THREAD_MANAGER::ThreadManagerThread+39 > > > > kernel32!BaseThreadStart+34 > > > > > Back to Top > > > > > Thread 4 - System ID 2164 > > > > Entry > > ... > > read more »- Hide quoted text - > > - Show quoted text -
From: GaneshBabu.CV on 21 Sep 2007 00:26
Dear Sir In order to simulate the memory problem we executed our application for almost 48 hours continiously. We didnt get any memory exception but after 48 hours the session was cut and the following message was logged in the event log A process serving application pool DefaultAppPool exceeded time limits during shut down. The process id was process id. Event ID - 1013 Is it a problem or it is because our application ran for a long time the process was shutdown. On Sep 18, 12:55 pm, David Wang <w3.4...(a)gmail.com> wrote: > Following the strategy that I outline at:http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Understand_... > > We are going after the issues one at a time, not all at once. > > We know there is memory corruption. I would use Application Verifier > and enable "Page Heap" on w3wp.exe, and then try to reproduce the > issue. > > When it happens, Application Verifier will break into the process. If > you happen to have a debugger attached, you can directly observe the > culprit. > > How to do this is beyond the scope of this newsgroup. You can either > learn on your own, pay someone else to learn, or pay someone else to > do it. > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang > // > > On Sep 17, 11:52 pm,GaneshBabu...(a)gmail.com wrote: > > > > > Yes Sir our code is ASP, but we do use COM DLLs for Database > > connectivity and Logging. When we analyzed the memory leaks we found > > out that the BSTR were not freed using SysFreeString(). When we called > > SysFreeString also the same problem persists. Sometimes we get an > > exception dialog from w3wp.exe, it is an memory exception. I > > downloaded Application verifier from micorosoft site but Iam not able > > to execute w3wp.exe using the verifier. When Debug diag is not > > runnning the exception dialog apperas and event log entries are > > created, but if Debug diag is executed then the Exception dialog does > > not appear and only event log entries are created. Please help me in > > how to use Appverifier for w3wp.exe service and suggest me some method > > through which i can identify the cause of the problem. > > > Thanks in Advance > > > On Sep 18, 1:23 am, David Wang <w3.4...(a)gmail.com> wrote: > > > > It *could*, but I consider it the last option to explore because if it > > > is a problem with IIS/Windows, the issue would be hit far more > > > frequently and honestly we haven't seen such a deluge. I realize that > > > users usually trust their own code and not Microsoft's, but history > > > has shown that to be an incorrect assumption. Put in another way -- if > > > your application gets used by 100 million people in countless > > > different ways, how likely do you think it'd have issues? > > > > ISAPI DLL is a common cause but not the only. Are you running *any* > > > third party code with your application. I see that your application is > > > ASP, so it is purely ASP which does not do *any* Server.CreateObject() > > > or new ActiveXObject() calls? Those calls would load other native > > > code into the web server that could crash, even if your web page is > > > pure ASP. > > > > I'm also going to have to check if that "crash" is one of the expected > > > exceptions -- there's a couple of internal Windows APIs that actually > > > use exceptions as a normal part of operation and should be ignored by > > > the debugger. I could have sworn ntdll! > > > ExpInterlockedPopEntrySListFault is one of them. > > > > Does this happen if you do not run DebugDiag to track memory leaks? > > > Because you have a crash, not memory leak, and they are tracked > > > differently > > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang > > > // > > > > On Sep 16, 9:52 pm,GaneshBabu...(a)gmail.com wrote: > > > > > Thanks for the help. But we dont use any ISAPI DLLs in our > > > > application. We reviewed the code for memory leaks but didnt find any > > > > problem. This problem is occurring only in windows 2003 R2 SP2. Will > > > > it be a problem with 2003 R2? > > > > > On Sep 16, 12:14 pm, David Wang <w3.4...(a)gmail.com> wrote: > > > > > > Your application is running native code which is crashing the worker > > > > > process (that's what 0xc0000005 means). > > > > > > There is also signs of memory corruption in the worker process. It > > > > > *may* be the cause of the crash (in which case you have one issue), or > > > > > it may not (which means you have more than one issue within your > > > > > website). > > > > > > Please start by identifying all custom ISAPI Filter DLL and ISAPI > > > > > Extension DLL loaded on your server. > > > > > > When there is signs of memory corruption, the code that actually > > > > > crashed may *not* be the culprit but rather unfortunate victim of the > > > > > memory corrupting code. For example, the code that crashed in your > > > > > example was NTDLL, an internal Windows DLL, but what it was doing is > > > > > hardly the cause of the memory corruption -- it is clearly the victim > > > > > of some other memory corrupting code. It is usually beneficial to > > > > > enable PageHeap to catch many (but not all) code that corrupt memory > > > > > as it corrupts its, which is like catching a crook red-handed. > > > > > > Microsoft publishes free Application Verifier as well as Debugging > > > > > Tools which do all these things (and more), as well as general > > > > > instructions on how to use them. It would be beneficial in your > > > > > situation to use them to diagnose your issue. > > > > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang > > > > > // > > > > > > On Sep 14, 5:02 am,GaneshBabu...(a)gmail.com wrote: > > > > > > > Hi, > > > > > > > We are running ASP application in IIS 6.0. > > > > > > But w3wp.exe crashes unexpectedly with the following message. > > > > > > > An exception dialog appears and one of the following message is logged > > > > > > in event log > > > > > > > And any one of the following are logged in the System log during the > > > > > > w3wp.exe exception: > > > > > > Message 1 > > > > > > > Event Type: Warning > > > > > > Event Source: W3SVC > > > > > > Event Category: None > > > > > > Event ID: 1009 > > > > > > Date: Date > > > > > > Time: Time > > > > > > User: N/A > > > > > > Computer: ComputerName > > > > > > Description: > > > > > > A process serving application pool 'DefaultAppPool' terminated > > > > > > unexpectedly. The process id was '1234'. The process exit code was > > > > > > '0xc0000005'. > > > > > > > Message 2 > > > > > > > Event Type: Warning > > > > > > Event Source: W3SVC > > > > > > Event Category: None > > > > > > Event ID: 1011 > > > > > > Date: Date > > > > > > Time: Time > > > > > > User: N/A > > > > > > Computer: ComputerName > > > > > > Description: > > > > > > A process serving application pool 'DefaultAppPool' suffered a fatal > > > > > > communication error with the World Wide Web Publishing Service. The > > > > > > process id was '1234'. The data field contains the error number. > > > > > > > Message 3 > > > > > > > Event Type: Warning > > > > > > Event Source: W3SVC > > > > > > Event Category: None > > > > > > Event ID: 1013 > > > > > > Date: Date > > > > > > Time: Time > > > > > > User: N/A > > > > > > Computer: ComputerName > > > > > > Description: > > > > > > The process where application pool 'DefaultAppPool' was offered > > > > > > exceeded the time limitation in the middle of the shutdown. Process id > > > > > > was two '41 ' > > > > > > > At times, only any of the above entry is found in the event log > > > > > > without the w3wp.exe exception dialog. > > > > > > > We have run Microsoft's debug tool(Debug Diag) and have captured the > > > > > > following > > > > > > > Analysis Summary > > > > > > Type Description Recommendation > > > > > > Error In > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > > > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in > > > > > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an > > > > > > access violation exception (0xC0000005) when trying to read from > > > > > > memory location 0x00000002 on thread 8 > > > > > > > Heap corruption was detected in heap 0x00080000, however pageheap was > > > > > > not enabled in this dump. Please follow the instructions in the > > > > > > recommendation section for troubleshooting heap corruption issues. > > > > > > > Current NTGlobalFlags value: 0x0 An access violation exception thrown > > > > > > by a heap memory manager function indicates heap corruption. Please > > > > > > follow the steps outlined in the following Knowledge Base article: > > > > > > > 300966 Howto debug heap corruption issues in Internet Information > > > > > > Services (IIS) > > > > > > Warning 1 client connection(s) in > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > > > have been executing a request for more than 90 seconds. Please see the > > > > > > Client Connections section of this report for more detailed > > > > > > information about the connection(s). > > > > > > > Analysis Details > > > > > > Table Of Contents > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > > > > Top 5 threads by CPU time > > > > > > > Thread report > > > > > > > COM+ STA ThreadPool Report > > > > > > > Well-Known COM STA Threads Report > > > > > > > HTTP Report > > > > > > > ASP Report > > > > > > > Faulting Module Information > > > > > > > Report for > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Second_Chance_Exception_C0000005.dmp > > > > > > Type of Analysis Performed Combined Crash/Hang Analysis > > > > > > Machine Name INFCH02041 > > > > > > Operating System Windows Server 2003 Service Pack 2 > > > > > > Number Of Processors 2 > > > > > > Process ID 4468 > > > > > > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe > > > > > > System Up-Time 4 day(s) 14:22:11 > > > > > > Process Up-Time 0 day(s) 00:19:47 > > > > > > > Top 5 Threads by CPU time > > > > > > Note - Times include both user mode and kernel mode for each thread > > > > > > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry > > > > > > Point for Thread: msvcrt!_endthreadex+2f > > > > > > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry > > > > > > Point for Thread: msvcrt!_endthreadex+2f > > > > > > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry > > > > > > Point for Thread: ntdll!RtlpWorkerThread > > > > > > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry > > > > > > Point for Thread: LeakTrack!UnloadThread > > > > > > Thread ID: 19 Total CPU Time: 0 > > ... > > read more »- Hide quoted text - > > - Show quoted text - |