Previous Next

Thread: WAS randomly generates Event ID: 5009 in conjunction with AppErr Event ID: 1000

Last post 05-23-2008 3:32 PM by ChristophS. 5 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (6 items)

Sort Posts:

  • 05-22-2008, 4:45 PM

    WAS randomly generates Event ID: 5009 in conjunction with AppErr Event ID: 1000

    My setup:

    IIS7 on Windows Server 2008 Standard x64
    ASP.NET feature is installed but not used right now (the error was there before this feature was installed, so don't start there with problem solving)
    PHP x64 as ISAPI module (also the error was there before this was installed)
    HTTP Redirect, Logging features installed

    And all the standard stuff like compression, static pages etc.

    I randomly see from 5-20 times a day the following error:

    System Log (Warning):

    A process serving application pool 'iishosting.de' terminated unexpectedly. The process id was '2864'. The process exit code was '0xff'.

    • function Toggle(node) { if (!window.fullyLoaded) return; // Expand the branch? if (node.nextSibling.style.display == 'none') { // Change the sign from "+" to "-". var tBodyNode = node.childNodes[0]; var trNode = tBodyNode.childNodes[0]; var tdNode = trNode.childNodes[0]; var bNode = tdNode.childNodes[0]; var textNode = bNode.childNodes[0]; if (textNode.nodeType == 3 /* Node.TEXT_NODE */) { var s = textNode.data; if (s.length > 0 && s.charAt(0) == '+') { textNode.data = '-' + s.substring(1, s.length); } } // show the branch node.nextSibling.style.display = ''; } else // Collapse the branch { // Change the sign from "-" to "+". var tBodyNode = node.childNodes[0]; var trNode = tBodyNode.childNodes[0]; var tdNode = trNode.childNodes[0]; var bNode = tdNode.childNodes[0]; var textNode = bNode.childNodes[0]; if (textNode.nodeType == 3 /* Node.TEXT_NODE */) { var s = textNode.data; if (s.length > 0 && s.charAt(0) == '-') { textNode.data = '+' + s.substring(1, s.length); } } // hide the branch node.nextSibling.style.display = 'none'; } } // Toggle "System" element by default so that it's default status is to hide its children function ToggleSystemElement() { var body = document.getElementById("body"); var anchor = body.getElementsByTagName("table")[0]; Toggle(anchor); } // If binary data is present in event XML, show it in friendly form. function ProcessBinaryData(binaryString, binaryDataCaption, wordsFormatString, bytesFormatString, normalFont, fixedWidthFont) { var bodyNode = document.getElementById("body"); // Add a
      at the end of the HTML body. bodyNode.appendChild(document.createElement("hr")); // This paragraph (p element) is the "Binary data:" literal string. var p = document.createElement("p"); p.style.fontFamily = normalFont; var b = document.createElement("b"); b.appendChild(document.createTextNode(binaryDataCaption)); p.appendChild(b); p.appendChild(document.createElement("br")); bodyNode.appendChild(p); // // Show binary data in Words format. // p = document.createElement("p"); p.style.fontFamily = normalFont; p.appendChild(document.createTextNode(wordsFormatString)); bodyNode.appendChild(p); // Must use fixed-width font for binary data. p = document.createElement("p"); p.style.fontFamily = fixedWidthFont; var i = 0; var j = 0; var s, tempS; var translatedString; var charCode; var byte1, byte2; // Each character in binaryString is a hex (16-based) representation of // 4 binary bits. So it takes 2 characters in binaryString to form a // complete byte; 4 characters for a word. while (i
      - System


      - Provider



      [ Name] Microsoft-Windows-WAS



      [ Guid] {524B5D04-133C-4A62-8362-64E8EDB9CE40}



      [ EventSourceName] WAS


      - EventID 5009



      [ Qualifiers] 32768



      Version 0



      Level 3



      Task 0



      Opcode 0



      Keywords 0x80000000000000


      - TimeCreated



      [ SystemTime] 2008-05-22T20:35:39.000Z



      EventRecordID 9513



      Correlation


      - Execution



      [ ProcessID] 0



      [ ThreadID] 0



      Channel System



      Computer Tokyo.iishosting.de



      Security
      - EventData


      AppPoolID iishosting.de


      ProcessID 2864


      ExitCode ff
       

    And at the same time in the Application Log (Error):

    Faulting application w3wp.exe, version 7.0.6001.18000, time stamp 0x47919ed8, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791adec, exception code 0xc0000374, fault offset 0x00000000000a6e97, process id 0xb30, application start time 0x01c8bc4851434751.

    •   function Toggle(node) { if (!window.fullyLoaded) return; // Expand the branch? if (node.nextSibling.style.display == 'none') { // Change the sign from "+" to "-". var tBodyNode = node.childNodes[0]; var trNode = tBodyNode.childNodes[0]; var tdNode = trNode.childNodes[0]; var bNode = tdNode.childNodes[0]; var textNode = bNode.childNodes[0]; if (textNode.nodeType == 3 /* Node.TEXT_NODE */) { var s = textNode.data; if (s.length > 0 && s.charAt(0) == '+') { textNode.data = '-' + s.substring(1, s.length); } } // show the branch node.nextSibling.style.display = ''; } else // Collapse the branch { // Change the sign from "-" to "+". var tBodyNode = node.childNodes[0]; var trNode = tBodyNode.childNodes[0]; var tdNode = trNode.childNodes[0]; var bNode = tdNode.childNodes[0]; var textNode = bNode.childNodes[0]; if (textNode.nodeType == 3 /* Node.TEXT_NODE */) { var s = textNode.data; if (s.length > 0 && s.charAt(0) == '-') { textNode.data = '+' + s.substring(1, s.length); } } // hide the branch node.nextSibling.style.display = 'none'; } } // Toggle "System" element by default so that it's default status is to hide its children function ToggleSystemElement() { var body = document.getElementById("body"); var anchor = body.getElementsByTagName("table")[0]; Toggle(anchor); } // If binary data is present in event XML, show it in friendly form. function ProcessBinaryData(binaryString, binaryDataCaption, wordsFormatString, bytesFormatString, normalFont, fixedWidthFont) { var bodyNode = document.getElementById("body"); // Add a
      at the end of the HTML body. bodyNode.appendChild(document.createElement("hr")); // This paragraph (p element) is the "Binary data:" literal string. var p = document.createElement("p"); p.style.fontFamily = normalFont; var b = document.createElement("b"); b.appendChild(document.createTextNode(binaryDataCaption)); p.appendChild(b); p.appendChild(document.createElement("br")); bodyNode.appendChild(p); // // Show binary data in Words format. // p = document.createElement("p"); p.style.fontFamily = normalFont; p.appendChild(document.createTextNode(wordsFormatString)); bodyNode.appendChild(p); // Must use fixed-width font for binary data. p = document.createElement("p"); p.style.fontFamily = fixedWidthFont; var i = 0; var j = 0; var s, tempS; var translatedString; var charCode; var byte1, byte2; // Each character in binaryString is a hex (16-based) representation of // 4 binary bits. So it takes 2 characters in binaryString to form a // complete byte; 4 characters for a word. while (i
      - System


      - Provider



      [ Name] Application Error


      - EventID 1000



      [ Qualifiers] 0



      Level 2



      Task 100



      Keywords 0x80000000000000


      - TimeCreated



      [ SystemTime] 2008-05-22T20:35:37.000Z



      EventRecordID 1836



      Channel Application



      Computer Tokyo.iishosting.de



      Security
      - EventData



      w3wp.exe



      7.0.6001.18000



      47919ed8



      ntdll.dll



      6.0.6001.18000



      4791adec



      c0000374



      00000000000a6e97



      b30



      01c8bc4851434751

    This error happened at 22:35:39 GMT +1 (2 minutes ago) and there wasn't even someone browsing that website. The last visit was at 20:14:51 which is weird because I visited the site at 22:14 so the log files seem to be 2 hours early although the server time is correct and shows 22:36 right now. Why is this in the first place that the log file shows GMT -1 times? Anyway that's not the bigger issue here.

    The app pool should have been shutdown at 22:34:39 due to inactivity and the default 20 minutes timeout so I don't know why it generates an error 1 and a half minute later anyway. I also see this Event ID 1000 when I shutdown IIS manually. All App Pools (they all have the default values, there are just several to seperate the websites) seem to crash when I shutdown IIS. Although I only receive the Event ID 1000 Error then and not the Event ID 5009 which just happens randomly.

    I have no users complaining about errors when visiting sites and I haven't experienced any errors when browsing the sites as well but I really don't like warnings in my logs and even less errors. My Win 2003 setup had less than 1 warning a day and 0 errors in weeks I want this tidyness again!! :D

    Thanks in advance for any help and let me know if you need additional info. I intended to post a debug trace with the Diagnostics Tool but it doesn't work when IIS is in 64-bit mode which I don't want to change.

  • 05-22-2008, 4:50 PM In reply to

    Re: WAS randomly generates Event ID: 5009 in conjunction with AppErr Event ID: 1000

     Sorry dunno why I see this junk of html code up there, I hope it's not too annoying. I don't get it removed when I post the detailed error report.

  • 05-22-2008, 5:55 PM In reply to

    • anilr
    • Top 10 Contributor
    • Joined on 05-23-2006, 10:13 PM
    • Redmond, WA
    • Posts 1,225

    Re: WAS randomly generates Event ID: 5009 in conjunction with AppErr Event ID: 1000

    That error is STATUS_HEAP_CORRUPTION - so some code running in the worker process is corrupting the heap.  If it your code, you will need to attach a debugger (and maybe use things like app-verifier) to get to the bottom of this.  If this is microsoft/IIS code, you can go to "problem reports and solutions" in control panel and click "check for solutions to problems" to send crash data collected by windows to microsoft - also, once you have done that, the problems would have a bucket id assigned to them, if you post that here, I can look at it.

    Anil Ruia
    Senior Software Design Engineer
    IIS Core Server
  • 05-23-2008, 6:50 AM In reply to

    Re: WAS randomly generates Event ID: 5009 in conjunction with AppErr Event ID: 1000

      Well I don't really know what that "some code" should be. I have a few app pools with sites that contain only static .htm not even with javascript or anything in them. And even these app pools caused this random error a few times already.

      I have sent about 500 error reports with practically the same error already because auto error reports are turned on. Unfortunately no solutions can be found though.

      Here is the data of the latest report:

    Problem signature
    Problem Event Name:    APPCRASH
    Application Name:    w3wp.exe
    Application Version:    7.0.6001.18000
    Application Timestamp:    47919ed8
    Fault Module Name:    StackHash_f6a9
    Fault Module Version:    6.0.6001.18000
    Fault Module Timestamp:    4791adec
    Exception Code:    c0000374
    Exception Offset:    00000000000a6e97
    OS Version:    6.0.6001.2.1.0.272.36
    Locale ID:    1031
    Additional Information 1:    f6a9
    Additional Information 2:    759774abbb232e93c7f03b4baffc3162
    Additional Information 3:    899c
    Additional Information 4:    a56c9dae37e630ae6bf7d31e12e11c1e

    Extra information about the problem
    Bucket ID:    1031459

      Thank you very much for your assistance!!

    P.S. A few other bucket IDs with this error (most of the time the same is shown on different error reports):
    1031459 (static .htm website in its own pool)
    1135349 (php site in its own pool)
    1031459 (php site again shortly after the one before)
    1031459 (interesting this is the same bucket id from a static site again because it's a different site than the first ID and third ID)

  • 05-23-2008, 12:33 PM In reply to

    • anilr
    • Top 10 Contributor
    • Joined on 05-23-2006, 10:13 PM
    • Redmond, WA
    • Posts 1,225

    Re: WAS randomly generates Event ID: 5009 in conjunction with AppErr Event ID: 1000

    I took a look at the bucket id and it seems to be heap corruption bug in php5isapi.dll during worker process shutdown - this seems to be the most common cause of crash in w3wp.exe - you should work with php developers to get this fixed - or maybe use php with fastcgi - since the bug seems to happen only during worker process shutdown, it never results in any errors on the client etc.

    Anil Ruia
    Senior Software Design Engineer
    IIS Core Server
  • 05-23-2008, 3:32 PM In reply to

    Re: WAS randomly generates Event ID: 5009 in conjunction with AppErr Event ID: 1000

     Hmmm if it's indeed a PHP problem I will remove the PHP handler from most app pools as it is only required for 2 app pools. I was just too lazy to make it a non-default config.

    The strange thing is, I was using the same version of PHP on IIS6 (Win 2003) and there it was working fine. I see if I can compile the latest version of PHP and maybe the error goes away then.

     Thanks for your help so far :-)

Page 1 of 1 (6 items)
Page view counter