« Previous Next »

• 04-16-2009, 2:38 PM

  a382453 Joined on 04-16-2009, 3:51 PM Posts 2

  Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll Reply Contact What do I need to do for this listed Recommendation? We received a wc3 service error weekly during some processing. system logs : event ID 1011 => A process serving application pool 'DefaultAppPool' suffered a fatal communication error with the World Wide Web Publishing Service. The process id was '4108'. The data field contains the error number. Running the IIS debug tool, this is what i found: Description In w3wp__PID__4108__Date__04_16_2009__Time_11_14_15AM__7__Second_Chance_Exception_C0000005.dmp the assembly instruction at kernel32!InterlockedDecrement+9 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to write to memory location 0x018babf0 on thread 136 Recommendation Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll  Details Thread 136 - System ID 6068 Entry point   ntdll!RtlpWorkerThread Create time   4/16/2009 11:13:14 AM Time spent in user mode   0 Days 00:00:00.00 Time spent in kernel mode   0 Days 00:00:00.00   Function   Source kernel32!InterlockedDecrement+9    w3cache!CACHE_HINT_MANAGER::HintFlushByTTL+12    w3cache!CTypedHashTable<CACHE_HINT_HASH,CACHE_HINT_ENTRY,unsigned short *,CLKRHashTable>::_Pred+10    iisutil!CLKRLinearHashTable::_DeleteIf+7d    iisutil!CLKRHashTable::DeleteIf+4c    w3cache!CTypedHashTable<CACHE_HINT_HASH,CACHE_HINT_ENTRY,unsigned short *,CLKRHashTable>::DeleteIf+2b    w3cache!CACHE_HINT_MANAGER::FlushByTTL+f    w3cache!CACHE_HINT_MANAGER::ScavengerCallback+d    ntdll!RtlpWaitOrTimerCallout+74    ntdll!RtlpAsyncTimerCallbackCompletion+2d    ntdll!RtlpWorkerCallout+71    ntdll!RtlpExecuteWorkerRequest+4f    ntdll!RtlpApcCallout+11    ntdll!RtlpWorkerThread+61    kernel32!BaseThreadStart+34

  Tags: IIS 6.0 MemoryIIS hangsCrashIIS 6.0 worker process w3wpwhy application pool/worker process crashes?W3WP worker process crash Debug Diag Dump6.0application pool

• 04-17-2009, 2:31 AM

  In reply to

  lextm Joined on 10-22-2008, 4:18 AM Shanghai, PRC Posts 1,417

  Re: Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll Reply Contact You can refer to the following KB articles, IIS crash http://support.microsoft.com/kb/919789   Memory leak http://support.microsoft.com/kb/919790   High CPU http://support.microsoft.com/kb/919791   Hang http://support.microsoft.com/kb/919792   As you only pasted one event, I am not sure which one is matching your case. If we can capture correct dump files, then we can identify the root cause. Lex Li Support Engineer at Microsoft --------------------------- This posting is provided "AS IS" with no warranties, and confers no rights.

• 04-17-2009, 11:40 AM

  In reply to

  a382453 Joined on 04-16-2009, 3:51 PM Posts 2

  Re: Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll Reply Contact Can you be more specifie for what info i need to provide? This is the analysis summary from the from the DebugDiag. (including the 2 warning types). Hopefully this helps. Type Description Recommendation   Error In w3wp__PID__4108__Date__04_16_2009__Time_11_14_15AM__7__Second_Chance_Exception_C0000005.dmp the assembly instruction at kernel32!InterlockedDecrement+9 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to write to memory location 0x018babf0 on thread 136 Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll   Warning The following threads in w3wp__PID__4108__Date__04_16_2009__Time_11_14_15AM__7__Second_Chance_Exception_C0000005.dmp are calling an ISAPI Extension wcsisapi ( 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 ) 86.23% of threads blocked The purpose of ISAPI extensions is to "extend" the functionality of a web site. Without ISAPI extensions the IIS web service would be similar to the FTP service where it simply returns static (unchanging) files. If a developer of an ISAPI extension has not written any sort of custom "thread pool" then the ISAPI extension they wrote will execute on the default threads that handle the incoming requests (ATQ thread) of the web service. The maximum number of threads in the ATQ thread pool is 256 but is typically much lower due to system resources. If enough ATQ threads become unavailable due to hanging requests to an ISAPI extension then soon IIS will have no threads available to handle any requests. Please follow up with vendor Crystal Decisions for problem resolution concerning the following file: \\?\D:\Program Files\Crystal Decisions\Enterprise 10\win32_x86\wcsisapi.dll.   Warning The following threads in w3wp__PID__4108__Date__04_16_2009__Time_11_14_15AM__7__Second_Chance_Exception_C0000005.dmp are waiting on data to be returned from another server via WinSock. The call to WinSock originated from ebus_3_3_2_1!OCI_IIOP_Transport_impl::receive+34 and is destined for port 1607 at IP address 162.111.73.77 ( 130 133 ) 1.45% of threads blocked Ensure that any remote server this application may be calling is functioning properly and there are no network issues between the two servers. If the problem continues, please contact the application vendor for further assistance

• 04-18-2009, 12:38 AM

  In reply to

  lextm Joined on 10-22-2008, 4:18 AM Shanghai, PRC Posts 1,417

  Re: Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll Reply Contact Thanks for posting the report. But I think this dump provides us little information about the real problem. Actually the four KB articles I provided reveal a few problem patterns. So please review your event logs and also double check your problem symptons to see which case you are in. Then you can capture another group of dumps to see if that can provide us useful information about the root cause. If you find it difficult to do that yourself, please feel free to contact Microsoft support hotline. http://support.microsoft.com/ Lex Li Support Engineer at Microsoft --------------------------- This posting is provided "AS IS" with no warranties, and confers no rights.

• 06-15-2009, 9:15 AM

  In reply to

  srkjain Joined on 06-09-2009, 1:25 PM Bangalore Posts 12

  Re: Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll Reply Contact hi I am facing similar problem as urs, and debug diagnostics tools analysis reveals the same problem as "kernal.dll access violation" did you find any solutions to your problem? if yes please share with me, i am desperately trying to resolve this problem from last 6 months.   Thanks Rakesh Rakesh Jain

• 06-15-2009, 9:41 PM

  In reply to

  lextm Joined on 10-22-2008, 4:18 AM Shanghai, PRC Posts 1,417

  Re: Please follow up with the vendor Microsoft Corporation for C:\WINDOWS\system32\kernel32.dll Reply Contact I would like to comment that such "kernal.dll access violation" messages are facade of the real problem. In fact such a problem might orginate from another module. To better understand the cause, you must capture the right dumps at right time and have them carefully analyzed. Debug Diagnostics is mainly a tool to capture dumps, and as you noticed its dump analysis engine is not as powerful as manual analysis. So if you need assistance on such problems and dump analysis, you can contact Microsoft support team. Lex Li Support Engineer at Microsoft --------------------------- This posting is provided "AS IS" with no warranties, and confers no rights.