IIS 7 and Above
Crashing w3wp.exe with ntdll.dll
Last post Jun 09, 2010 07:15 AM by Rovastar
May 11, 2010 04:29 AM|wouteronline55|LINK
I am a fairly unexperienced user of Windows Server 2008 Web with IIS 7. I run a web application on that server and it runs good.
However, sometimes w3wp.exe crashes and stops working (i noticed it in the Reliability monitor). The crashes are random: sometimes 3 days in a row and 3 times a day, then no crashes for 4 or 5 days.
I looked up the crash in the Application Windows Log and it says the following:
Faulting application w3wp.exe, version 7.0.6001.18000, time stamp 0x47919413, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a783, exception code 0xc0000374, fault offset 0x000aada3, process id 0x1434, application start time 0x01caed1c3e3e0eb8.
I tried to Google the error but I can't define the right solution. As I said, I am not an experienced user of Windows Server.
Hope someone knows a solution or can get me started?
May 11, 2010 04:52 AM|lextm|LINK
Even if you are familiar with IIS, you may fail to dig further if you don't know how to analyze crash dumps.
Please try to capture an IIS crash dump and then share with someone who can analyze that. If you like, you can open a support case via
http://support.microsoft.com to involve Microsoft support team.
May 12, 2010 10:36 AM|wouteronline55|LINK
Thanks for the reply. I installed Debug Diagnostic Tool and added the crash from w3wp.exe as a rule. However, since then the process has crashed two times but there is no dump generated by Debug Diagnostic.
The tool indicates that the rule is active.
Since this is a remote server, i will log out after i am finished. After I log back in, the Debug Diagnostic tool is closed. Is it possible this is the reason why there is no dumb file created?
May 12, 2010 07:49 PM|lextm|LINK
May 13, 2010 05:40 AM|wouteronline55|LINK
May 13, 2010 06:25 AM|lextm|LINK
May 13, 2010 07:10 AM|wouteronline55|LINK
May 13, 2010 07:01 PM|lextm|LINK
May 17, 2010 04:20 AM|wouteronline55|LINK
I added the registry key including the values. The application log indicates that the process is crashed again, but I can't find the folder with the dumbs. I used the default folder: %LOCALAPPDATA%\CrashDumps. But when searching for 'CrashDumps', the folder
is nowhere to be found.
My configuration of the key:
Keyname: LocalDumbs (is onder HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/Windows Error Reporting
- Default (no value)
- DumpCount (10)
- DumpFolder (%LOCALAPPDATA%\CrashDumps)
- DumpType (2)
Is there something wrong with my configuration?
May 17, 2010 04:46 AM|lextm|LINK
May 17, 2010 04:56 AM|wouteronline55|LINK
I looked around on my hard drive, but can't find the dumb. It should appear when searching for 'crashdumps' (the folder name), right?
May 17, 2010 08:14 AM|lextm|LINK
May 17, 2010 12:20 PM|wouteronline55|LINK
May 17, 2010 07:37 PM|lextm|LINK
May 18, 2010 11:01 AM|wouteronline55|LINK
First off all: thanks for all the help! I did read the article and found out two things:
1. The crashdumps are not in the 'problem reports and solution window'. It only has erorros from last year and those were from other applications.
2. My \Windows Error Reporting folder in the register did not contain any of the settings mentioned in the article. So I added the most 'relevant' (see article) ones to the key.
Is this enough action taken, because I don't kwow exactly what the steps are with all the settings. There is only a list with the meaning, but no example of a rightly configured key.
If the application crashes again, I will let you know if a dump was created. Where will this dump show up? At the problem reports and solution window or in the folder you gave me 1 post earlier?
May 25, 2010 04:05 AM|wouteronline55|LINK
In the meanwhile the process crashed a couple of times but there is no Dumpfile created. Not in problem reports and solution window and not in the folder you gave to me earlier.
Any more ideas? Kind of strange that Windows can't simply create a dumb.
May 28, 2010 03:17 AM|wouteronline55|LINK
Any more thoughts?
May 28, 2010 09:03 AM|wouter@Coteng|LINK
Hi other wouter :)
I am having the same problems on IIS7.
In my case I am migrating an ASP.NET MVC application from IIS6 to IIS7.
This application uses a COM+ object to generate bitmap files.
I am debugging this on my server machine, and my code does the following :
Instantiate the COM object, and call a method to generate a file.
Once the call to the method happens, an image is generated and next the IIS crashes with the same error code as yours.
This code worked perfectly in IIS6 and inside the visual studio development server.
Is your error also COM related, or are you not sure?
May 28, 2010 09:07 AM|wouteronline55|LINK
Hi Wouter :-)
No, my applicition is not in ASP and does not use COM+.
Any other ideas maybe?
May 28, 2010 08:12 PM|lextm|LINK
May 31, 2010 07:31 AM|wouteronline55|LINK
What are the other approaches you speak off?
I also found this: http://support.microsoft.com/kb/286350/. Is that relevant for my case?
Jun 04, 2010 11:17 AM|wouteronline55|LINK
Jun 04, 2010 11:39 AM|Rovastar|LINK
ADplus and other tools are useful. But Lextm has covered most scenerios and with any complex case a support call is useful. They do get heavy going and very few people outside microsoft will really be able to understand them. The best you can really hope
for are clues. Process Monitor is useful for realtime investigations but as you cannot reproduce this error that will be difficult.
But before you do dumps are there any other clues in the behaviour. Any pattern in what was happening at the time? Event, IIS, http logs? Often there will be a similiar behaviour and maybe you can recretae the problem. Recreating the problem is normally
one of teh first steps in detailed troubleshooting.
Jun 07, 2010 08:34 AM|wouteronline55|LINK
I already thought about some patterns in the behavior. Lot of the crashes are at night, but not on the same time. This rules out that a user can trigger the error (almost no visitors at nighttime), but it also rules out a cron job (then the same time should
be the case).
I used every inch of the application that is running on the server to see if I can trigger the error with a specific function, but that was not the case.
Is there a log in IIS/Windows server which says witch PHP scripts/pages did run at a certain moment? Maybe I can find a clue there (that is if the error is triggered by a script)?
Jun 07, 2010 03:09 PM|cn411ca|LINK
We had same issue and just fixed it.
We just removed the newest 3rd-party control, then everything is OK now.
Jun 09, 2010 03:21 AM|wouteronline55|LINK
We don't use ABCPdf or any 3rd-party software. Except, we run Plesk to manage the webserver.
But there is no log which says me when witch PHP script has run?
Jun 09, 2010 07:15 AM|Rovastar|LINK
The IIS logs will tell you what pages are run and at what time.