Service terminated unexpectedlyRSS

2 replies

Last post Jul 13, 2020 03:44 AM by Yuk Ding

  • Service terminated unexpectedly

    Jul 11, 2020 04:08 PM|infra@egyptianbanks.net|LINK

    Alert description: The W3C Logging Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Run the configured recovery program.

    IIS start command received from user NT AUTHORITY\SYSTEM. The logged data is the status code.

    Event ID: 3201   Source: IIS-IISReset

    Please we need to identify the root cause.

    -------------------------

    Report.wer

    ---------------------------------------------------

    Version=1
    EventType=APPCRASH
    EventTime=132385321069708200
    ReportType=2
    Consent=1
    ReportIdentifier=c16ab7ec-bfb2-11ea-80e0-000c29534ed3
    IntegratorReportIdentifier=c16ab7eb-bfb2-11ea-80e0-000c29534ed3
    NsAppName=svchost.exe_w3logsvc
    Response.type=4
    Sig[0].Name=Application Name
    Sig[0].Value=svchost.exe_w3logsvc
    Sig[1].Name=Application Version
    Sig[1].Value=6.3.9600.16384
    Sig[2].Name=Application Timestamp
    Sig[2].Value=5215dfe3
    Sig[3].Name=Fault Module Name
    Sig[3].Value=w3logsvc.dll
    Sig[4].Name=Fault Module Version
    Sig[4].Value=8.5.9600.16384
    Sig[5].Name=Fault Module Timestamp
    Sig[5].Value=5215d69a
    Sig[6].Name=Exception Code
    Sig[6].Value=c0000005
    Sig[7].Name=Exception Offset
    Sig[7].Value=000000000000e628
    DynamicSig[1].Name=OS Version
    DynamicSig[1].Value=6.3.9600.2.0.0.272.7
    DynamicSig[2].Name=Locale ID
    DynamicSig[2].Value=1033
    DynamicSig[22].Name=Additional Information 1
    DynamicSig[22].Value=e675
    DynamicSig[23].Name=Additional Information 2
    DynamicSig[23].Value=e67595a1d2b6d5e97e781ff03864c663
    DynamicSig[24].Name=Additional Information 3
    DynamicSig[24].Value=efc9
    DynamicSig[25].Name=Additional Information 4
    DynamicSig[25].Value=efc9e4b23ba2098a0d6bf4908acc9553
    UI[2]=C:\Windows\system32\svchost.exe
    UI[5]=Check online for a solution (recommended)
    UI[6]=Check for a solution later (recommended)
    UI[7]=Close
    UI[8]=W3C Logging Service stopped working and was closed
    UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
    UI[10]=&Close
    LoadedModule[0]=C:\Windows\system32\svchost.exe
    LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
    LoadedModule[2]=C:\Windows\system32\KERNEL32.DLL
    LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
    LoadedModule[4]=C:\Windows\System32\SYSFER.DLL
    LoadedModule[5]=C:\Windows\SYSTEM32\sechost.dll
    LoadedModule[6]=C:\Windows\system32\RPCRT4.dll
    LoadedModule[7]=C:\Windows\system32\SspiCli.dll
    LoadedModule[8]=c:\windows\system32\inetsrv\apphostsvc.dll
    LoadedModule[9]=C:\Windows\system32\msvcrt.dll
    LoadedModule[10]=C:\Windows\system32\ADVAPI32.dll
    LoadedModule[11]=c:\windows\system32\inetsrv\iisutil.dll
    LoadedModule[12]=c:\windows\system32\inetsrv\nativerd.dll
    LoadedModule[13]=C:\Windows\SYSTEM32\combase.dll
    LoadedModule[14]=C:\Windows\system32\WS2_32.dll
    LoadedModule[15]=C:\Windows\SYSTEM32\XmlLite.dll
    LoadedModule[16]=C:\Windows\SYSTEM32\ktmw32.dll
    LoadedModule[17]=C:\Windows\system32\NSI.dll
    LoadedModule[18]=c:\windows\system32\inetsrv\IISRES.DLL
    LoadedModule[19]=C:\Windows\SYSTEM32\CRYPTSP.dll
    LoadedModule[20]=C:\Windows\system32\rsaenh.dll
    LoadedModule[21]=C:\Windows\system32\bcrypt.dll
    LoadedModule[22]=C:\Windows\system32\CRYPTBASE.dll
    LoadedModule[23]=C:\Windows\system32\bcryptPrimitives.dll
    LoadedModule[24]=C:\Windows\system32\ole32.dll
    LoadedModule[25]=C:\Windows\system32\GDI32.dll
    LoadedModule[26]=C:\Windows\system32\USER32.dll
    LoadedModule[27]=C:\Windows\SYSTEM32\kernel.appcore.dll
    LoadedModule[28]=C:\Windows\SYSTEM32\VSSAPI.DLL
    LoadedModule[29]=C:\Windows\SYSTEM32\VssTrace.DLL
    LoadedModule[30]=C:\Windows\SYSTEM32\DSROLE.dll
    LoadedModule[31]=C:\Windows\SYSTEM32\bcd.dll
    LoadedModule[32]=C:\Windows\SYSTEM32\clbcatq.dll
    LoadedModule[33]=C:\Windows\system32\mlang.dll
    LoadedModule[34]=C:\Windows\system32\OLEAUT32.dll
    LoadedModule[35]=C:\Windows\SYSTEM32\samcli.dll
    LoadedModule[36]=C:\Windows\SYSTEM32\netutils.dll
    LoadedModule[37]=C:\Windows\SYSTEM32\SAMLIB.dll
    LoadedModule[38]=C:\Windows\system32\es.dll
    LoadedModule[39]=C:\Windows\system32\PROPSYS.dll
    LoadedModule[40]=C:\Windows\SYSTEM32\sxs.dll
    LoadedModule[41]=C:\Windows\system32\vss_ps.dll
    LoadedModule[42]=C:\Windows\System32\msxml3.dll
    LoadedModule[43]=C:\Windows\SYSTEM32\sfc.dll
    LoadedModule[44]=C:\Windows\SYSTEM32\sfc_os.DLL
    LoadedModule[45]=C:\Windows\system32\SETUPAPI.dll
    LoadedModule[46]=C:\Windows\system32\CFGMGR32.dll
    LoadedModule[47]=C:\Windows\system32\DEVRTL.dll
    LoadedModule[48]=c:\windows\system32\inetsrv\w3logsvc.dll
    LoadedModule[49]=C:\Windows\system32\SHELL32.dll
    LoadedModule[50]=C:\Windows\system32\SHLWAPI.dll
    LoadedModule[51]=C:\Windows\SYSTEM32\ntmarta.dll
    FriendlyEventName=Stopped working
    ConsentKey=APPCRASH
    AppName=W3C Logging Service
    AppPath=C:\Windows\system32\svchost.exe
    NsPartner=windows
    NsGroup=windows8
    ApplicationIdentity=C60F4118C9F93D2D26760BEBEAB4D576

  • Re: Service terminated unexpectedly

    Jul 12, 2020 01:35 AM|lextm|LINK

    With that information it is impossible to tell the cause.

    Can you reproduce the crash reliably? If you can, then capture a crash dump and analyze further.

    Lex Li
    Affordable IIS Consulting Services at https://support.lextudio.com/services/consulting.html
    ---------------------------
    This posting is provided "AS IS" with no warranties, and confers no rights.
  • Re: Service terminated unexpectedly

    Jul 13, 2020 03:44 AM|Yuk Ding|LINK

    Hi infra,

    Please capture dump file with debug diagnostic tool. Please set a crash rule and reproduce this issue. Then we may find the root cause.

    https://www.microsoft.com/en-us/download/details.aspx?id=49924

    If you don't know how to analyze a dump file and this is making business impact, then please try to open a support ticket.

    https://support.microsoft.com/en-us/supportforbusiness/productselection

    Best Regards,

    Jokies Ding

    Yuk Ding

    MSDN Community Support
    Please remember to "Mark as Answer" the responses that resolved your issue.