IIS 5 & IIS 6
Strange failure in IIS6
Last post Jul 13, 2006 06:13 PM by ericdeily
Jun 15, 2006 08:53 AM|Wallym|LINK
Has anyone had a situation where an anti-virus program has caused IIS to
stop working? We are using Norton/Symantec Anti-Virus. The latest theory in our
ongoing problem is that the anti-virus is locking a file/directory and this
then blocks IIS from using a necessary file and then IIS fails. Has anyone
seen anything like this? We are looking at excluding IIS from scanning a
couple of directories, but before going through this, we are looking for
other people's experience with this type of issue. I am not 100% convinced that the anti-virus is actually causing the problem, I am just working with the info that the MS Support Engineer gave me at this time. Any thoughts are appreciated?
Other pieces of information:
Jun 16, 2006 11:39 AM|mvolo|LINK
Jun 17, 2006 02:54 AM|qbernard|LINK
Typically, in my previous asp setup, we exclude the .asa, .inc, etc from the virus scan, as this will trigger the app to recycled. Other than that, nothing much. Oh ya. script blocking is the other setting that may cause potential problem as well.
Jun 19, 2006 09:35 AM|Wallym|LINK
Jun 19, 2006 10:57 AM|chrisad|LINK
What is the event id and\or event desc when it does happened? Is this Service Pack 1 by chance? I know you gave details in the first thread but the reason I ask I was wondering if you have thought about using tracing? Although, it might be hard as it
doesn't sound like you have a lot to go on -
Also, can you set LogEventOnRecycle for the application pool in question -
cscript adsutil.vbs set w3svc/LogEventOnRecycle 255
This will ensure that if the apppool for some reason recycles (or fails) then a log event will be recorded in the system event viewer...
Jun 19, 2006 10:56 PM|Wallym|LINK
Here is the the event description that we have in the windows logs:
A process serving application pool 'DefaultAppPool' suffered a fatal communication error with the World Wide Web Publishing Service. The process id was '352'. The
data field contains the error number.
Is there anyway to reset the app pool when this happens? Unfortunately, I don't know enough about the IIS6 reliability features to know what is and is not possible.
The next question is "what is the data field?" as stated in the error message? What does that term refer to?
Jul 13, 2006 06:13 PM|ericdeily|LINK
Wally - if this happens frequently (i.e. 5 times in 5 minutes), you'd see another event saying that DefaultAppPool has suffered a flurry of failures and is being put into Rapid Fail Protection. This means you'd be getting 503's back for requests to that
pool and they'd actually be logged in the HTTPERR log file.
Now, as to why the WP is failing...I'd recommend you check out DebugDiag and create a crash rule. This event you indicate means the worker process crashed, and DebugDiag can help you figure out why. Check the numerious postings here on DebugDiag
-> it's a great tool.